Privacy and personal data policy

Last updated: August 5, 2026

Data controller

Juan José Aristizábal, responsible for Coffea Project, is the controller of personal data collected through coffeaproject.com and its related channels.

• Identification: Colombian identity or tax identification number pending update
• Address: Cra. 108 #42-34, 904 t4, Cali, Valle del Cauca 760030, Colombia
• Email for inquiries and complaints: hola@coffeaproject.com
• Controller’s telephone: pending update

Rules and scope

This policy is adopted in accordance with the Colombian Constitution, Law 1581 of 2012, Decree 1074 of 2015 and the rules that amend, supplement or replace them. It applies to customers, visitors, subscribers, suppliers and other people whose data are processed by Coffea Project.

Data we may collect

We may process identification and contact details, delivery addresses, order and billing information, purchase history, communications, coffee and subscription preferences, technical browsing information and data needed to prevent fraud and respond to requests.

Coffea Project does not directly store complete card details or financial credentials. These are processed by the enabled payment gateways and institutions under their own safeguards and policies.

Purposes of processing

Data may be collected, stored, used, updated, transmitted, transferred or deleted to:

• create and manage orders, accounts and subscriptions;
• process payments, billing, returns and fraud prevention;
• prepare, dispatch, track and deliver products;
• respond to inquiries, requests, complaints, warranty claims and personal-data requests;
• send transactional messages about orders and subscriptions;
• send news, launches and commercial communications where authorized, with the ability to withdraw consent at any time;
• improve the site, measure its performance and personalize the experience;
• maintain security, prevent abuse and retain evidence of transactions;
• comply with legal, accounting and tax obligations and requests from competent authorities;
• carry out internal and statistical analysis, using aggregated or anonymized information where possible.

Authorization

Except where the law provides otherwise, processing requires the data subject’s prior, express and informed authorization, obtained in a form that can be consulted later. Providing sensitive data or data about children or adolescents is optional. Coffea Project does not intentionally request sensitive data or information about minors for purchases.

Processors, transmissions and transfers

To operate the store, we may share only the necessary data with providers acting as processors or independent controllers, including Shopify, Mercado Pago, hosting and analytics services, email tools, customer service, accounting providers and carriers.

Some providers may process information outside Colombia. International data transmissions or transfers are subject to the authorizations, contracts, exceptions and safeguards required by Colombian regulations.

We do not sell personal data.

Data subject’s rights

The data subject may:

• know, access, update and correct their data;
• request evidence of authorization, except where it is not legally required;
• learn how their data have been used;
• request deletion or revoke authorization where applicable;
• access their personal data free of charge;
• file complaints with the Superintendence of Industry and Commerce after completing the inquiry or complaint process with Coffea Project;
• be informed that answers about sensitive data or minors are optional.

Inquiries and complaints

Inquiries and complaints are received at hola@coffeaproject.com. Requests must include the data subject’s name and identification, a clear description, contact details and supporting documents.

Inquiries will be answered within a maximum of ten (10) business days after receipt. If this is not possible, we will explain the reason and provide a new date no later than five (5) additional business days.

Complaints will be answered within a maximum of fifteen (15) business days, starting on the day after a complete complaint is received. If incomplete, we will request corrections within five (5) days. If a response is not possible within the initial period, we will state the reason and a new date no later than eight (8) additional business days.

Security and retention

We adopt reasonable administrative, technical and organizational measures to protect data from loss, alteration, unauthorized use or access. No system is completely infallible.

Data will be retained as needed for the stated purposes, to comply with legal and contractual obligations, and to exercise or defend rights. They will then be deleted, anonymized or retained only where legally required.

Cookies and similar technologies

The site may use cookies needed for the cart, sign-in, security, payment and preferences. It may also use measurement, functionality or advertising cookies where appropriate and with the required authorization.

Visitors may manage non-essential cookies through the available consent mechanism and browser settings. Rejecting non-essential cookies should not prevent purchases, although some additional features may be limited.

Commercial communications

We will send promotional communications only where authorized or where an applicable legal basis exists. Each message will include an unsubscribe mechanism. Opting out of promotional messages does not affect communications needed to process orders or manage an active subscription.

Effective date and changes

This policy takes effect upon publication. Databases will remain in operation while the stated purposes and applicable legal obligations continue. Substantial changes will be announced on the site or through an appropriate channel before taking effect where required by law.