DATA PRIVACY POLICY

As an integral part of the Terms of Use and Browsing Conditions of the Portal www.alasdezafiro.com and www.alasdezafiro.com.co, this section, called Privacy Policy, aims to establish the rules on obtaining, using and storing data and information collected from internet users, in addition to recording their activities on the Portal.

Throughout the purchase process on www.alasdezafiro.com and www.alasdezafiro.com.co, we will request some personal data from our customers. In compliance with Law 1581 of 2012 "Personal Data Protection Law" and Decree 1377 of 2013, ALAS DE ZAFIRO informs that it is responsible for the administration of said data. According to our personal data processing policies, the mechanisms through which we use them are secure and confidential, as we have the appropriate technological means to ensure that they are stored to prevent unwanted access by third parties, and in the same order, we ensure their confidentiality.

We will use the information provided by our customers to process and deliver orders, send notifications about order status, billing, and to send information that may be useful to our customers or that they have specifically requested, including information about our products, services, and offers, unless they inform us that they object to being contacted for these purposes.

Subject to obtaining your consent, we may contact you by text message/SMS, email, direct mail or by telephone. If you do not wish to receive communications through any or all of these channels, you can communicate this at any time via email alasdezafiro@gmail.com, WhatsApp (+57) 320 641 8516 or by direct mail to the address Cra 65F# 31 - 40 Apt120 in Medellín and you will stop receiving such communications.

THIRD PARTIES: We may share your data with third parties to assist us with any of the functions mentioned in our Privacy Policy. For example, we may use third parties to help us with product promotion delivery, payment collection, product transportation, or customer service system management. We may exchange information with third parties for fraud protection and risk reduction purposes. Third parties must commit to maintaining the privacy policies of this document for the handling of your data.

PAYMENT INFORMATION:

Payments made through the Site will be processed by our online payment agent MercadoPago, Pay U, Wompi, Nequi, Paypal, Bancolombia, Stripe. You should only provide your information on our site. This information must be accurate and truthful and must be kept up to date. If any change occurs in your data, you must update it through the "My Account" page on our website.

Our e-commerce technology platform SHOPIFY and our payment partner MercadoPago have PCI DSS certification for secure handling of credit card information. While we cannot guarantee 100% security, these systems have proven effective in handling reserved information and will make it difficult for a hacker to decipher your data.

DATA PROCESSING, USE AND COLLECTION POLICY

This personal data processing policy is prepared in accordance with the provisions of Law 1581 of 2012 regulated by Decree 1377 of 2013, and other complementary provisions, which will be applied by ALAS DE ZAFIRO in relation to the processing of personal data.

PURPOSE:

In this policy, ALAS DE ZAFIRO establishes the necessary guidelines to protect the Personal Data of the Data Subjects, as well as the purpose of collecting information, establishes the criteria for the collection, storage, use and deletion of the data of the data subjects, their rights, the obligations of ALAS DE ZAFIRO as data controller, the channels for inquiries and complaints, the procedures for addressing them, and the validity of the databases.

DEFINITIONS:

Authorization: prior, express and informed consent of the data subject to carry out the processing of personal data.

Database (BB.DD): organized set of personal data that is subject to processing.

Personal data: any information linked or that can be associated with one or more determined or determinable natural persons.

Data Subject: natural person whose personal data is subject to processing.

Data Processor: natural or legal person, public or private, who, by itself or in association with others, carries out the processing of personal data, on behalf of the data controller.

Data Controller: natural or legal person, public or private, who, by itself or in association with others, decides on the database and/or the processing of the data.

PRINCIPLES:

Principle of legality in data processing: the processing of personal data is a regulated activity that must comply with the provisions of Law 1581 of 2012 and other provisions that develop it.

Principle of security: the information subject to processing by the Data Controller or Data Processor referred to in Law 1581 of 2012 must be handled with the technical, human and administrative measures that are necessary to provide security to the records, avoiding their alteration, loss, consultation, use or unauthorized or fraudulent access.

Principle of purpose: the processing of personal data obeys a legitimate purpose in accordance with the Constitution and Law 1581 of 2012, which must be informed to the Data Subject.

Principle of freedom: processing may only be carried out with the prior, express and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives consent.

Principle of veracity or quality: the information subject to processing must be truthful, complete, accurate, verifiable and understandable. The processing of partial, incomplete, fragmented or misleading data is prohibited.

Principle of transparency: in the processing, the Data Subject's right to obtain from the Data Controller or Data Processor, at any time and without restrictions, information about the existence of data concerning him/her must be guaranteed.

Principle of access and restricted circulation: processing is subject to the limits derived from the nature of personal data, the provisions of this law and the Constitution. In this sense, processing may only be carried out by persons authorized by the Data Subject and/or by the persons provided for in Law 1581 of 2012.

Principle of confidentiality: all persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks involved in the processing, being able to only supply or communicate personal data when this corresponds to the development of the activities authorized in Law 1581 of 2012 and in the terms thereof.

RESPONSIBLE:

Company Name: ALAS DE ZAFIRO

Address: Cra 65 F # 31 - 40

City: Medellín - Colombia.

Email: alasdezafiro@gmail.com

Phone: (+57) 320 641 8516 

Department in charge: CUSTOMER SERVICE

PROCESSING TO WHICH PERSONAL DATA WILL BE SUBJECTED / PURPOSES:

We use the personal information you provide us for purposes that include, but are not limited to: 

• We use your email address to help you create, manage, and maintain an account on our Services, to communicate with you, provide you with updates or information you request, respond to comments and questions. 

• We use your email address and phone number to send you security alerts, order shipping notifications, and other administrative messages, and to provide customer support. 

• Fulfill orders for products, services, or information. 

• Track and confirm orders. 

• Deliver products. 

• Administer any loyalty program. 

• Provide customer service, respond to requests, complaints or claims. 

• Administer sweepstakes, promotions, and surveys. 

• Offer new products and services. 

• Improve the effectiveness of our website, our marketing efforts, and our services and offerings. 

• Conduct research and analysis for commercial purposes. 

• Evaluate the quality of our products and conduct studies on consumption habits, preferences, purchase interest, product testing, concept, service evaluation, satisfaction, and others related to our products. 

• Send marketing communications, offers, or promotions. 

• Control and prevent fraud in all its forms. 

• To monitor and analyze trends, uses and activities, and improve our Services and product offerings. 

• To facilitate transactions and payments. 

• To record purchases you have made through our services. 

• Eventually, external databases may be consulted to ensure the reliability and conformity of the information provided by the customer. 

• If you provide us with information about other people, or if other people give us information about you, we will only use such information for the specific reason for which it was provided. Some examples include providing an address for advertising mail, purchases shipped to an address other than the buyer's as a gift, gift list.

INFORMATION PROVIDED BY THE USER:

Registration and profile information: When you create an account or place an order, we ask for your first name, last name, email address, phone number, identification number, payment information, shipping and billing address, neighborhood, city, and department where you reside; demographic information may also be requested.

Payment information: When you make a purchase, depending on the payment option chosen, we may use a third-party service provider that handles payments for us, in which case we only receive information about the approval or rejection of your payment. Payments made through the site will be processed by our online payment agent MercadoPago; you should only provide your information on our site. This information must be accurate and truthful and must be kept up to date. If any change occurs in your data, you must update it through the "My Account" page on our website.

Our e-commerce platform SHOPIFY and our payment partner MercadoPago have certifications for the secure handling of credit card information.

COMMUNICATIONS:

If you contact us directly, we may receive additional information about you. For example, when you communicate with our customer service team, we will receive your name, email address, phone number, the content of a message or attachments you may send us, and other information you may provide. We may also record your calls with our Customer Service team to handle your query and for training, research, and product development purposes.

INFORMATION WE COLLECT WHEN YOU USE OUR SITE:

Location Information: When you use our Services, we receive your precise location information. We also infer your more general location information (e.g., your IP address may indicate your more general geographical region).

Device Information: We receive information about the device and software you use to access our Services, including Internet Protocol (IP) address, web browser type, operating system version, mobile carrier and manufacturer, application installations, device identifiers, mobile advertising identifiers, and push notification tokens.

Usage Information: To help us understand how you use our services and to help us improve them, we automatically receive information about your interactions with our Services, such as the pages or other content you view, the searches you perform, the purchases you make, and the dates and times of your visits.

User Feedback: We receive information about ratings and comments you post when using our Services.

INFORMATION WE RECEIVE FROM THIRD PARTIES:

Third-Party Service Information: If you choose to link our Services to a third-party account, we may receive information about you, including your profile information, and your use of the third-party account. If you wish to limit the information available to us, you should visit the privacy settings of your third-party accounts to learn about your options, for example, to log in to our site, you can choose whether you want to do so with your Google or Facebook account.

PROCESSING OF SENSITIVE PERSONAL DATA

In accordance with Law 1581 of 2012, sensitive personal data are "those that affect the intimacy of the Data Subject or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data." Among these are also recognized data of minors.

ALAS DE ZAFIRO must process data of this nature in the development of relationships with its employees and/or candidates in selection processes, especially those related to health, and eventually biometric data in the implementation of security measures in access control systems to its facilities or to some physical spaces. In any case, special security measures will be adopted in the processing of such data, and in any case, when authorization for the processing of sensitive data is requested, the data subject will be warned of the purposes for which they will be processed and will be informed that they have the right to refrain from answering questions about sensitive data or about data of children and adolescents.

PROCESSING OF MINORS' DATA

ALAS DE ZAFIRO strives not to collect information from minors in the course of its economic activity. If you are under 18 years of age, your data may only be entered into our databases with the express consent of the minor's legal representative.

Notwithstanding the foregoing, and in the event that data is provided to us by minors, such data will be subject to the rules set forth below.

Special requirements for the processing of personal data of children and adolescents.

The processing of personal data of children and adolescents is prohibited, except when it concerns data of a public nature, in accordance with the provisions of article 7 of Law 1581 of 2012 and when such processing complies with the following parameters and requirements:

1. That it responds to and respects the best interests of children and adolescents.
2. That the respect for their fundamental rights is ensured.

Once the foregoing requirements have been met, the legal representative of the child or adolescent will grant authorization after the minor has exercised their right to be heard, an opinion that will be valued taking into account their maturity, autonomy, and capacity to understand the matter.

According to the Colombian Constitutional Court, personal data of minors under 18 years of age may be processed, as long as the prevalence of their fundamental rights is not jeopardized and it unequivocally responds to the realization of the principle of their best interest, without prejudice to compliance with the foregoing, the collection and any use of the data of minors who are registered in ALAS DE ZAFIRO's databases or who are requested require the express authorization of the legal representative of the child or adolescent, to whom ALAS DE ZAFIRO will facilitate the possibility of exercising the rights of access, cancellation, rectification and opposition of their wards' data.

Every data controller and data processor involved in the processing of personal data of children and adolescents must ensure the proper use of such data. To this end, the principles and obligations established in Law 1581 of 2012 and in the regulatory decree must be applied.

The family and society must ensure that data controllers and data processors of personal data of minors comply with the obligations established in Law 1581 of 2012 and in the regulatory decree.

By virtue of the foregoing, ALAS DE ZAFIRO will only process data of minors, after respecting the principles already indicated in the collection of authorization and provided that in the processing thereof the best interests of the minors are respected.

AUTHORIZATION

For ALAS DE ZAFIRO to process personal data, prior, informed, and express authorization from the Data Subject is required. This authorization will be obtained by any verbal (with documentation), written, physical, or electronic means that can be subject to later consultation; without prejudice to the exceptions provided by law, it being understood in any case that this authorization is given upon registration in our offices, points of sale, and/or on the website and by accepting the collection and processing of data.

ALAS DE ZAFIRO will keep proof of such authorizations appropriately, respecting the principles of confidentiality and privacy of information.

Any modification made to these policies or the way in which your personal information is used will be announced and published by means of a notice before the application of the new conditions, and all modified terms will automatically take effect five (5) days after the appearance of a notice on our website.

CASES IN WHICH ALAS DE ZAFIRO DOES NOT REQUIRE AUTHORIZATION FOR DATA PROCESSING, OR FOR THE DELIVERY OF DATA IN ITS POSSESSION

- When the information is requested from ALAS DE ZAFIRO by a public or administrative entity acting in the exercise of its legal functions or by court order.

- When it is public data because it is not protected by the scope of the standard.

- duly verified medical or health emergencies.

- In those cases where the information is authorized by law to fulfill historical, statistical, and scientific purposes.

- When it comes to data related to the civil registry of persons or that is contained in public records because this information is not considered private data.

DATA SECURITY: We use certain organizational, technical, and physical security measures that are designed to ensure the integrity and security of the personal information we process. We take steps to ensure that your personal information is treated securely and in accordance with this Privacy Policy. Unfortunately, the Internet cannot be guaranteed to be 100% secure, and we cannot guarantee the security of the information you provide to us. We will do our best and everything within our reach to ensure that the information you provide us is under our domain and control, preventing its alteration, loss, consultation, unauthorized or fraudulent use or access.

RIGHTS OF DATA SUBJECTS:

The owners of personal data have the following rights:

To know, update, and rectify their personal data before the data controllers or processors, in the case of ALAS DE ZAFIRO. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or those whose processing is expressly prohibited or has not been authorized.

To request proof of authorization granted to the data controller, except when it is expressly exempted as a requirement for processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.

To be informed by the data controller or processor, upon request, regarding the use given to their personal data.

To file complaints with the Superintendence of Industry and Commerce for infringements of the provisions of this Policy and the rules that regulate it.

To voluntarily revoke authorization and/or request the suppression of data when the processing does not respect constitutional and legal principles, rights, and guarantees. Revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that the data controller or processor has engaged in conduct contrary to the Constitution and the Law.

To access their personal data that has been subject to processing free of charge.

PROCEDURE FOR EXERCISING RIGHTS BY DATA SUBJECTS:

Personal data subjects must address their queries, requests, or complaints to alasdezafiro@gmail.com

Inquiries: ALAS DE ZAFIRO must respond to inquiries within ten (10) business days from the date it was received. If it is not possible to comply with this timeframe, the interested party must be informed, stating the reasons for the delay and the date on which the inquiry will be addressed, within a period not exceeding five (5) days.

Complaints: The data subject or successor who considers that the information contained in a database should be subject to correction, updating or deletion, or when they notice the alleged breach of any of the duties contained in the law or in this policy, may file a complaint with ALAS DE ZAFIRO, which will be processed under the following rules:

The complaint will be formulated by means of a request addressed to the data controller or processor, to the email alasdezafiro@gmail.com with the identification of the data subject, the description of the facts that give rise to the complaint, the address, and accompanying the documents to be asserted.

If the complaint is incomplete, ALAS DE ZAFIRO will require the interested party within five (5) days following its receipt to remedy the deficiencies.

If two (2) months have passed since the date of the request, without the applicant submitting the required information, it will be understood that the complaint has been abandoned.

The maximum period to address the complaint will be fifteen (15) business days from the day following the date of its receipt. If it is not possible to address the complaint within said period, the interested party will be informed of the reasons for the delay and the date on which their complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial period.

The data subject or successor may file a complaint with the Superintendence of Industry and Commerce, once they have exhausted the inquiry or complaint process with the data controller or processor without having received a satisfactory response to their request.

Revocation of authorization and/or suppression of data: Data subjects may at any time request ALAS DE ZAFIRO to suppress their personal data and/or revoke the authorization granted for their processing, by filing a complaint, in accordance with the provisions of Article 15 of Law 1581 of 2012, Decree 1377 of 2013 and the procedure indicated in this policy. Said revocation may be requested by the data subject or successor to alasdezafiro@gmail.com. If, after the respective legal term, ALAS DE ZAFIRO has not deleted the personal data, the data subject will have the right to request the Superintendence of Industry and Commerce to order the revocation of the authorization and/or the suppression of the personal data. Notwithstanding the foregoing, personal data must be kept when required for the fulfillment of a legal or contractual obligation.

LEGITIMATE PARTIES TO FILE COMPLAINTS AND INQUIRIES AND TO WHOM DATA SUBJECTS' INFORMATION MAY BE PROVIDED:

To the data subjects, their heirs or representatives at any time and through any means when they request it from ALAS DE ZAFIRO.

To judicial or administrative entities in the exercise of functions that make a request to the company for the information to be delivered to them.

To third parties authorized by law.

To third parties to whom the Data Subject expressly authorizes the delivery of the information and whose authorization is delivered to ALAS DE ZAFIRO.

CONTACT:

To learn about ALAS DE ZAFIRO's data protection policy, you can contact (+57) 320 641 8516, or via email: alasdezafiro@gmail.com where you can make the respective request.

POLICY VALIDITY: This Policy comes into effect on April 24, 2024.

Any modification made to this policy will be published in the same way as the initial policy.