Lean Solutions Group Acquires SupportZebra.
LEAN SOLUTIONS GROUP, a business group mainly composed of: LEAN STAFFING SOLUTIONS INC, PERFILES Y SOLUCIONES LOGÍSTICAS S.A.S, PERFILES Y SOLUCIONES TECNOLÓGICAS S.A.S, LEAN SOLUTIONS MÉXICO, S. DE R.L. DE C.V, PERFILES Y SOLUCIONES LOGÍSTICAS GUATEMALA S.A., LEAN OUTSOURCING SOLUTIONS GROUP PHIL. INC, LEAN STAFFING SOLUTIONS ECUADOR S.A.S. and the rest of its subsidiaries recognizes the protection of personal data as a fundamental right and a corporate priority.
This Policy establishes general guidelines for the processing of personal data collected, stored, used, transmitted, transferred, or deleted by the company during its commercial and operational activities, ensuring compliance with applicable regulations in the United States, Colombia, Guatemala, the Philippines, Mexico, and Ecuador.
The purpose of this policy is:
Promote an organizational culture based on responsibility, transparency, and trust.
This Policy applies to all business units, subsidiaries, offices, and employees of LEAN SOLUTIONS GROUP and its subsidiaries, as well as to:
It includes all means of processing: physical, digital, electronic, or automated.
In the event of a conflict between this Policy and local laws, the provision that provides greater protection to the data subject shall prevail.
In the event of a conflict between this Policy and local laws, the provision that provides greater protection to the data subject shall prevail.
2.1 Reference Documents
In the event of a conflict between this Policy and local laws, the provision that provides greater protection to the data subject shall prevail.
The processing of personal data shall be governed by the following universal principles:
Categories of Data Processed
The company may collect and process the following categories of information:
LEAN SOLUTIONS GROUP and its affiliated companies may carry out the processing activities necessary for the proper conduct of their operations, in accordance with applicable law and the Global Corporate Policy. Such activities include, among others, collection, access, consultation, use, analysis, circulation, transmission, transfer, storage, systematization, purification, updating, blocking, conservation, and eventual deletion of personal data, in accordance with the purposes informed to each owner and the principles of legality, purpose, freedom, truthfulness, transparency, restricted access and circulation, security, and confidentiality.
The processing may be carried out through physical, electronic, automated, or hybrid means, including internal tools, technological platforms of the corporate ecosystem, cloud services, telemetry solutions, physical and logical security systems, and automation or artificial intelligence mechanisms implemented by the group, always under schemes of proportionality, minimization, and appropriate safeguards.
Purposes for Employees
a) Labor administration and legal compliance
b) Security, access control, and video surveillance.
c) Corporate benefits management
d) Internal communications and organizational culture incidents.
e) Internal and external use of images.
f) Disciplinary processes and compliance.
g) Technology management, telemetry, and IT security.
h) AI/automation.
Always under the principles of transparency, proportionality, and security
i) General administrative management
Retain information for evidentiary purposes, internal or external audits, compliance with legally required document retention periods, and the defense of the Company in potential judicial or administrative proceedings.
j) Capture and processing of biometric voice and image data for employment purposes
With the express, voluntary, and separate authorization of the employee, LEAN SOLUTIONS GROUP may:
LEAN SOLUTIONS GROUP may collect, store, and process voice biometric data (vocal fingerprint, voice recordings, voice recognition patterns) and image biometric data (photographs, facial captures, facial biometric identifiers) from its employees for purposes strictly related to the performance of their job duties and identity verification in corporate communications. The processing of this data will only be carried out with the prior, express, informed, and separate authorization of the data subject, who may refuse to grant it without affecting their employment or working conditions. The company guarantees that this data will be processed under strict reinforced security measures and will not be used for purposes other than those expressly authorized.
PURPOSES FOR APPLICANTS/CANDIDATES
PURPOSES FOR INDIVIDUAL USERS OF THE WEB PORTAL
PURPOSES FOR BUSINESS USERS
PURPOSES FOR SUPPLIERS, CONTRACTORS, AND LESSORS
PURPOSES FOR CUSTOMERS AND PARTNERS
PURPOSES FOR VISITORS AND THIRD PARTIES
PURPOSES FOR SHAREHOLDERS
Data subjects have the right to:
Your data may be shared with other divisions or subsidiaries of LEAN SOLUTIONS GROUP, always ensuring maximum protection of the same. Likewise, such information may be shared and processed in relation to the following categories of recipients:
– Third parties: Potentially important third parties include:
– With digital human transformation tools: As part of the development and operation of various applications, the organization and its business lines use and develop technology platforms designed to ensure the protection of users’ personal information. These platforms allow for the collection, storage, use, circulation, and deletion of data in a secure manner and in accordance with current regulations. All information processing carried out through these tools complies with the principles of legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security, and confidentiality. These tools use different platforms exclusively for the purposes defined in this policy, in compliance with legal and contractual obligations, and under technical and organizational measures that ensure the ethical, responsible, and secure processing of personal data, for which the data subject will be informed of such processing.
– Sensitive Data and Emotional Well-being: The processing of sensitive data, including biometric information and data related to mood, emotional health, or well-being (collected through tools such as Pulse), will be carried out under strict security measures and with the prior consent of the data subject. This data will be processed exclusively for the purpose of improving the organizational climate, occupational health programs, and supporting the overall well-being of employees. LEAN SOLUTIONS GROUP guarantees that no discriminatory decisions will be made based exclusively on the automated processing of this sensitive data.
LEAN SOLUTIONS GROUP guarantees the owners of personal data the full exercise of their rights to know, update, rectify, delete, revoke authorization, and access information.
8.1 Contact channels.
Data subjects may exercise their rights through the following channels:
| Country | Contact |
| In Colombia |
|
| In Guatemala |
|
| In the Philippines |
|
|
In the United States |
|
| In México |
|
| In Ecuador |
|
For all other countries, the data subject must contact the legal entity of LEAN SOLUTIONS GROUP where such data is being processed, without prejudice against being able to communicate with any of the entities provided herein.
When the data subject wishes to know the personal information stored in the databases. Response time: 10 business days from receipt.
When the owner requests correction, updating, or deletion of information, or submits complaints. Response time: 15 business days from receipt. If the request does not contain sufficient information or require verification, the area responsible will ask the owner to correct it within the following 5 days, suspending the terms until additional information is provided.
8.3 Responsible for customer service
Without prejudice against the contact channels established in section 9.1, LEAN SOLUTIONS GROUP guarantees that requests will be handled by its designated representatives in each jurisdiction. The Data Protection Officer (DPO) for Colombia, or the compliance officer in each country of operation, will coordinate the handling of requests and ensure compliance with the legal terms established for inquiries and complaints. To exercise their rights, the data subject may contact the corresponding legal entity in their country of location:
In all cases, the data subject may choose to communicate through the global centralized channel (tratamientodedatos@leangroup.com), which will act as a liaison with the local data controller to ensure a timely response in accordance with the applicable law in their territory.
8.4 Escalation to authorities
If the data subject does not receive a response within the legal deadlines or considers it unsatisfactory, they may contact the competent authority:
Depending on the entity responsible for LEAN SOLUTIONS GROUP and the recipients, your personal information may be processed and hosted in countries other than the one in which the information was originally collected, including those that may have less stringent data protection laws than the country in which you initially provided the information or in which it was originally collected, and those that do not provide adequate levels of security (provided that the owner authorizes it).
LEAN SOLUTIONS GROUP operates primarily in the United States, Mexico, Ecuador, Guatemala, the Philippines, and Colombia. In the case of international data transfers, we will protect your personal information as required by all applicable data protection laws.
9.1 Definitions
9.2 General principles
All transfers or transmissions shall be governed by:
9.3 International Circulation for Employment Purposes: In the context of providing global services, LEAN SOLUTIONS GROUP may transfer or transmit personal data to customers, parent companies, or suppliers located in the United States and other countries of operation. The specific purpose of this transfer is to manage the employment relationship, allocate resources to international customer projects, evaluate performance, and audit services provided. The company will ensure that these third parties act as data processors under security standards equivalent to those described herein.
LEAN SOLUTIONS GROUP has implemented technical, administrative, and physical measures aimed at ensuring the integrity, availability, and confidentiality of the personal information processed during its operations.
10.1 Security Principles
The company applies the principle of reasonable security, ensuring that the level of protection is proportional to the sensitivity and risk associated with each type of data.
The measures adopted are based on the best international practices in information security and data protection, including ISO/IEC 27001 and ISO/IEC 27701 standards.
10.2 Technical measures
10.3 Administrative Measures
10.4 Physical Measures
10.5 Specific measures for voice and image biometric data:
10.6 Incident and security breach management
LEAN SOLUTIONS GROUP has an Information Security Incident Response Procedure, which includes:
Designated representatives in each country, responsible for regulatory compliance and interactions with local authorities. They shall:
Personal data will be retained:
Once the term has expired, the data will be securely deleted or anonymized, in accordance with the company’s information retention policies.
Registration and Notification to Authorities: LEAN SOLUTIONS GROUP undertakes to register, enroll, and/or update its databases with the control authorities and national registries of each country where it operates, whenever required by local regulations. This compliance ensures the transparency and traceability of the processing of personal information.
For security purposes and to comply with its obligations, LEAN SOLUTIONS GROUP uses various means of video surveillance installed at different internal and external locations on our premises or in our offices. At the entrance to our premises, the corresponding privacy notices will be posted, stating the purpose of the processing of the data collected by these means and warning of the sensitive nature of such information, as well as the voluntary nature of providing it.
This Corporate Personal Data Processing Policy establishes the general principles and guidelines applicable to the processing of personal data across all operations of LEAN SOLUTIONS GROUP. However, considering that the company operates in multiple jurisdictions, this Policy may be supplemented by specific annexes for each country.
The jurisdiction-specific annexes will further develop and regulate those aspects of personal data processing that must be adapted to the applicable legislation in each country where LEAN SOLUTIONS GROUP operates, including, among others, local regulatory requirements, data subject rights, obligations before supervisory authorities, compliance mechanisms, and specific procedures required by the applicable legal framework.
Such annexes shall form an integral part of this Corporate Policy. In the event of any discrepancy or conflict between the general provisions contained in this Policy and the provisions established in the jurisdiction-specific annexes, the provisions contained in the respective annexes shall prevail to the extent that they reflect legal or regulatory obligations applicable in the relevant jurisdiction.
LEAN SOLUTIONS GROUP may create, modify, update, or supplement these annexes whenever necessary to comply with regulatory changes, guidance issued by competent authorities, or the expansion of operations into new jurisdictions, without requiring a full amendment of this Policy.
This Corporate Policy on the Processing of Personal Data is effective as of its publication and will remain in force indefinitely. LEAN SOLUTIONS GROUP reserves the right to modify or update this document at any time to adapt it to new legislation, case law, internal policies, or new technological services (such as the use of AI agents).
Any substantial change affecting the purposes of the processing or the identity of the controller will be communicated in a timely manner to the data subjects via the official website, emails, or public notices, before it comes into effect.
The validity of the databases will be subject to the purpose of the processing and the legal terms of information retention.
15.1 Change Control Table.
Change Control
| Version | Date | Change Description | Responsible |
| 001 | June 09, 2020 | Document creation | Continuous improvement |
| 002 | May 12, 2023 | Modification to terms and conditions | Legal |
| 01 | April 9, 2026 | Review and update of the Policy, including the assignment of a new coding structure in accordance with the Company’s updated branding | Legal |
