Personal Data Processing Policy

This policy describes how Walden Lab collects, uses, stores, and protects the personal data of the people who use the platform, in compliance with Law 1581 of 2012, Decree 1074 of 2015 — which compiles the regulations on personal data protection, including the former Decree 1377 of 2013 — and other Colombian habeas data rules.

It is written to be understood. If anything is unclear, write to us at julian.cifuentes@thewaldenlab.com and we will explain it.

Note on language. This is a courtesy translation. Walden Lab operates under Colombian law, and the Spanish version of this policy is the binding one. In the event of any discrepancy between the two, the Spanish text prevails.

---

1. Data Controller

• Controller: Julián Cifuentes, natural person.
• Tax ID (NIT): 1.032.446.532-9
• Trade name: Walden Lab
• Domicile: Bogotá, Colombia
• Address for notices: Calle 81 #113-46, Bogotá, Colombia
• Email: julian.cifuentes@thewaldenlab.com
• Phone: +57 3112149132
• Area responsible for queries and claims: Walden Lab Administration, at the email address above.

2. Definitions

• Data subject: the natural person whose personal data is processed — that is, you.
• Personal data: any information linked to an identified or identifiable natural person.
• Sensitive data: data affecting privacy, or whose misuse may lead to discrimination (health, sex life, biometric data, ethnic origin, political or religious beliefs).
• Processing: any operation on personal data (collection, storage, use, circulation, deletion).
• Processor: a party that processes data on behalf of and under the instructions of the Controller, without deciding what it is used for (see section 7).
• Independent controller: a third party that, upon receiving data, decides for itself the purposes and means of processing, and answers to you for it (see section 7).
• Authorization: the data subject's prior, express, and informed consent.

3. What data we collect

We only collect what the platform needs in order to work.

Account and identification data. Full name, email address, and password. The password is not stored: our authentication provider keeps only a hash of it — the result of an irreversible cryptographic function that cannot be used to reconstruct the original password. Nobody at Walden Lab can read it, not even the administrator.

Purchase data. Courses purchased, amount, date, payment status, and transaction reference. We do not store credit or debit card data: financial details are entered directly into the payment gateway (Wompi), never pass through our servers, and are not saved in our database.

Academic activity data. Course progress, completed lessons, answers to exercises and quizzes, workshop submissions, grades and instructor feedback, attendance at live classes, and accumulated points.

Usage and activity-pattern data. To know whether the platform is working for you and to improve it, we record how you interact with course tasks: when you start an activity after it becomes available, how long you work on it actively, across how many sessions you return to it, and how far ahead of its deadline you submit it. Active time is estimated from a periodic signal (roughly every 30 seconds) that only counts when the course page is visible and there has been recent interaction; we do not read what you type or capture your screen. This data describes the way you study —not your performance— and is not used to grade you.

Content you generate. Messages in discussion forums, questions and conversations with the platform's artificial intelligence assistants, files you upload as submissions, and comments addressed to instructors.

Image and voice. If you take part in a live class with your camera or microphone on, and the session is recorded, your image and voice will be in the recording (see section 6).

Requests and proceedings. The content of your petitions, complaints, and claims (PQR), their case number, and our response.

Compliance records. The proof of your authorization: which version of this policy and of the terms you accepted, and when. The law gives you the right to ask us for that proof, and to give it to you we have to keep it.

Technical and security data. Access logs, IP address, browser and device type, logs of calls made to the AI models, backups, and information stored in cookies (see section 13).

4. What we use your data for (purposes)

We process your personal data in order to:

1. Create and manage your account, and authenticate your access to the platform.
2. Process course purchases, issue the receipt, and activate your enrollment once payment is confirmed.
3. Deliver the educational service: give you access to content, track your progress, grade your submissions, and issue attendance certificates.
4. Personalize and improve your learning experience: adapt the operation of the artificial intelligence assistants (see section 8) and understand your usage and activity patterns to make the platform more useful.
5. Administer the points and discounts granted by the platform.
6. Organize live classes and, where applicable, their recordings (see section 6).
7. Communicate with you about course matters: announcements, reminders, schedule changes, and responses to your requests.
8. Handle your petitions, complaints, and claims, and keep a record of their processing.
9. Moderate the forums and community spaces.
10. Prevent fraud, unauthorized access, and abusive use of the platform.
11. Generate backups and audit logs.
12. Preserve contractual evidence and defend or pursue claims.
13. Comply with legal, accounting, and tax obligations, and respond to requests from competent authorities.
14. Analyze technical errors and platform stability.
15. Produce aggregate statistics to improve the courses. These statistics are built in anonymized form, so that it is not reasonably possible to re-identify you from them.
16. Send you information about new courses and content, only if you authorize it separately. This authorization is not a requirement for purchasing or for accessing your courses, and you may withdraw it at any time.

We do not sell your personal data to third parties. Ever.

5. Sensitive data

Walden Lab does not request sensitive data in order to provide its services. We do not need to know your health status, your beliefs, your ethnic origin, or your private life, and we will not ask for them. You are not obliged to authorize the processing of sensitive data.

That said, let us be candid: the platform has free-text fields — forums, workshops, submissions, and AI assistants — and nothing technically prevents someone from typing sensitive information into them. So, even though we do not request it, we could receive it incidentally. If we detect sensitive information or third-party data in those spaces, we may block, restrict, or delete it.

If some exceptional activity were to require processing sensitive data, we would ask you for prior, express, and specific authorization for it, and we would tell you that you are not obliged to give it.

Important notice for psychology professionals

Most of our students are psychologists. The platform's forums, workshops, and AI assistants are not a clinical or confidential environment. By using them, you agree not to share identifiable information about your patients or clients (names, clinical records, contact details, or any data that could identify them). If you need to use a real case as an example, anonymize it completely.

You are responsible for holding any authorizations you need and for anonymizing the cases you use for educational purposes, in accordance with Law 1090 of 2006. The foregoing does not exclude Walden Lab's own obligations as Controller with respect to any personal data it may process.

6. Live classes and recordings

Classes are taught live over Zoom and are recorded. The recording is later published inside the platform so you can review it, or watch it if you could not attend.

This means that if you take part with your camera or microphone on, your image, your voice, and your contributions will be in the recording and may be seen by the other students on your course.

• You may take part with your camera off. Turning it on is never mandatory.
• If you prefer not to appear, you can type your questions in the chat.
• The recording is available only to students enrolled in that course, and for the access period stated on the course page.
• You may not redistribute the recording outside the platform (see the Terms).
• If we wanted to use an excerpt for promotional purposes, we would ask you for separate, express authorization. General acceptance of this policy is not enough for that.

7. Processors and third parties we share data with

To operate, we rely on technology providers. They do not all play the same legal role, and the difference matters to you, because it determines who you complain to.

Data Processors

They process your data on our behalf and under our instructions, under the data processing agreements (DPAs) signed with each of them. They do not decide what it is used for.

Independent controllers

They receive data and, over it, decide on their own: they have their own purposes and legal obligations, which we neither control nor can limit by contract. Their own privacy policy applies to that processing.

We may also disclose data to judicial or administrative authorities when a legal order requires us to do so.

8. The artificial intelligence assistants

The platform uses Anthropic's AI models to support you in class preparation, workshops, discussions, and reminders. You should know exactly what happens when you use them.

What is sent to Anthropic. The text you write, the history of that conversation, and the academic context of the activity: the course and lesson title, and the learning objective being worked on.

What is NOT sent. Your name and your email address are not sent. Anthropic receives the content of the conversation, not your identity.

What we do with the conversation. We store it in our database, to give continuity to the dialogue, to let your instructor support your process, and to sustain the points system.

Automated decisions: let us be clear. The assistant evaluates your preparation answers, and that evaluation affects the points you earn, which in turn translate into discounts. It is therefore an automated decision with an economic effect, and we are not going to pretend otherwise. Accordingly:

• Points do not affect your grade, your certificate, or your standing in the course — only the discount.
• Your instructor can review and correct any evaluation made by the assistant.
• If you believe the assistant assessed you wrongly, you can request human review by writing to julian.cifuentes@thewaldenlab.com. We will carry it out.

Model training. We use Anthropic's commercial API, whose current terms state that customer inputs and outputs are not used to train its models by default. Anthropic may retain them for a limited time for safety and abuse-prevention purposes, in accordance with its own policies.

What you must not write to it. Identifiable information about patients or clients, or confidential third-party data (see section 5).

9. International data processing

Several of the providers in section 7 process data outside Colombia, mainly in the United States. Colombian law distinguishes two figures, and both apply to us:

International transmission. When a provider processes your data exclusively on our behalf and under our instructions — the case of the Processors listed above — the operation is a transmission, and it is governed by the data processing agreements (DPAs) we have signed with each of them. Those contracts, and not an additional authorization from you, are what enable it and what oblige the provider to maintain the security and confidentiality of your data.

International transfer. When a third party decides the purposes of processing on its own — the independent controllers — the communication may constitute a transfer. In those cases we apply the conditions, authorizations, or exceptions required by Colombian law, including the one allowing a transfer when it is necessary for the performance of the contract you have with us: without processing the payment there is no course to deliver.

In both cases we maintain reasonable contractual and security measures with providers that process data outside Colombia.

10. Minors

The platform is aimed at professionals and therefore at people over 18 years of age. When you register you expressly declare that you are at least 18, and this is recorded in the checkbox you accept.

We do not knowingly collect data from minors. If we have reason to believe an account belongs to a minor, we may suspend it as a precaution while we verify the situation, and we will delete the data where appropriate, except what we must keep by legal obligation. If you believe a minor has created an account, write to us at julian.cifuentes@thewaldenlab.com.

11. Your rights as a data subject

Law 1581 of 2012 guarantees you the following rights:

1. To know, consult, and access free of charge the personal data we process about you.
2. To update and correct data that is incomplete, inaccurate, fragmented, out of date, or misleading.
3. To request proof of the authorization you granted us, except where the law does not require it. (We keep it: see section 3, "Compliance records".)
4. To be informed, upon request, about how we have used your data.
5. To file complaints with the Superintendence of Industry and Commerce (SIC) for breaches of the law.
6. To revoke your authorization and/or request deletion of your data, where no legal or contractual duty requires us to keep it.

12. How to exercise your rights: queries and claims

Who may request it. The data subject, their successors, their legal representative, or their attorney-in-fact. If you act on behalf of another person, provide proof (power of attorney, civil registry, or the appropriate document).

Through which channel. Through the platform's PQR form, or by writing to julian.cifuentes@thewaldenlab.com. In both cases you will receive a case number with the date and time, which lets you follow up and serves as proof that you filed the claim.

Write to us from the email address you registered with (or attach a document proving your identity), clearly describe what you need, and attach any supporting documents. If the request is not ours to handle, we will tell you and forward it to whoever is competent, where possible.

If it is a query — you want to know what data we hold about you:

We respond within a maximum of ten (10) business days. If that is not possible, we will tell you why and when we will respond, which will be no later than five (5) business days after the first deadline expires.

If it is a claim — you want to correct, update, or delete data, or you believe we have breached the law:

We respond within a maximum of fifteen (15) business days counted from the day after we receive it. If that is not possible, we will inform you of the reason and the new date, which will be no later than eight (8) business days after the first deadline expires.

Once a complete claim is received, we will add a note reading "Claim in progress" to the database, together with its reason, within two (2) business days. The note remains until the claim is resolved (article 15 of Law 1581 of 2012).

If the claim arrives incomplete, we will let you know within five (5) days so you can complete it. If two (2) months pass without a response from you, the claim will be considered withdrawn.

Before going to the SIC

The law (article 16 of Law 1581 of 2012) requires you to first exhaust the claim procedure with us. If we do not respond, or if you are not satisfied with our response, you may file your complaint with the Superintendence of Industry and Commerce.

13. Cookies and local storage

These are all the cookies and storage the platform uses:

We do not use advertising, analytics, or cross-site tracking cookies. There is no Google Analytics, no pixels, no third-party tracking tools: they are not installed on the site. Since every cookie we use is necessary for the platform to work, there is nothing optional to accept or reject — which is why we do not show you a cookie banner asking permission for something we do not do.

Class videos are embedded from YouTube in its privacy-enhanced mode (youtube-nocookie.com), which does not set tracking cookies when the lesson loads and does not feed Google's ad personalization.

You can block cookies in your browser, but in that case you will not be able to log in.

14. Data retention

We keep each piece of data only for as long as is reasonable and necessary for the purpose that justifies it. Specifically:

Once those periods have elapsed, the data is deleted or anonymized.

15. Information security

We apply reasonable technical and administrative measures to protect your data: encryption of communications (HTTPS), passwords stored using irreversible cryptographic functions, and access control based on roles and on the principle of least privilege, with row-level security policies in the database, so that each user and each authorized member of the team accesses only the information necessary for their role. This means that authorized staff — instructors, administration, and support — can access the data their work requires.

No system is infallible. If a security incident occurs, we will investigate it, take containment and remediation measures, keep the corresponding record, and report it to the Superintendence of Industry and Commerce where legally required. We will inform you when the law requires it, or when the nature and risk of the incident make it reasonable to tell you.

16. Changes to this policy

We may update this policy. When a change is substantial, we will notify you by email or through a visible notice on the platform before it takes effect.

If a change introduces new purposes that are not reasonably compatible with the authorization you already gave us, we will ask you for a new authorization before applying those purposes to data we already held. Merely notifying you is not enough.

The version and date of the last update always appear at the top of this document, and the version you accepted is recorded together with your consent.

17. Effective date

This policy is effective as of 17 July 2026.