Data Protection Policy 

This policy establishes how CLICK ACCESS collects, uses, stores, shares and deletes personal data, and how data subjects can exercise their rights. It applies to all personal data of clients, training participants, client contacts and suppliers, in any format.

Law 81 of March 26, 2019 on Personal Data Protection of the Republic of Panama, Executive Decree 285 of May 28, 2021 which regulates it, and the data protection clauses agreed with each client.

When a client company provides personal data of its employees or participants (for example, attendance lists or exercise files), CLICK ACCESS processes that data only on the client's documented instructions and only for the contracted training service. In that case the client remains the data controller and CLICK ACCESS acts as custodian/processor, applying the security measures described in this policy.

• Identification and contact data: full name, business email, job title, company, and phone number where provided.

• Training data: attendance, exercise results, evaluations and certificates.

• Exercise files: practice files normally contain fictitious data. When a client file contains real personal data, it is treated with the same controls as any other personal data.

CLICK ACCESS does not request sensitive data (health, biometric, religious, political or similar data) and does not process data of minors.

• Planning, delivering and evaluating training sessions.

• Grading exercises and delivering reports and certificates to the client.

• Communication with the client regarding the contracted service, invoicing and legal obligations.

Personal data is processed following the principles of lawfulness, loyalty, transparency, purpose limitation, data minimization, accuracy, limited retention, confidentiality and security. Only the minimum data necessary for each service is requested.

• All processing is carried out within Microsoft 365 Business (Exchange Online, OneDrive for Business, SharePoint Online, Teams). Data at rest is encrypted with AES-256 and data in transit with TLS 1.2 or higher.

• Access requires Microsoft Entra ID with multi-factor authentication. The laptop is protected by password and Windows Hello biometric (fingerprint) sign-in.

• Files are shared only through restricted links limited to specific recipients. USB drives, personal email accounts and public file-sharing services are not used for client data.

• No employees, subcontractors or third parties have access to client personal data.

• Measures are reviewed at least once a year through the annual inspection (CA-PDP-04).

Exercise files and any client personal data are permanently deleted from the cloud (including the OneDrive/SharePoint recycle bins) and from the laptop immediately after the exercises are graded and the report is delivered to the client. Invoicing and contractual records are kept only for the period required by tax and commercial law. The client may request earlier deletion at any time.

Data subjects, or their legal representatives, may exercise the following rights at any time and free of charge:

• Access: to know whether their data is processed and obtain a copy.

• Rectification: to correct inaccurate, incomplete or outdated data.

• Cancellation: to request the deletion of their data when it is no longer needed or was processed unlawfully.

• Opposition: to object to the processing of their data for legitimate reasons.

• Portability: to receive their data in a structured, commonly used format.

CLICK ACCESS does not sell, rent or share personal data with third parties. Microsoft Corporation acts as cloud service provider under its Data Protection Addendum. Data is only disclosed when required by law or by a competent authority.

Any personal data breach is handled according to the Personal Data Breach Response Procedure (CA-PDP-03), including notification to the affected client and, where applicable, to ANTAI and the affected data subjects.

This policy is reviewed at least once a year and whenever there are legal or operational changes. It is available on request and is shared with clients as part of supplier assessments.