✦ Lords Barbershop · Legal document
Personal Data Processing and Protection Policy
PERSONAL DATA PROCESSING AND PROTECTION POLICY
Courtesy translation — the Spanish version prevails. This English text is provided for convenience only. The only legally binding version of this Policy is the Spanish original published at https://barberialords.com/tratamiento-de-informacion/. In case of any discrepancy, the Spanish version prevails. (Translation pending review by the Legal Department.)
BARBERIAS LORDS LATAM SAS
Version 1.0 · FINAL, APPROVED BY MANAGEMENT
Approval date: September 8, 2026
Approved by: Hernando Luque Ariza · Legal Representative
Publication: document ratified by the Legal Department and published
1. Data Controller
| Field | Value |
|---|---|
| Company name | BARBERIAS LORDS LATAM SAS |
| Tax ID (NIT) | 901565132-7 |
| Registered office | Bogotá D.C., Colombia |
| Address | CL 109 18 C 17 OF 606 |
| Email for data protection requests (habeas data) | juridico@lainmobiliaria.com.co |
| Phone | +57 321 843 6887 |
| Area responsible for requests | Legal Department of the business group |
| Legal representative | Hernando Luque Ariza |
| Publication URL (binding version) | https://barberialords.com/tratamiento-de-informacion/ |
BARBERIAS LORDS LATAM SAS (hereinafter “LORDS” or “the Company”) is the Data Controller of the personal data for which it determines the purposes and means of Processing.
This Policy applies to the current and future activities, brands, formats, locations, establishments, platforms and channels operated directly by BARBERIAS LORDS LATAM SAS.
The opening, relocation, renaming, closing or addition of a new LORDS location or format does not by itself modify this Policy, provided that BARBERIAS LORDS LATAM SAS remains the same Controller and there is no material change in the purposes, data categories, retention, third-party access or manner of Processing.
The other companies of the business group will document their role as Controller or Processor as applicable to each processing activity. Membership in the group does not by itself replace that determination.
The legal and data protection channel may be handled centrally by the Legal Department of the business group, acting on behalf of BARBERIAS LORDS LATAM SAS to receive and process requests from Data Subjects.
2. Purpose and scope
This Policy sets out the principles, purposes, rights, responsibilities and procedures applicable to the Processing of personal data carried out by LORDS.
It applies to the information of:
- clients and prospects;
- users of websites, applications, chatbots and digital channels;
- employees, candidates, contractors, barbers and other members of the work teams;
- suppliers, partners and business contacts;
- visitors to the locations;
- and any other natural person whose data is lawfully processed by the Company.
3. Principles
LORDS will process personal data in accordance with the principles of legality, purpose limitation, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality established in Law 1581 of 2012 and its implementing regulations.
Data will be collected for specific, legitimate and disclosed purposes and will not subsequently be used in a manner incompatible with them.
4. Data processed and purposes
| Data subject / category | Examples of information | Main purposes |
|---|---|---|
| Clients and prospects | identification, contact details, bookings, services received, preferences, service history, invoicing, requests and complaints | providing and managing services, managing bookings, customer service, loyalty and benefit programs, quality, invoicing, support, fraud prevention and commercial communications where applicable |
| Web, app and chatbot users | account, authentication, technical identifiers, IP, device, activity logs needed to operate the service and messages exchanged with support channels | enabling access, providing features, security, fraud prevention, support, diagnostics, continuity and service improvement |
| Staff, barbers, candidates and contractors | identification, contact details, employment or contractual information, training, assignments, shifts, performance and data needed for the relationship | recruitment, hiring, personnel management, payroll and payments, scheduling, operations, security, compliance with legal obligations and exercise of rights |
| Suppliers and partners | identification, contact details, tax, contractual and banking information as needed | selection, contracting, payments, accounting, taxes, contract compliance and risk management |
| Image, audio or video | photographs, recordings and video surveillance | security, evidence, incident handling and, where specific authorization exists, communications or content |
| Geolocation | latitude, longitude, accuracy and timestamp, only in expressly enabled features | exclusively the purposes disclosed in the current GEO Notice |
When a purpose requires specific authorization, LORDS will request it before Processing and will keep verifiable proof of it.
A general authorization for a commercial, employment or contractual relationship will not be interpreted as unlimited authorization for materially different purposes.
5. Sensitive data
LORDS will avoid collecting sensitive data unless strictly necessary and there is a legal basis for its Processing.
Where applicable, the Data Subject will be informed of the sensitive nature of the data, the specific purpose and the optional nature of answering questions about sensitive data. Authorization will be explicit when required by law.
No activity may be conditioned on the Data Subject providing sensitive personal data, under the applicable Colombian regulations.
Images captured by video surveillance are personal data and are governed by this Policy and by the notice posted at each location.
6. Children and adolescents
The Processing of data of children and adolescents will only take place when legally permitted, respecting their best interests and prevailing rights and meeting the applicable special conditions.
LORDS’ ordinary services will not use this provision as a general authorization to collect data from minors.
7. Authorization and proof
When authorization is required, it may be obtained through physical, electronic, digital, technical or automated means that allow an unequivocal expression of the Data Subject’s will to be demonstrated later.
Silence, inactivity or pre-ticked options will not be used as a means of authorization.
LORDS will keep proof of the authorization and of the material content of the notice or text presented when it was granted.
When a processing activity uses text versions, each text_version must correspond to a complete, immutable and retrievable artifact of the approved text.
8. Geolocation in internal applications
LORDS may request one-time location captures in internal applications at any of its current or future locations, establishments or formats operated by BARBERIAS LORDS LATAM SAS, exclusively when the GEO feature has been enabled for that operation.
The capture will be triggered by an explicit action of the user. Under this purpose there will be no continuous tracking, background tracking, route logging or passive geofencing. Location alone will not trigger automatic penalties.
Geolocation authorization is independent of the technical permission the user grants to their device’s operating system.
The current GEO Notice defines the detailed purposes, captured data, retention, rights and conditions of the authorization.
The addition of a new LORDS location or format does not by itself require a new GEO authorization, provided that:
- BARBERIAS LORDS LATAM SAS remains the sole Data Controller;
- the same purposes are maintained;
- the categories of captured data are not expanded;
- retention does not materially change;
- no identifiable access by new third parties appears; and
- the manner of Processing does not materially change.
A material change in any of these conditions requires a new version of the notice and, where applicable, a new authorization.
9. Processors, business group and third parties
LORDS may engage Data Processors for technology services, infrastructure and cloud, analytics, messaging, chatbots, bookings and scheduling, payments, digital advertising, support, accounting, security and other necessary activities.
Processors will handle the information only in accordance with the Controller’s instructions, keep it confidential and adopt appropriate security and privacy measures.
When a company of the business group provides centralized administrative functions to LORDS and processes data on its behalf, its role and obligations must be documented as applicable.
Data may be provided to authorities when there is a legal duty, a court order or a request issued in the exercise of legal functions.
10. International transfers and transmissions
International transmission: a Processor located outside Colombia processes personal data on behalf of and following the instructions of LORDS. These operations must have the applicable contractual instrument and the clauses required by Colombian regulations and the current instructions of the Superintendence of Industry and Commerce (SIC).
International transfer: another Controller located outside Colombia receives data and decides on its Processing. These operations must comply with Article 26 of Law 1581 of 2012 and the other applicable rules.
LORDS will maintain an inventory of international suppliers and flows, their role as Controller or Processor, purpose, data categories, relevant location and contractual support.
When the Data Subject’s authorization is legally required for a specific transfer, it will be obtained expressly and unequivocally.
11. Retention and validity of databases
Personal data will be retained for as long as necessary and reasonable to fulfill the disclosed purposes, carry out legal or contractual relationships, handle claims and meet retention obligations.
Once the purpose ceases and there is no legal or contractual duty to retain them, the data will be deleted, anonymized or subjected to the legally applicable mechanism.
| Category | Retention period |
|---|---|
| Active clients | while the commercial relationship exists and up to 5 years after the last service |
| Unconverted prospects | 2 years from the last contact or until revocation, whichever occurs first |
| Invoicing and accounting records | applicable legal term |
| Staff and contractors | duration of the relationship and applicable legal terms |
| Unselected candidates | 6 months from the close of the process, unless authorized for a talent pool |
| Suppliers | duration of the relationship and applicable legal term |
| Video surveillance | 30 days, unless an incident, investigation or claim justifies keeping the necessary footage |
| Geolocation evidence | 14 days of availability and operational use; after that period it enters the automated physical deletion mechanism, which may complete asynchronously |
GEO authorization record (geo_legal_ack) | while the authorization supports a current GEO processing activity and, afterwards, 3 years counted from the latest of: last capture under that ACK, revocation or replacement of the text_version, or account closure/termination of the relationship |
| Commercial communications | until revocation or 2 years of inactivity, whichever occurs first |
Legal hold of the GEO ACK
If, before expiry, there is a claim, administrative investigation, authority request or litigation related to that processing, LORDS may retain only the necessary ACK until the final conclusion of the proceeding plus one (1) additional year.
That legal hold does not by itself extend the retention of GEO evidence beyond 14 days.
12. Security, confidentiality and incidents
LORDS will adopt reasonable technical, human, administrative and organizational measures to protect information against loss, alteration, consultation, use or unauthorized or fraudulent access.
Access will be limited to people and systems that need it for authorized functions.
Security incidents will be investigated, documented, mitigated and reported to the authority or to Data Subjects when required by applicable regulations.
13. Rights of Data Subjects
Data Subjects may:
- know, update and rectify their data;
- request proof of the authorization, except where legally not required;
- be informed of the use given to their data;
- access their personal data being processed free of charge;
- request revocation of the authorization and/or deletion where legally applicable;
- submit inquiries and complaints; and
- file complaints with the Superintendence of Industry and Commerce (SIC) once the corresponding procedure with LORDS has been exhausted.
14. Inquiry and complaint procedure
Requests should be sent to juridico@lainmobiliaria.com.co or to the other official channels published by LORDS and will be handled by the Legal Department.
- Inquiries: maximum 10 business days. When a response is not possible within that term, the reason and the new date will be communicated, which may not exceed 5 additional business days.
- Complaints: if incomplete, the requester will be asked to complete it within the following 5 days. If 2 months pass without the requested information being provided, the complaint will be deemed withdrawn. A complete complaint will be resolved within a maximum of 15 business days; when not possible, the reason and the new date will be communicated, which may not exceed 8 additional business days. Where applicable, the legend “complaint in process” will be included.
15. Commercial communications
When LORDS uses contact data for promotions, news, loyalty or other commercial or advertising communications, it will:
- use the authorized channels;
- provide a quick, simple and free mechanism to stop receiving communications;
- not condition the purchase or provision of services that do not require it on accepting advertising;
- respect the legal time windows: Monday to Friday from 7:00 a.m. to 7:00 p.m. and Saturdays from 8:00 a.m. to 3:00 p.m., never on Sundays or holidays; and
- when the frequency rules of Law 2300 of 2023 apply, once direct contact exists, not contact the consumer more than once on the same day or through several channels within the same week.
Communications strictly related to a requested service, a booking, a transaction or information requested by the Data Subject will be handled according to their corresponding purpose.
16. Cookies and similar technologies
Websites and digital services may use cookies or other technologies for operation, security, authentication, preferences, measurement and advertising.
When technologies requiring additional information or consent are used, the corresponding notice or mechanism will be implemented as a complement to this Policy.
17. National Database Registry
LORDS will periodically verify whether it is required to register its databases in the National Database Registry (RNBD).
When its total assets and other conditions place it among the obligated parties under current regulations, including the applicable threshold of 100,000 UVT for companies, it will carry out and keep the corresponding registration up to date.
Not being required to register in the RNBD does not exempt LORDS from its other personal data protection obligations.
18. Amendments
LORDS may amend this Policy in response to legal, regulatory, technological or operational changes.
Substantial amendments that change a previously authorized purpose will be communicated to Data Subjects and, where applicable, will require a new authorization.
Each version will keep its approval date, publication date and change traceability.
19. Validity
This Policy was approved by the Legal Representative of BARBERIAS LORDS LATAM SAS on September 8, 2026.
It is in force from its publication, ratified by the Legal Department, at:
https://barberialords.com/tratamiento-de-informacion/
ANNEX A · APP TEAMS GEO NOTICE
The App Teams GEO Notice, text_version = geo-shadow-staging-v2, is an integral part of this Policy and must be kept as an immutable and retrievable legal artifact.
The GEO Notice applies to all current and future LORDS locations and formats operated by BARBERIAS LORDS LATAM SAS where geolocation features are enabled.
Studio Elite is a Barberías LORDS format, owned and operated by BARBERIAS LORDS LATAM SAS, and is governed by the same Processing rules as the other LORDS locations and formats.
ANNEX B · MODEL AUTHORIZATIONS
Courtesy translation: the authorizations actually granted are those in the Spanish text.
B.1 Clients — services
I authorize BARBERIAS LORDS LATAM SAS (NIT 901565132-7) to process my personal data to provide and manage the services I request, manage bookings, customer service, invoicing, loyalty programs, support and the other purposes described in the Data Processing Policy. I know my rights as a Data Subject and the channels available to exercise them. Policy: https://barberialords.com/tratamiento-de-informacion/.
B.2 Clients — separate and optional commercial communications
☐ I authorize BARBERIAS LORDS LATAM SAS to send me commercial and advertising communications through the channels I select. I understand that this authorization is optional, does not condition the provision of services, and that I can revoke it through a free and simple mechanism.
B.3 Staff, barbers and contractors
The staff member or contractor authorizes BARBERIAS LORDS LATAM SAS to process their personal data for recruitment, hiring, personnel management, payroll and payments, scheduling, operations, security and compliance with legal and contractual obligations, in accordance with the Data Processing Policy published at https://barberialords.com/tratamiento-de-informacion/.
B.4 Video surveillance
This location has video surveillance for security, evidence and incident-handling purposes. Controller: BARBERIAS LORDS LATAM SAS, NIT 901565132-7. Ordinary retention: 30 days, unless an incident justifies additional retention of the necessary footage. Rights: juridico@lainmobiliaria.com.co. Policy: https://barberialords.com/tratamiento-de-informacion/.
ANNEX C · VERSION CONTROL AND APPROVAL
DOC = POLITICA_TRATAMIENTO_DATOS_LORDS_LATAM
VERSION = 1.0
APPROVED_BY_DIRECTION = YES
APPROVED_BY_REP_LEGAL = Hernando Luque Ariza · 2026-09-08
JURIDICO_RATIFICATION = RATIFICADA
PUBLICATION = PUBLICADA
PUBLIC_URL = https://barberialords.com/tratamiento-de-informacion/
RESPONSABLE = BARBERIAS LORDS LATAM SAS
NIT = 901565132-7
LEGAL_SCOPE = ALL_CURRENT_AND_FUTURE_LORDS_LOCATIONS_AND_FORMATS_OPERATED_BY_LATAM
STUDIO_ELITE = LORDS_FORMAT
STUDIO_ELITE_CONTROLLER = BARBERIAS LORDS LATAM SAS
GEO_TEXT_VERSION = geo-shadow-staging-v2
GEO_LEGAL_SCOPE = ALL_CURRENT_AND_FUTURE_LORDS_LOCATIONS_OPERATED_BY_LATAM
NEW_LOCATION_REQUIRES_NEW_ACK = NO_UNLESS_MATERIAL_TREATMENT_CHANGE
NEW_LOCATION_REQUIRES_TECH_ENABLEMENT = YES
GEO_EVIDENCE_RETENTION = 14D_LOGICAL + ASYNC_PHYSICAL_PURGE
GEO_ACK_RETENTION = 3Y_RULE + LIMITED_LEGAL_HOLD