Grupo Circuito S.A.S., in compliance with Law 1581 of 2012, Decree 1074 of 2015 (Title 2.2.2.25), and the other regulations governing the protection of personal data in Colombia, adopts this Personal Data Processing Policy (the "Policy").
Last updated: 06/30/2026 Version: 1.0 Validity of the databases: for as long as the purpose that justified the collection subsists and/or the applicable legal retention period (see section 16).
This is an English translation provided for convenience. In the event of any discrepancy or conflict between this translation and the Spanish-language version, the Spanish version shall prevail, as this Policy is governed by the laws of the Republic of Colombia.
1. Identification of the Data Controller
Corporate name: GRUPO CIRCUITO S.A.S. (trade names: "AXV" and "AXV Racing").
Tax ID (NIT): 901.918.966
Domicile and address: Calle 106 # 13-35, Bogotá D.C., Colombia.
Email: axv@axv.com.co
Phone: +57 315 175 1101
Area responsible for attending to the Data Subject: AXV Data Protection Area (see section 14).
2. Purpose, Scope, and Acceptance
2.1. This Policy establishes the criteria, purposes, rights, procedures, and mechanisms for the Processing of the personal data of Data Subjects who interact with AXV through the website axv.com.co, its subdomains, the AXV application (the "App"), and the Company's other channels.
2.2. Acceptance. By using the App and/or the website, registering, or providing their data to AXV, the Data Subject expressly and on an informed basis accepts this Policy and authorizes the Processing of their personal data under the terms described herein. This general acceptance is understood without prejudice to the specific, separate, and independent authorizations required for particular purposes —especially geolocation (GPS) and commercial communications—, which are requested on a granular basis and are never bundled into a single checkbox.
2.3. This Policy is supplemented by the Privacy Notice and the Cookies and Tracking Technologies Policy.
3. Definitions
In accordance with Article 3 of Law 1581 of 2012:
Authorization: the Data Subject's prior, express, and informed consent to carry out the Processing.
Database: an organized set of personal data subject to Processing.
Personal data: any information linked to or that may be associated with a determined or determinable natural person.
Sensitive data: data that affects the Data Subject's privacy or whose improper use may generate discrimination (racial or ethnic origin, political orientation, religious convictions, health, sex life, biometric data, among others).
Data Processor: the person who carries out the Processing on behalf of the Controller.
Data Controller: the party that decides on the database and/or the Processing; in this Policy, Grupo Circuito S.A.S.
Data Subject: the natural person whose personal data is subject to Processing.
Processing: any operation on personal data (collection, storage, use, circulation, deletion, etc.).
Transfer: the sending of data to a Controller located inside or outside Colombia.
Transmission: the Processing of data on behalf of the Controller by a Processor, inside or outside Colombia.
4. Guiding Principles
AXV applies the principles of Article 4 of Law 1581 of 2012: legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security, and confidentiality. All Processing pursues a legitimate purpose, disclosed to the Data Subject and in accordance with the Constitution and the law.
5. Personal Data Collected
Depending on the channel and the relationship with AXV, the Company may process the following categories of data:
Identification and contact data: name, identity document, email, phone, country/city, shipping and billing address.
Account data: access credentials and preferences in the App.
Transaction data: purchase history, products purchased, and data necessary for dispatch. Full payment-method data is not stored by AXV; it is processed directly by the payment gateway (see section 9).
Vehicle data: vehicle identification number (VIN), reference, model, and technical configuration.
Operation logs: parameters and technical data from the electronic control unit generated during the use of the App and the Services.
Geolocation data (GPS): location used on a transitory basis and only when necessary for the generation of a log or equivalent function. Geolocation is not stored persistently once that purpose has been fulfilled (see sections 6 and 16).
Browsing data: IP address, device identifiers, usage data, and cookies, in accordance with the Cookies and Tracking Technologies Policy.
6. Sensitive Data and Reinforced Processing of Geolocation
6.1. As a general rule, AXV does not collect sensitive data. The Data Subject is not obliged to provide sensitive data and, where it is exceptionally required, the authorization will be explicit and for specific purposes, in accordance with Article 6 of Law 1581 of 2012.
6.2. Geolocation (GPS). Although geolocation does not constitute sensitive data in the categorical sense, AXV processes it with reinforced measures due to its capacity to reveal behavioral patterns: (i) it is requested through a specific, separate, and independent authorization; (ii) it is revocable at any time from the App or the device; (iii) it is used on a transitory basis and discarded once its technical purpose is fulfilled; and (iv) it is not used for purposes other than those disclosed.
7. Purposes of the Processing
7.1. Primary purposes (necessary for the relationship)
a) To manage the User's registration, account, and authentication. b) To process, dispatch, and track Product orders. c) To provide, calibrate, and support the reprogramming Services, including the generation and analysis of logs. d) To verify vehicle compatibility and prevent fraud. e) To attend to petitions, complaints, claims, and warranty requests. f) To comply with legal, accounting, tax, and regulatory obligations.
7.2. Geolocation purposes
g) To generate logs and technical functions that require location, under the reinforced terms of section 6.2 (subject to specific authorization).
7.3. Secondary purposes (optional)
h) To send commercial communications, promotions, news, and marketing content by electronic means (subject to specific, independent, and revocable authorization at any time). i) To carry out statistical analyses, product improvements, and segmentation, on an aggregated or pseudonymized basis where possible.
The Data Subject may decline the secondary purposes without this affecting the provision of the Products or Services.
8. Authorization of the Data Subject
8.1. Mechanism. Authorization is obtained on a prior, express, and informed basis, through an unequivocal electronic manifestation upon using the Platform, registering, checking the corresponding boxes, or voluntarily providing the data (Law 527 of 1999).
8.2. Granularity. The purposes of geolocation and commercial communications have independent authorization checkboxes, not pre-selected and revocable, separate from the general acceptance of this Policy.
8.3. Cases in which authorization is not required. In accordance with Article 10 of Law 1581 of 2012, authorization is not required for data required by a public entity in the exercise of its legal functions, data of a public nature, cases of medical or health emergency, Processing authorized by law for historical/statistical/scientific purposes, and data related to the Civil Registry.
8.4. Evidence. AXV retains the technical mechanisms that allow it to demonstrate the granting and conditions of the authorization.
9. Data Processors
AXV relies on third parties that process data on its behalf and under its instructions, subject to confidentiality and security duties. The categories of Processors include:
Cloud infrastructure and hosting: Google Cloud (storage and processing; see section 10).
Payment gateways: Bold and/or ePayco (payment processing; they directly process payment-method data as controllers/processors under their own policy).
Analytics and measurement: Google Analytics and Microsoft Clarity (website usage analytics).
Advertising and campaign measurement: Meta Platforms (Meta Ads/pixel), in accordance with the Cookies Policy.
Messaging and support providers: email and customer-service platforms (Meta's WhatsApp and our own email).
AXV endeavors to enter into the corresponding transmission contracts and/or data processing addenda with its Processors.
10. International Transfer and Transmission of Data
10.1. Given that AXV uses Google Cloud infrastructure, whose servers may be located in different countries depending on the provider's allocation, the Processing may involve the international transmission and/or transfer of personal data.
10.2. In accordance with Article 26 of Law 1581 of 2012, such operations are supported by: (i) the Data Subject's authorization, granted upon accepting this Policy; and/or (ii) the execution of data transmission contracts and contractual clauses with the provider (including Google's Data Processing Addendum —DPA— and the applicable standard contractual clauses), which ensure security and confidentiality standards equivalent to those required by Colombian regulations.
10.3. For Data Subjects covered by the GDPR, transfers outside the European Economic Area are based on valid transfer mechanisms (such as the Standard Contractual Clauses of the European Commission).
11. Rights of the Data Subject
In accordance with Article 8 of Law 1581 of 2012, the Data Subject has the right to:
a) Know, update, and rectify their data before AXV. b) Request evidence of the authorization granted. c) Be informed about the use given to their data. d) File complaints before the Superintendence of Industry and Commerce (SIC) for legal infringements. e) Revoke the authorization and/or request the deletion of the data when the legal principles, rights, and guarantees are not respected, or when there is no legal or contractual duty to retain it. f) Access free of charge their data subject to Processing.
For Data Subjects covered by the GDPR, the rights of portability, restriction of Processing, objection, and not to be subject to automated individual decisions with significant legal effects are additionally recognized.
12. AXV's Duties as Controller
AXV observes the duties of Article 17 of Law 1581 of 2012, including: guaranteeing the exercise of the Data Subject's rights, keeping the information under secure conditions, handling queries and claims within the legal terms, updating the information, informing the use given to the data, and using it only for the authorized purposes.
13. Procedure for Queries and Claims
13.1. Queries (Art. 14). The Data Subject or their successors-in-title may consult their data. The query will be addressed within a maximum term of ten (10) business days from its receipt. When this is not possible, the interested party will be informed, stating the reasons and the date of attention, which will not exceed five (5) business days following the expiry of the first term.
13.2. Claims (Art. 15). When the Data Subject considers that their data should be corrected, updated, or deleted, or detects a presumed breach, they may file a claim, which will be addressed within a maximum term of fifteen (15) business days from the day following its receipt. When this is not possible, the reasons and the date of attention will be communicated, which will not exceed eight (8) business days following the expiry of the first term. If the claim is incomplete, the interested party will be requested within the following five (5) days to remedy it; if two (2) months pass without a response, it will be deemed withdrawn.
13.3. Procedural requirement. The Data Subject may only file a complaint before the SIC once the query or claim procedure before AXV has been exhausted (Art. 16).
14. Service Channel for the Data Subject
The Data Subject may exercise their rights and file queries and claims through:
Email: axv@axv.com.co (subject: "Data Protection")
Physical address: Calle 106 # 13-35, Bogotá D.C., Colombia.
The request must contain: identification of the Data Subject, description of the facts and the right being exercised, notification address, and the documents to be relied upon.
15. Information Security
AXV adopts reasonable technical, human, and administrative measures to protect data against unauthorized access, loss, alteration, or fraudulent use, in application of the security principle. No measure guarantees absolute security; AXV manages incidents in accordance with applicable regulations and, where appropriate, will notify the competent authority and the affected Data Subjects.
16. Data Retention and Validity of the Databases
16.1. Data will be retained for as long as the purpose that justified its collection subsists and/or during the periods required by legal, accounting, tax, or contractual obligations.
16.2. Once the purpose has been fulfilled and the retention periods have expired, the data will be securely deleted or anonymized.
16.3. Geolocation (GPS): due to its transitory nature, it is not stored persistently beyond the moment at which the technical purpose that motivated it is fulfilled.
17. Processing of Minors' Data
The Platform is not directed at minors. The Processing of minors' data is exceptional in nature and, where applicable, will respond to their best interests and respect for their fundamental rights, in accordance with constitutional case law and Decree 1074 of 2015. AXV may delete data it identifies as belonging to a minor without the due authorization of the legal representative.
18. Cookies and Tracking Technologies
The use of cookies, pixels, and analytics and advertising tools (including Microsoft Clarity and Meta Ads) is governed by the Cookies and Tracking Technologies Policy, which includes the consent-management mechanism.
19. Provisions for Data Subjects Outside Colombia
When AXV offers Products or Services to Data Subjects resident in jurisdictions whose data protection regulations apply (for example, the GDPR in the European Union/EEA or the United Kingdom), AXV will attend to the rights and legal bases that such regulations recognize, without prejudice to the application of Colombian law as the principal framework. The legal bases may include the performance of the contract, consent, compliance with legal obligations, and legitimate interest, as appropriate.
20. Validity and Amendments
20.1. This Policy is effective from its publication date and will remain in force for as long as AXV processes data.
20.2. AXV may amend it to reflect legal, technical, or business changes; the version in force will always be the one published on the Platform, with its update date. Substantial changes affecting the authorized purposes will be communicated by reasonable means and, where the law so requires, a new authorization will be requested.
GRUPO CIRCUITO S.A.S. (AXV) — Tax ID (NIT) 901.918.966 Calle 106 # 13-35, Bogotá D.C., Colombia — axv@axv.com.co — +57 315 175 1101
This document must be read together with the Terms and Conditions, the Privacy Notice, and the Cookies and Tracking Technologies Policy.