Personal data processing

Data controller

• Trade name: Chocolates Flores Medellín.
• Shop: Cra. 81 #34A-49, Laureles - Estadio, Medellín, Antioquia, Colombia.
• Opening hours: Every day, from 8:00 a.m. to 8:00 p.m.
• WhatsApp: 319 216 1731.
• Email: ventas@chocolatesfloresmedellin.com.
• Website: chocolatesfloresmedellin.com.

Scope

This policy applies to all personal data we collect and process as data controller: that of our customers, of the people who receive our gifts, of those who write to us, and of our suppliers.

It complements the privacy policy, which explains in plain language what data we collect on the site and why. Where there is any doubt about the procedure, this document prevails.

Definitions

• Data subject: the natural person to whom the data refers.
• Personal data: any information linked to an identified or identifiable natural person.
• Sensitive data: data that affects the data subject's privacy or whose misuse could lead to discrimination.
• Authorization: the data subject's prior, express and informed consent to the processing of their data.
• Data controller: the party that decides on the database and its processing; in this case, us.
• Data processor: the party that processes data on behalf of the controller, such as our payment gateway or our hosting provider.

Principles

We process data in accordance with the principles of legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality, under the terms of Article 4 of Law 1581 of 2012.

Purposes of processing

• Managing the order: preparing it, coordinating delivery and confirming receipt.
• Communicating with the buyer and the recipient about the order and its delivery.
• Issuing sales records and fulfilling accounting, tax and commercial obligations.
• Handling requests, complaints, claims and warranty requests, and keeping a record of how they were handled.
• Analyzing site usage in aggregate to improve the catalog and service.
• Sending commercial information and promotions, only to those who have expressly authorized it.

Sensitive data and data of minors

We do not collect sensitive data or data of minors. Should it ever be required, express authorization will be requested, noting that there is no obligation to grant it, and we will comply with the provisions of the law and case law regarding the data of children and adolescents.

Rights of data subjects

• To know, update and correct their personal data.
• To request proof of the authorization granted, except where the law does not require it.
• To be informed about how their data has been used.
• To file complaints with the Superintendence of Industry and Commerce for violations of the law.
• To revoke the authorization and request the deletion of their data, where there is no legal or contractual duty to retain it.
• To access their personal data free of charge.

Contact channel

All inquiries and claims are handled at ventas@chocolatesfloresmedellin.com and on WhatsApp at 319 216 1731, or in person at Cra. 81 #34A-49, Laureles - Estadio, Medellín, Antioquia, during business hours.

The request must state the data subject's name, a description of the facts, a channel for our response, and any supporting documents.

Procedure for inquiries

Inquiries are answered within a maximum of ten business days from receipt. When it is not possible to respond within that period, the requester will be informed of the reason and the date on which the inquiry will be answered, which in no case shall exceed five business days after the initial period expires.

Procedure for claims

Claims will be resolved within a maximum of fifteen business days from the day after receipt. When it is not possible to resolve a claim within that period, the requester will be informed of the reason and the date on which it will be resolved, which shall not exceed eight business days after the initial period expires.

If the claim is incomplete, the requester will be asked within five days of receipt to correct the deficiencies. If two months pass without the requested information being provided, the claim will be deemed withdrawn.

Before turning to the Superintendence of Industry and Commerce, the data subject must have exhausted this claims procedure with us.

Processors and transfers

To operate, we rely on third parties that process data on our behalf: site hosting, email, payment gateway, messaging and analytics tools. We require all of them to maintain security and confidentiality conditions equivalent to our own.

Some of these services store information on servers located outside Colombia. By authorizing the processing, the data subject authorizes this international transfer and transmission, which is carried out under the security standards required by current regulations.

Security measures

We adopt reasonable technical, human and administrative measures to protect information: encrypted connections, access control, backups, and confidentiality commitments from those who process data on our behalf.

Effective period of the policy and databases

This policy is effective as of August 15, 2026. Personal data will be retained for as long as the relationship with the data subject continues and, thereafter, for the period required by applicable accounting, tax and commercial regulations; once that period ends, it will be deleted or anonymized.

Any substantial change to this policy will be announced on this site.