Privacy Policy and Personal Data Processing Policy

Version 1.1 · Effective November 6, 2026

1. Who is responsible for your data

Garita Lab is a robotics and artificial intelligence academy for kids and teens aged 6 to 17 in Cartagena, Colombia. It is a project of Future Tales. The data controller (in Colombian law, the "Responsable del Tratamiento") is:

• Legal name: Future Tales, LLC
• EIN (US tax ID): 92-3591159
• Address: 2107 NW 142nd Way, Pembroke Pines, FL 33028, USA
• Privacy contact email: datos@garitalab.com
• Phone: +1 551 587 0112
• Website: https://garitalab.com

Privacy questions, requests and complaints are handled by the Garita Lab Data Protection team at datos@garitalab.com.

2. Who this policy applies to

This policy explains how we handle personal data we receive through https://garitalab.com. It applies to parents and legal guardians who contact us, and to the children and teens whose information they share with us.

We follow Colombian data protection law, including Law 1581 of 2012 and Decree 1377 of 2013 (now part of Decree 1074 of 2015). Because the site can also be visited from the United States, we also follow the Federal Trade Commission's Children's Online Privacy Protection Rule (COPPA, 16 CFR Part 312). In Colombia, the data protection authority is the Superintendence of Industry and Commerce (SIC).

This page is both our data processing policy and our privacy notice.

3. What data we collect

What you enter in the enrollment form

The form must be filled out by the child's parent or legal guardian, who must confirm they are 18 or older. We ask for:

• Parent or guardian's name.
• WhatsApp or phone number.
• Email address (optional).
• The child's first name.
• The child's age (6 to 17).
• Program of interest (optional).
• A free-text message (optional).

Please do not include health information or other sensitive data in the message. We never ask for sensitive data. If you include it anyway, we will not use it for anything and will delete it once we notice it.

Record of your consent

When you submit the form, we keep a record of your authorization: the date and time, the version of this policy, and the exact consent text you accepted. We also record whether you opted in to receive news. We need this record to show, if you or the SIC ask, that we have your authorization.

Technical data

As with any website, our hosting provider (Vercel) receives basic technical data when you visit the site or submit the form, such as your IP address and the date and time of the request. This is used only to run and secure the site. We do not use it to identify you or track your behavior.

What we do not collect

• We do not ask for the child's last name, photos, ID documents, home address or school through the site.
• We do not collect anything typed into the Tale chat (see section 7).
• We do not use cookies, analytics, social media pixels or advertising (see section 8).

4. Children's and teens' data

Colombian law gives special protection to minors' data (Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013). That is why:

• We only process the child's first name and age, and only with the authorization of their parent or legal guardian.
• We use this data only to suggest the right group and program for the child's age, always in the child's best interests and respecting their fundamental rights.
• Answering questions about a minor's data is optional: you are not required to provide it. Without the child's age, however, we cannot recommend a group. If you prefer not to use the form, you can email us at datos@garitalab.com.
• We ask that, depending on your child's age and maturity, you tell them what information you are sharing with us and why, and take their opinion into account. This respects their right to be heard.
• Children should not fill out the form. If we learn that a minor sent us information without their parent or guardian, we will delete it.

5. How we use the data

We use the data only to:

1. Contact you to answer your request and give you information about enrollment, groups, schedules and prices.
2. Manage your child's enrollment, if you decide to enroll.
3. Send you a confirmation that we received your request, if you gave us an email address.
4. Keep the record of your consent and handle your privacy requests.
5. Only if you opted in separately: send you news and promotions about Garita Lab programs (see section 6).

What we do not do with your data:

• We do not sell or rent it.
• We do not share it with other companies for their marketing.
• We do not build profiles or make automated decisions about you or your child.
• We do not show advertising on the site.

6. News and promotional messages

The form has a separate, optional checkbox to receive news and promotions about Garita Lab programs by WhatsApp or email. If you leave it unchecked, we will only contact you to answer your enrollment request.

If you check it, we follow Colombia's Law 2300 of 2023:

• We only contact you through the channels you gave us (WhatsApp or email).
• We only send messages Monday to Friday between 7:00 a.m. and 7:00 p.m., and Saturdays between 8:00 a.m. and 3:00 p.m. (Colombia time). Never on Sundays or public holidays.
• We commit to sending at most one message per week on each channel.

You can withdraw this permission at any time, free of charge: reply to any message asking us to stop, or write to datos@garitalab.com. Withdrawing it does not affect your request or your child's enrollment.

7. The Tale assistant

Tale is Garita Lab's mascot and has a chat on the site. The chat runs entirely in your browser, using pre-written answers:

• What is typed in the chat is not sent to any server.
• It is not stored, and we cannot see it.
• It is not used to train artificial intelligence.

Even so, the chat reminds users not to type personal information such as full names, phone numbers or addresses.

8. Cookies and browser storage

The site uses no cookies, no analytics tools, no advertising trackers and no social media pixels. Fonts and images are hosted on our own site, so your browser does not contact third-party services to load them.

We only use one small item in your browser's session storage (sessionStorage), called tale-seen. It remembers that you already closed Tale's greeting so it is not shown again while you browse. It is strictly functional, stays on your device, is never sent to us, and is cleared when you close the tab or browser.

9. Service providers and international transfers

To run the site and the form, we use these service providers, which act as data processors (in Colombian law, "Encargados del Tratamiento"). They only process data on our instructions and to provide their service to us:

• Vercel Inc. (United States): hosts the website and runs the function that receives the form.
• Resend (United States): delivers email. It forwards the form contents to the Garita Lab team inbox and, if you gave us an email address, sends you a confirmation.
• ImprovMX (United States): forwards email sent to garitalab.com addresses to the team inbox.
• Google LLC (United States), through Google Workspace: hosts the team's email inbox, where we receive requests.

This means your data is transmitted to and processed in the United States. By accepting this policy, you authorize that international transmission. The United States is on the SIC's list of countries with an adequate level of data protection. We also require these providers to maintain appropriate security measures.

Apart from these providers, we do not share your data with third parties, unless a competent authority lawfully orders us to.

10. Security

We protect your data with reasonable measures, including:

• The whole site uses an encrypted connection (HTTPS) and HSTS, which tells browsers to always use that secure connection.
• Only authorized Garita Lab staff can see enrollment data, and only for the purposes in this policy.
• We have a written information security program: it has a designated person in charge, and we assess risks and update our safeguards at least once a year.
• We collect as little data as possible and delete what we no longer need.

No system is 100% secure. If an incident affects your data, we will act quickly and notify the SIC and the people affected when the law requires it.

11. How long we keep data

This is our data retention policy. For each kind of data, it says why we keep it, why we need it and when we delete it. We do not keep data indefinitely.

• Enrollment request, if your child does not enroll (your details, your child's first name and age, and your message). Why we keep it: to answer you and offer a group. Why we need it: many families pick up the enrollment months later. When we delete it: no later than 24 months after our last contact with you.
• Enrollment data, if your child enrolls. Why we keep it: to organize groups and contact you about classes. Why we need it: we can't provide the service without it. When we delete it: no later than 12 months after your child's last class.
• Payment and billing records (the payer's name, amounts, dates and invoices; they do not include your child's age). Why we keep them: accounting and taxes. Why we need them: the law requires us to keep them. When we delete them: when the legal period ends, which can be up to 10 years.
• Record of your consent. Why we keep it: to show that you authorized us. Why we need it: the law requires us to be able to prove it. When we delete it: together with the data it covers. If a request, complaint or investigation is open, we keep it until it is resolved.
• WhatsApp or email messages about the enrollment follow the same timeframes as the request or enrollment they relate to.
• News: if you withdraw permission to receive news, we stop sending it right away. We only keep your number or email on an opt-out list, so we don't contact you again, for as long as we send news.
• Copies held by our providers: Resend keeps a copy of sent emails for a short period, depending on its plan (up to 30 days). Vercel's technical logs do not include form data.

You can ask us to delete your data sooner (see section 12).

12. Your rights

As the data subject, or as your child's legal representative, you have the right to:

1. Know, update and correct your data.
2. Ask for proof of the authorization you gave us.
3. Be told, on request, how we have used your data.
4. File complaints with Colombia's Superintendence of Industry and Commerce (SIC) about violations of the law, after first making your request or complaint to us.
5. Withdraw your authorization and ask us to delete your data, unless we have a legal or contractual duty to keep it.
6. Access your data free of charge.

13. How to exercise your rights

Write to us at datos@garitalab.com. You can also call +1 551 587 0112 or send a letter to 2107 NW 142nd Way, Pembroke Pines, FL 33028, USA. There is no charge.

Your request should include:

• Your full name and, if you are acting for your child, the child's first name.
• The phone number or email you used in the form, so we can find your data.
• What you are asking for (for example, to see, correct or delete your data) and, for a complaint, what happened.
• An email or address where we can reply.
• Any documents you want to attach.

To protect your data, we may ask for additional information to confirm that you are the data subject or the child's legal representative.

Inquiries

An inquiry ("consulta") is when you want to know what data we hold and how we use it. We answer within 10 business days of receiving it. If we cannot meet that deadline, we will tell you before it expires, explain why, and answer within 5 more business days.

Complaints

A complaint ("reclamo") is when you want to correct, update or delete your data, withdraw your authorization, or believe we are not complying with the law.

• We answer within 15 business days from the day after we receive it. If we cannot meet that deadline, we will tell you before it expires, explain why, and answer within 8 more business days.
• If information is missing, we will ask you for it within 5 days of receiving the complaint. If 2 months pass without a reply, we will treat the complaint as withdrawn.
• While we resolve it, we will flag your data as "complaint in progress".

If you are not satisfied with our answer, you can contact the SIC (www.sic.gov.co).

14. Parents in the United States (COPPA)

If you live in the United States, COPPA gives you additional rights over the personal information of your children under 13. On this site, the information comes from you, the parent, not from your child, and we only collect your child's first name and age.

• You can ask us what information about your child we hold, and review it.
• You can ask us to delete it.
• You can refuse to let us collect or use it any further.

We do not disclose your child's information to third parties, other than the technical service providers listed in section 9, which only process it so the form works. If we ever wanted to share it with any other third party, we would first ask for your separate consent.

To exercise these rights, contact Future Tales, LLC, 2107 NW 142nd Way, Pembroke Pines, FL 33028, USA; email datos@garitalab.com; phone +1 551 587 0112. Before showing you or deleting any data, we will verify that you are the child's parent or legal guardian.

15. For kids and teens

Hi! If you are under 18, ask your mom, dad or the adult who takes care of you to fill out the form for you. We only ask for your first name and your age, so we can find the group where you will have the most fun. When you chat with Tale, don't type your full name, address or phone number: Tale doesn't save anything, but it's a smart habit online. If you have questions, ask a trusted adult, or write to us together at datos@garitalab.com.

16. Changes to this policy

We may update this policy, for example if we change providers or add a feature to the site. When we make an important change, we will post a visible notice on the site before it takes effect and update the version and effective date at the top of this page. If a change affects the purposes for which we use your data, we will ask for your authorization again.

17. Effective date and language

This policy is effective as of November 6, 2026 (version 1.1). Our databases will remain in use for as long as Garita Lab provides its services and for the retention periods described in section 11.

This English version is provided for convenience. In Colombia, and if there is any difference between versions, the Spanish version prevails.