Privacy Policy

Last updated: October 24, 2026

1. Data controller

PIXMAKER S.A.S. ("PIXMAKER"), with registered address at Calle 20 A # 78-62, Oficina 201, Medellín, Antioquia, Colombia, email gerencia@thepixmaker.com and telephone +57 321 758 4075, is the controller (responsable del tratamiento) of the personal data described in this Policy.

2. Legal framework

This Policy is issued in accordance with Colombian Law 1581 of 2012, Decree 1074 of 2015 (which incorporates Decree 1377 of 2013) and other applicable rules on personal data protection.

3. Personal data we process

Website contacts: name, work email, company name and main market submitted through our contact channels.
Client due diligence: identification data of legal representatives, authorized signatories, shareholders and beneficial owners (name, ID document, nationality, residence, contact details), PEP status, results of sanctions and adverse-media screening, and information on source of funds and source of wealth.
Transaction data: names and identifiers of payers and beneficiaries, bank account details, wallet addresses, amounts, currencies, dates, and supporting commercial documents (invoices, proformas, contracts).
Communications: emails, messages and records of meetings or video calls held with clients.
Technical data: IP address, browser and device information generated when the Website is accessed.

4. Purposes

PIXMAKER processes personal data for the following purposes:

Assessing and onboarding clients and verifying their representatives and beneficial owners.
Executing the Services, including sharing the data needed to process payments with payment providers, banks and blockchain networks.
Complying with anti-money laundering, counter-terrorist financing and sanctions obligations and policies, including screening, monitoring and reporting to competent authorities such as the UIAF.
Responding to information requests from banks, payment providers and other financial counterparties.
Preventing fraud and protecting the security of operations.
Invoicing, accounting, tax compliance and record keeping.
Communicating with clients and prospective clients about the Services.
Complying with legal obligations and orders from competent authorities.

5. Authorization

PIXMAKER processes personal data with the prior, express and informed authorization of the data subject, obtained through its onboarding documents and contact channels, except in the cases where Article 10 of Law 1581 of 2012 does not require authorization. When a client provides personal data of its representatives, shareholders, beneficial owners or beneficiaries, the client represents that it has obtained their authorization to share such data with PIXMAKER for the purposes of this Policy.

6. Sensitive data and minors

PIXMAKER does not intentionally request sensitive data. If identity verification by video call is carried out, it will be done only with the data subject's authorization; data subjects are not obliged to authorize the processing of sensitive data. PIXMAKER does not provide services to minors and does not knowingly process their data.

7. Recipients and transfers

PIXMAKER does not sell personal data. It may share personal data, only as needed for the purposes above, with:

Payment providers, banks and correspondent banks that execute payments.
Compliance service providers used for sanctions and PEP screening, blockchain analytics and payment tracking.
Technology, hosting and cloud providers.
Auditors and legal or professional advisors, under confidentiality obligations.
Competent authorities, when required by law or by an order of an authority.

Some of these recipients are located outside Colombia, including in the United States, Asia and Europe. International transfers and transmissions of personal data are made with the data subject's authorization or under the cases permitted by Article 26 of Law 1581 of 2012, and recipients are required to protect the data. Wallet addresses and blockchain transactions are recorded on public networks by their nature.

8. Retention

Personal data related to clients and transactions are retained for ten (10) years after the end of the relationship or the date of the transaction, or longer where required by law, an authority or a pending investigation or dispute. Other data are retained only for as long as necessary for the purpose for which they were collected.

9. Security

PIXMAKER applies technical, human and administrative measures to protect personal data against unauthorized access, loss, alteration or misuse, including role-based access controls, confidentiality obligations and traceability of compliance records.

10. Rights of data subjects

Under Article 8 of Law 1581 of 2012, data subjects have the right to:

Know, update and rectify their personal data.
Request proof of the authorization granted.
Be informed, upon request, of how their data have been used.
File complaints with the Superintendencia de Industria y Comercio (SIC) after exhausting the procedure before PIXMAKER.
Revoke the authorization and/or request deletion of their data, when there is no legal or contractual duty to keep them.
Access their personal data free of charge.

11. How to exercise your rights

Requests must be sent to gerencia@thepixmaker.com, indicating the data subject's name, identification, contact details, a description of the request and any supporting documents.

Inquiries will be answered within ten (10) business days from receipt. If this is not possible, the data subject will be informed of the reasons and the response will be given within five (5) additional business days.
Claims (correction, update, deletion or alleged breach) will be answered within fifteen (15) business days from receipt. If this is not possible, the data subject will be informed and the response will be given within eight (8) additional business days. If a claim is incomplete, the data subject will be asked to complete it within five (5) days; if it is not completed within two (2) months, the claim will be deemed withdrawn.

The area responsible for handling these requests is PIXMAKER's Compliance function.

12. Cookies

The Website does not use advertising cookies. It may use strictly necessary technical cookies to operate properly. If PIXMAKER introduces analytics or other cookies, this Policy will be updated accordingly.

13. Validity and changes

This Policy is effective from October 24, 2026. Personal databases will remain in force for as long as PIXMAKER carries out its business activity and the purposes described in this Policy subsist. Any material change will be published on the Website before it takes effect.