Privacy Policy

Last update: February 06, 2026

1. Introduction

Welcome to CheckOP. This Privacy Policy ("Policy") describes how Progresus S.A.S. ("Progresus", "CheckOP", "we", "us", "our" or "our") collects, uses, processes, discloses and protects personal information collected through our SaaS platform available at https://app.checkop.co, the Android mobile application, application programming interfaces (APIs) and all related websites, networks and services (collectively, the "Service").

This Policy also tells you about your rights and choices regarding your information, and how you can contact us if you have any questions or concerns.

By accessing or using our Service, you are accepting the practices described in this Policy. If you do not agree to this Policy, please do not use our Service.

2. Roles in Data Processing

2.1 CheckOP as Data Controller

When you interact directly with us (for example, by creating an account, contacting support or visiting our website), CheckOP acts as the Controller of your personal data and is directly responsible for determining the purposes and means of the processing.

2.2 CheckOP as Processor

When our Business Customers (companies that contract our Service) use CheckOP to manage their operations, they collect personal information about their employees, contractors and end customers. In these cases, CheckOP acts as a Processor, processing personal data on behalf of and under the instructions of our Business Customers.

If you are an employee, contractor or end customer of one of our Business Customers and you wish to exercise your rights over your personal data, we recommend that you contact directly that Business Customer, who is the Data Controller of your data.

3. Personal Information We Collect

3.1 Information Provided Directly by You

Account Registration: When you register to use the Service, we collect your name, email address, password and, depending on the type of user, address or physical location. Optionally, you may add additional information such as a profile picture.

Payment Information: When you make payments through the Service, our payment service providers may collect information such as credit card number and billing address. Progresus does not store full credit card information on its systems.

User Content: We collect any information you upload or post through the Service, including:

• Data captured in dynamic forms.
• Photographs, videos and voice memos
• Digital signatures
• GPS location information associated with tasks
• Messages and communications within the platform.

Communications: We collect information you provide to us when you communicate with our technical support or customer service team.

Job Applications: If you apply for employment with Progresus, we will collect information contained in your resume, references and related documentation.

3.2 Information Collected Automatically

Location Information: When you use our mobile application and enable location services, we collect and store GPS coordinates for functionalities such as geolocation of tasks, tracking of personnel in the field, and location verification.

Device Information: We collect information about the device you use to access the Service, including hardware model, operating system, unique device identifiers and network information.

Cookies and Similar Technologies: We use session cookies and persistent cookies to automatically collect information about your use of the Service. This may include:

• IP address
• Browser and device type
• Pages visited and time spent
• Dates and times of access
• Interactions with the Service

Activity Logs: The Service automatically logs all actions performed on the system to provide full traceability, including accesses, modifications and operations performed.

3.3 Information Obtained from Third Parties

From Our Business Customers: If you are an end user of a Business Customer, we may receive information about you provided by that customer, including name, email address, telephone number and information necessary for the operation of the Service.

From Service Providers: We may receive information from service providers that help us operate our business, such as identity verification or analytics services.

4. How We Use Personal Information

We use the personal information collected for the following purposes:

4.1 Provision of the Service

• Operating, maintaining and providing all functionalities of the Service
• Create and manage user accounts
• Process and complete transactions
• Provide the services and information you request
• Manage the assignment, tracking and reporting of operational tasks

4.2 Service Improvement

• Understanding and analyzing usage trends and user preferences
• Improve the Service and develop new functionalities
• Perform statistical and performance analysis
• Monitor aggregated usage metrics

4.3 Communications

• Respond to your inquiries and comments
• Send administrative communications (service updates, policy changes)
• Send notifications related to your account and operations
• With your consent, send promotional communications

4.4 Security and Legal Compliance

• Protect the security and integrity of the Service
• Detect, prevent and respond to fraud, abuse or illegal activities
• Enforce our Terms of Service
• Comply with legal obligations and law enforcement requirements

4.5 Support and Assistance

• Provide technical assistance and customer support
• Resolve reported incidents and problems
• Provide training on the use of the Service

5. Legal Basis for Processing

We process your personal information on the following legal bases:

Performance of Contract: Where the processing is necessary to provide you with the Service in accordance with the accepted Terms and Conditions.

Consent: Where you have given your express consent for specific purposes, such as receiving promotional communications.

Legitimate Interest: Where we have a legitimate interest in processing your information, such as to improve the security of the Service, conduct business analysis or prevent fraud, provided that such interest does not override your rights and interests.

Legal Obligation: Where we are required by law to process your personal information.

6. How We Share Personal Information

6.1 With Our Business Customers

If you are an end user or end customer of a Business Customer, we may disclose information about you to such Business Customer as necessary to provide the requested services.

6.2 With Service Providers

We work with third party service providers who assist us with:

• Hosting and data storage (Amazon Web Services, Google Cloud Platform).
• Payment processing
• Analytics and monitoring
• Technical support

We limit the information provided to these providers to what is necessary to perform their functions and require them to maintain the confidentiality of such information.

6.3 Within the Business Group

We may share personal information with our affiliates and subsidiaries for the purposes described in this Policy.

6.4 As Legally Required

We may disclose personal information when:

• Is required by law or legal process
• It is necessary to respond to requests from public authorities
• We have a good faith belief that disclosure is necessary to protect our rights, your safety or the safety of others
• Is necessary to investigate possible violations of our Terms of Service

6.5 In Corporate Transactions

In the event of a merger, acquisition, reorganization, asset sale or bankruptcy, personal information may be transferred as part of business assets.

6.6 Non-Identifiable Information

We may share aggregated or anonymized information that does not identify individual users for business, research or analysis purposes.

6.7 What We DO NOT Do

• We do not sell personal information to third parties
• We do not share customer data with other customers.
• We do not use customer data to contact individuals or companies without express authorization.

7. International Data Transfers

The Service is hosted in data centers located in the United States, using Amazon Web Services (AWS) and Google Cloud Platform (GCP) services. If you access the Service from outside the United States, please note that your personal information will be transferred to and processed in the United States.

When we transfer personal information internationally, we implement appropriate safeguards to ensure an adequate level of protection, including:

• Approved standard contractual clauses
• Compliance with applicable privacy frameworks
• Assessment of recipients' security measures

8. Data Retention

8.1 During the Contractual Relationship

Customer data will be retained for as long as the customer remains an active customer with a current subscription.

8.2 After Termination

Paid customer data is deleted from the databases in real time within ninety (90) days after termination of the contractual relationship, upon written request from the customer.

8.3 Backups

Information stored in backups, snapshots and backups is not constantly purged, but ages naturally in the repositories according to the life cycle of the information.

8.4 Information Retained by Legal Obligation

We retain certain information, such as records and related metadata, to meet security, compliance or statutory regulations, even after termination of the contractual relationship.

8.5 Disposal on Request

Progresus platforms provide active customers with tools to delete their information if they deem it appropriate. Customers may request deletion of specific data or all of their information.

9. Data Security

9.1 Protection Measures

We implement physical, administrative and technical security measures designed to protect personal information, including:

Encryption - All sensitive interactions with CheckOP are encrypted in transit with TLS 1.0, 1.1, 1.1, 1.2 or 1.3 and 2048-bit or higher keys. Data at rest is encrypted using AES-256.

Access Control: We implement role-based access controls (RBAC) to limit access to information based on job requirements.

Secure Infrastructure: We use top-tier cloud infrastructure providers (AWS and GCP) that have SOC 2 Type II and ISO 27001 certifications.

Monitoring: We perform continuous security monitoring and vulnerability analysis.

Application Protection: We implement protection measures against common attacks following OWASP recommendations and protection against DDoS attacks.

9.2 User Authentication

The Service requires unique credentials for each user. Passwords must meet complexity requirements and multi-factor authentication is implemented where available.

9.3 Limitations

Despite our best efforts, no method of data transmission or storage is completely secure. We cannot guarantee the absolute security of information transmitted or stored on the Service.

9.4 Notification of Incidents

In the event of a security breach affecting your personal data, we will notify you as required by applicable law and take appropriate measures to mitigate the impact.

10. Your Rights and Choices

10.1 Access and Update

You may access, update or correct your profile information at any time through your account settings on the Service.

10.2 Data Subject Rights

Depending on your location and applicable laws, you may have the right to:

• Access: Request information about the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete Personal Data
• Erasure: Request the deletion of your personal data, subject to certain legal exceptions
• Restriction: Request restriction of the processing of your personal data
• Portability: Receive your personal data in a structured format and transfer it to another provider
• Opposition: Oppose the processing of your personal data for certain purposes.
• Withdrawal of Consent: Withdraw any consent previously granted, without affecting the lawfulness of the previous processing.

10.3 Exercising Rights

To exercise any of these rights, you may contact us through:

• Email: soporte@checkop.co
• Support Portal: https://support.checkop.co

We will respond to your request within the time limits established by applicable law. We may request additional information to verify your identity before processing your request.

10.4 Promotional Communications

You may opt out of receiving promotional communications by following the unsubscribe instructions included in such emails, or by contacting us directly. Please note that you will continue to receive administrative communications related to the Service.

10.5 Cookies

You can set your browser to refuse cookies or to alert you when cookies are being sent. However, some features of the Service may not function properly if you disable cookies.

11. Privacy of Minors

Our Service is not directed to children under the age of 16 and we do not knowingly collect personal information from children under the age of 16 without verifiable parental consent. If we learn that we have collected personal information from a minor without appropriate consent, we will take steps to delete such information.

If you are a parent or guardian and believe that your child under the age of 16 has provided us with personal information, you may contact us at soporte@progresus.co to request deletion of such information.

12. Links to Third Party Sites

The Service may contain links to third party websites or services. This Policy does not apply to such third party sites, which may have their own privacy policies. We encourage you to review the privacy policies of any third party sites you visit.

13. Changes to this Policy

We may update this Policy from time to time. When we make material changes:

• We will update the "Last Updated" date at the top of this Policy.
• We will post the updated Policy on the Service
• We will notify you by email or by a prominent notice on the Service, as appropriate

Your continued use of the Service following the posting of changes constitutes your acceptance of the modified Policy.

14. Contact

If you have questions, comments or concerns about this Privacy Policy or our privacy practices, you may contact us:

Progresus S.A.S.

• E-mail: soporte@checkop.co
• Support Portal: https://support.checkop.co
• Knowledge Base: https://conocimiento.checkop.co

We are committed to responding to your privacy inquiries in a timely manner and working with you to resolve any concerns you may have.

15. Supervisory Authority

If you believe that the processing of your personal data violates applicable data protection regulations, you have the right to file a complaint with the competent data protection authority in your jurisdiction.

In Colombia, the competent authority is the Superintendence of Industry and Commerce (SIC).

This Privacy Policy is aligned with good international data protection practices, including the principles of the General Data Protection Regulation (GDPR) as a reference, without implying a claim of absolute legal compliance with such regulations.