Privacy and Personal Data Processing Policy

Last Updated: August 2026

DUQCAFÉ S.A.S. ("DUQCAFÉ", "we", "our", or "us") is committed to protecting the privacy, security and confidentiality of the personal information entrusted to us by our customers, website visitors, distributors, suppliers, business partners and all individuals who interact with our company.

This Privacy and Personal Data Processing Policy explains how DUQCAFÉ collects, stores, processes, uses, shares, protects and, where appropriate, transfers personal information obtained through our website, online store, customer service channels, commercial communications and other interactions with our business.

Our objective is to ensure that all personal information is processed responsibly, securely and transparently while respecting the rights of every data subject in accordance with the Constitution of Colombia, Law 1581 of 2012, Decree 1074 of 2015 and all applicable regulations concerning personal data protection.

1. Scope

This Policy applies to all personal information collected directly or indirectly by DUQCAFÉ S.A.S. through any of the following channels:

www.duqcafe.com
WooCommerce online store
Customer account registration
Order checkout process
Newsletter subscriptions
Contact forms
WhatsApp conversations
Email communications
Social media interactions
Customer support requests
Commercial quotations
Wholesale inquiries
Business partnerships
Coffee export inquiries
Marketing campaigns
Events and exhibitions
Any other lawful commercial interaction with DUQCAFÉ.

This Policy applies to customers, potential customers, suppliers, distributors, commercial partners, website visitors and any natural person whose personal information is processed by DUQCAFÉ.

2. Data Controller

Company:
DUQCAFÉ S.A.S.

NIT:
902035546-2

Website:
https://duqcafe.com

Email:
contacto@duqcafe.com

Business Address:
Carrera 96A #151-43
Bogotá D.C.
Colombia

Customer Service:
+57 333 432 7937

DUQCAFÉ S.A.S. acts as the Data Controller with respect to all personal information directly collected through its website and commercial activities.

3. Legal Framework

This Policy has been prepared in accordance with:

Political Constitution of Colombia.
Law 1581 of 2012.
Decree 1074 of 2015.
Other Colombian regulations concerning Personal Data Protection.
Electronic Commerce legislation where applicable.
Consumer Protection regulations.

4. Definitions

Authorization

Prior, express and informed consent granted voluntarily by the data subject allowing DUQCAFÉ to process personal information.

Personal Data

Any information relating to an identified or identifiable natural person.

Sensitive Personal Data

Information affecting privacy or that may generate discrimination, including health, biometric data, religious beliefs, political opinions, sexual orientation or similar categories protected by law.

Data Subject

The individual whose personal information is processed.

Data Controller

DUQCAFÉ S.A.S., which determines the purposes and means of processing personal information.

Data Processor

A third party processing information on behalf of DUQCAFÉ under contractual obligations.

Processing

Any operation involving personal information including collection, storage, organization, consultation, use, circulation, transfer, deletion or destruction.

Database

Any organized collection of personal information maintained physically or electronically.

5. Principles Governing Personal Data Processing

DUQCAFÉ processes personal information according to the following principles:

Lawfulness

Personal information shall always be processed in accordance with applicable law.

Purpose

Information shall only be collected for legitimate, explicit and previously informed purposes.

Freedom

Processing requires prior authorization whenever legally required.

Transparency

Every data subject may know how their personal information is being processed.

Accuracy

Information should remain complete, accurate and updated whenever reasonably possible.

Need and Proportionality

Only information reasonably necessary for the intended purposes shall be collected.

Restricted Access

Access to personal information shall be limited to authorized personnel and service providers requiring such information.

Security

Administrative, organizational and technical safeguards are implemented to protect personal information.

Confidentiality

Every employee, contractor and service provider with access to personal information must maintain confidentiality during and after the business relationship.

Limited Retention

Information shall only be retained for the period necessary to fulfill contractual, commercial, accounting, legal and tax obligations.

6. Categories of Personal Information Collected

Depending on the interaction with DUQCAFÉ, we may collect:

Full name
Email address
Telephone number
WhatsApp number
Billing address
Shipping address
City
Country
Postal code
Order history
Purchase history
Product preferences
Customer account information
Communications with customer support
IP address
Browser type
Operating system
Device information
Website activity
Cookies
Analytics information
Referral source
Approximate geographic location based on technical information

7. Sensitive Personal Information

DUQCAFÉ does not intentionally request or process sensitive personal information unless such processing is expressly authorized by the data subject or required by law.

Users are not obligated to provide sensitive information through our website.

8. Authorization for Processing

Whenever required by law, DUQCAFÉ will obtain the prior, express and informed authorization of the data subject before processing personal information.

Authorization may be granted by:

Creating an account.
Completing an online purchase.
Submitting a contact form.
Subscribing to newsletters.
Accepting cookies where applicable.
Communicating with DUQCAFÉ by electronic means.

By voluntarily providing personal information through any of these channels, the user confirms that the information is accurate and authorizes DUQCAFÉ to process it for the purposes described in this Policy.

9. Legal Basis for Processing

DUQCAFÉ processes personal information based on one or more of the following legal grounds:

Consent provided by the data subject.
Performance of a sales contract.
Compliance with legal obligations.
Protection against fraud.
Legitimate commercial interests.
Compliance with tax, accounting and consumer protection obligations.

10. Purposes of Processing Personal Data

DUQCAFÉ collects and processes personal information solely for legitimate, specific and lawful purposes related to the operation of our business, our online store and our relationship with customers, suppliers and business partners.

Depending on the interaction with our company, personal information may be processed for one or more of the following purposes:

Creating and managing customer accounts.
Processing online purchases.
Confirming orders.
Preparing and shipping products.
Providing delivery updates.
Generating invoices and accounting records.
Managing returns, exchanges and refunds.
Responding to inquiries received through our website.
Providing customer service before and after a purchase.
Managing wholesale and distributor requests.
Responding to coffee export inquiries.
Providing technical information regarding our products.
Maintaining commercial relationships with customers and suppliers.
Preventing fraudulent transactions.
Improving website performance and user experience.
Improving our products and services.
Conducting statistical analysis of website traffic.
Sending service-related communications.
Sending promotional communications when legally authorized.
Complying with legal, tax and accounting obligations.

11. Marketing Communications

DUQCAFÉ may send promotional emails, newsletters or commercial communications only when permitted by applicable law or when the user has provided the necessary authorization.

Recipients may unsubscribe from promotional communications at any time by following the unsubscribe instructions included in the email or by contacting DUQCAFÉ directly.

Transactional communications related to purchases, payments, shipping, invoices, password recovery or customer support may still be sent when necessary to fulfill contractual obligations.

12. Cookies and Similar Technologies

Our website uses cookies and similar technologies to improve website functionality, remember user preferences, enhance security and better understand how visitors interact with our content.

Cookies may be classified as:

Strictly Necessary Cookies

Customer login.
Shopping cart.
Checkout functionality.
Website security.
Session management.

Functional Cookies

Remember language preferences.
Remember customer preferences.
Improve navigation experience.

Analytics Cookies

Measure website traffic.
Analyze visitor behavior.
Improve website performance.
Understand customer interests.

Marketing Cookies

When applicable, marketing cookies may be used to measure advertising campaign effectiveness and improve commercial communications.

Users may configure their browsers to reject cookies; however, certain website features may not function correctly.

13. Google Services

DUQCAFÉ may use Google services to improve website performance, visibility and customer experience.

These services may include:

Google Analytics.
Google Search Console.
Google Business Profile.
Google Maps.
YouTube embedded videos.

These services operate under Google's own privacy policies and may process technical information necessary for their operation.

14. WooCommerce Online Store

Our website operates using WooCommerce, which processes information necessary to provide e-commerce functionality.

Information processed may include:

Customer information.
Shipping information.
Billing information.
Purchased products.
Order status.
Order history.
Customer account information.

WooCommerce stores only the information reasonably necessary for operating the online store.

15. Payment Providers

Payments made through our website are processed by authorized third-party payment providers such as Mercado Pago or any future payment gateway incorporated into our online store.

DUQCAFÉ does not intentionally store complete credit card numbers, security codes or online banking credentials.

Payment providers process financial information according to their own privacy and security policies.

16. WhatsApp Communications

Customers may contact DUQCAFÉ through WhatsApp for customer service, product inquiries, order assistance and commercial communications.

Messages exchanged through WhatsApp are processed solely for customer service, order management and business communication purposes.

17. Sharing Personal Information

DUQCAFÉ does not sell, rent or commercially distribute personal information.

Information may only be shared when necessary with:

Shipping companies.
Payment processors.
Technology providers.
Website hosting providers.
Email service providers.
Accounting advisers.
Legal advisers.
Government authorities when legally required.

Every service provider processing information on behalf of DUQCAFÉ is expected to maintain appropriate confidentiality and security measures.

18. International Data Transfers

Some technology providers used by DUQCAFÉ may process personal information outside Colombia.

Whenever international transfers occur, DUQCAFÉ will seek to ensure that adequate contractual, organizational and technical safeguards are implemented in accordance with applicable data protection laws.

19. Information Security

DUQCAFÉ adopts reasonable administrative, organizational and technical security measures designed to protect personal information against:

Unauthorized access.
Unauthorized disclosure.
Loss.
Alteration.
Destruction.
Cybersecurity threats.
Fraud.

Although DUQCAFÉ continuously works to protect personal information, no method of electronic transmission or storage can guarantee absolute security.

Users are encouraged to protect their account credentials and notify DUQCAFÉ immediately if unauthorized access is suspected.

20. Data Retention

Personal information will be retained only for the period reasonably necessary to fulfill the purposes described in this Policy and to comply with applicable accounting, tax, contractual and legal requirements.

Once retention is no longer necessary, personal information may be securely deleted, anonymized or archived as permitted by law.

21. Rights of Data Subjects

In accordance with the applicable Colombian data protection legislation, every data subject has the right to:

Know whether DUQCAFÉ processes their personal information.
Access the personal information stored by DUQCAFÉ.
Update inaccurate or incomplete information.
Correct information that is inaccurate, incomplete or outdated.
Request proof of the authorization granted for data processing whenever applicable.
Request information regarding the use given to their personal information.
Request deletion of personal information whenever legally applicable.
Revoke authorization for the processing of personal information where permitted by law.
Object to receiving promotional or marketing communications.
Submit complaints before the Superintendence of Industry and Commerce (SIC) after exhausting the applicable internal procedure.
Access their personal information free of charge in accordance with applicable regulations.

22. Requests, Consultations and Complaints

Data subjects may submit requests regarding their personal information by contacting DUQCAFÉ through the communication channels indicated in this Policy.

Requests should include:

Full name of the applicant.
Email address or telephone number.
Description of the request.
Supporting documents when applicable.
Any additional information necessary to identify the request.

Consultations

Requests concerning access to personal information will be answered within ten (10) business days from the date of receipt.

If DUQCAFÉ cannot respond within that period, the applicant will be informed before the deadline expires, indicating the reason for the delay and the new response date, which shall not exceed five (5) additional business days, as permitted by applicable law.

Complaints

Complaints related to correction, updating, deletion, revocation of consent or alleged non-compliance with applicable data protection regulations will be processed within fifteen (15) business days from the business day following their receipt.

If additional information is required in order to process the complaint, DUQCAFÉ may request it from the applicant. Should the requested information not be provided within the legally applicable period, the complaint may be considered withdrawn.

23. Revocation of Authorization

Data subjects may revoke the authorization previously granted to DUQCAFÉ whenever such revocation is legally applicable and no contractual or legal obligation requires DUQCAFÉ to continue processing the information.

Revocation may be total or partial depending on the request submitted by the data subject.

24. Deletion of Personal Information

The data subject may request deletion of personal information whenever the processing does not comply with applicable legislation or when the purposes for which the information was collected have been fulfilled.

DUQCAFÉ may retain information whenever required by accounting, tax, consumer protection, contractual or other legal obligations.

25. Children's Privacy

The DUQCAFÉ website is intended for adults and individuals legally capable of entering into commercial transactions.

DUQCAFÉ does not knowingly collect personal information from children. If personal information relating to minors must be processed for lawful purposes, authorization from the child's parent or legal guardian will be required in accordance with applicable legislation.

26. External Links

Our website may contain links to third-party websites including social media platforms, payment gateways, logistics providers, Google services, YouTube or other external websites.

DUQCAFÉ is not responsible for the privacy practices, security measures or content of external websites. Users are encouraged to review the privacy policies applicable to those third-party services before providing personal information.

27. Intellectual Property

All content available on www.duqcafe.com, including but not limited to text, photographs, product descriptions, graphics, logos, trademarks, videos, illustrations, website design and other materials, is owned by DUQCAFÉ S.A.S. or used under the appropriate authorization.

No content may be reproduced, copied, modified, distributed or used for commercial purposes without the prior written authorization of DUQCAFÉ.

28. Limitation of Liability

Although DUQCAFÉ implements reasonable technical and organizational security measures to protect personal information, no method of electronic transmission, internet communication or electronic storage can be guaranteed to be completely secure.

Users acknowledge the inherent risks associated with internet communications and agree that DUQCAFÉ shall not be liable for unauthorized access resulting from circumstances beyond its reasonable control.

29. Changes to this Policy

DUQCAFÉ reserves the right to modify or update this Privacy and Personal Data Processing Policy at any time in order to reflect:

Changes in applicable legislation.
Technological developments.
Changes in business operations.
Implementation of new services.
Website improvements.
Changes in payment methods.
Changes in commercial activities.

The latest version of this Policy will always be published on www.duqcafe.com together with its effective date.

Whenever material changes are introduced, DUQCAFÉ may notify users through the website, email or other appropriate communication channels.

30. Governing Law

This Policy shall be governed by and interpreted in accordance with the laws of the Republic of Colombia.

Any dispute concerning the processing of personal information shall be subject to the applicable Colombian legislation and, where appropriate, the jurisdiction of the competent authorities.

31. Contact Information

For questions, consultations, requests or complaints concerning this Privacy and Personal Data Processing Policy, please contact:

DUQCAFÉ S.A.S.

Website
https://duqcafe.com

Email
contacto@duqcafe.com

Customer Service & WhatsApp
+57 333 432 7937

Business Address
Carrera 96A #151-43
Bogotá D.C.
Colombia

32. Effective Date

This Privacy and Personal Data Processing Policy becomes effective upon its publication on the DUQCAFÉ website and remains in force until modified or replaced by a newer version.

By using the DUQCAFÉ website, creating an account, purchasing products or communicating with our company through any official channel, users acknowledge that they have read and understood this Policy and agree to the processing of their personal information in accordance with the purposes and conditions described herein, where such processing is based on their consent or another lawful basis.