FUERA DEL MOLDE PRIVACY AND PERSONAL DATA PROCESSING POLICY
FUERA DEL MOLDE recognizes the importance of privacy and the proper protection of the personal data of individuals who visit, use or interact with our Marketplace, our Services and our customer service channels.
This Policy explains who is responsible for Processing personal data, what information we may collect, how we use it, with whom it may be shared, how we protect it, and the rights that Data Subjects may exercise.
The Processing of personal data carried out by FUERA DEL MOLDE is conducted in accordance with applicable Colombian law and the principles and obligations set out in this Policy.
1. Identification of the Data Controller
The Data Controller responsible for the Processing of personal data is Grupo Tecnológico CATO S.A.S., a Colombian company identified with Tax Identification Number (NIT) 900.494.361-8, owner and operator of FUERA DEL MOLDE®, a commercial establishment and Marketplace available through www.fueradelmolde.com, its progressive web application (PWA), and any other digital channels made available by FUERA DEL MOLDE.
Mailing and business address: CL. 152 # 72-03, Tower 4, Bogotá D.C., Colombia.
Address for notices: Calle 45A # 53-51, Barrio Virrey, Villavicencio, Meta, Colombia.
Telephone numbers: 310 283 6520 and 314 481 6215.
Customer service email: [email protected].
For purposes of this Policy, Grupo Tecnológico CATO S.A.S. may also be referred to as “FUERA DEL MOLDE”, “FDM”, “we”, “our” or “us”, as applicable.
2. Purpose and Scope of the Policy
This Policy governs the Processing of personal data carried out by FUERA DEL MOLDE in connection with operation of the Marketplace, provision of its Services, and its relationships with individuals who interact with its Products, Services, features and channels. As applicable, the Policy applies to personal data collected or processed when a person accesses or browses the Marketplace; creates or administers an account; makes or attempts to make a purchase; customizes a Product; uploads, creates, publishes or commercializes Content; acts as a Buyer, Seller, Artist, Manufacturer or Producer, Printer or Associate; participates in the manufacture, printing, customization, distribution or delivery of Products; requests or receives payments; participates in promotions, surveys or programs; communicates with FUERA DEL MOLDE; submits a
request, inquiry, claim or report; interacts with our digital or social channels; or uses any other feature or Service involving the Processing of personal data.
This Policy also applies to the personal data of representatives, officers, employees, contractors or contact persons of Users that are legal entities, when their data is processed by FUERA DEL MOLDE.
The terms User, Buyer, Seller, Artist, Manufacturer or Producer, Printer, Associate, Content, Product, Service, Marketplace and other terms specific to FUERA DEL MOLDE’s operations will have the meanings established in the Terms and Conditions, unless this Policy expressly assigns them a specific meaning for personal data protection purposes.
The Policy applies to Processing carried out directly by FUERA DEL MOLDE and, where applicable, to Processing carried out by third parties on behalf of FUERA DEL MOLDE. When a third party processes information as an independent Data Controller for its own purposes, such Processing may also be subject to that third party’s privacy policy and applicable terms.
3. Applicable Legal Framework
FUERA DEL MOLDE will Process personal data in accordance with Article 15 of the Political Constitution of Colombia, Statutory Law 1581 of 2012, its regulatory provisions incorporated into Single Regulatory Decree 1074 of 2015, the instructions issued by the Superintendence of Industry and Commerce, and any other rules that amend, supplement, complement or replace the Colombian personal data protection regime.
When Processing relates to commercial or advertising communications, FUERA DEL MOLDE will also comply with provisions applicable to communication channels, permitted times, frequency, authorization and consumer contact preferences, including Law 2300 of 2023 and any rules that amend, supplement or replace it, where applicable.
When an activity, category of information or relationship with the Data Subject is subject to special regulation, the corresponding provisions will also apply.
4. Definitions
For purposes of this Policy, the following definitions will apply, without prejudice to any others established by applicable law:
Authorization: the Data Subject’s prior, express and informed consent to the Processing of their personal data.
Database: an organized set of personal data subject to Processing.
Personal Data: any information linked or capable of being associated with one or more identified or identifiable natural persons.
Public Data: data that, under applicable law, is not classified as semi-private, private or sensitive and may be Processed as permitted by law.
Sensitive Data: information that affects the privacy of the Data Subject or whose misuse may lead to discrimination, including, among other things, data relating to racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in certain organizations, health, sex life and biometric data, in accordance with applicable law.
Data Processor: a natural or legal person, public or private, that alone or jointly with others Processes personal data on behalf of the Data Controller.
Data Controller: a natural or legal person, public or private, that alone or jointly with others decides on the Database and/or the Processing of personal data.
Data Subject: a natural person whose personal data is subject to Processing.
Processing: any operation or set of operations performed on personal data, such as collection, storage, use, circulation, updating, organization, analysis, Transmission, Transfer or deletion.
Transfer: the sending or communication of personal data by a Data Controller and/or Data Processor to a third-party recipient that, in turn, acts as Data Controller of the information, within or outside Colombia.
Transmission: Processing of personal data involving its communication within or outside Colombia so that a Data Processor may Process it on behalf of the Data Controller.
5. Principles Applicable to Personal Data Processing
FUERA DEL MOLDE will Process personal data in a coordinated and comprehensive manner in accordance with the principles established by applicable Colombian law, particularly the principles of legality, purpose limitation, freedom, truthfulness or data quality, transparency, restricted access and circulation, security and confidentiality.
Processing must serve legitimate purposes disclosed to the Data Subject. Information subject to Processing must be truthful, complete, accurate, up to date, verifiable and understandable, according to the nature and purpose of the Processing. Access to, circulation and disclosure of personal data will be limited to persons authorized, legally entitled or otherwise permitted by law.
When the Data Subject’s Authorization is required, FUERA DEL MOLDE will seek to obtain it in advance, expressly and on an informed basis, and will retain evidence that it was granted, without prejudice to cases in which the law permits Processing without Authorization.
FUERA DEL MOLDE will adopt reasonable and appropriate technical, human and administrative measures designed to protect personal data against alteration, loss, consultation, use, access,
unauthorized or fraudulent circulation or disclosure. Persons involved in the Processing must respect the confidentiality of the information even after the relationship that gave rise to their access has ended.
In application of the accountability principle, FUERA DEL MOLDE will seek to implement policies, procedures and controls appropriate to the nature of the data, the purposes of Processing, the volume of information, the associated risks and the characteristics of its operations, and to retain reasonable evidence of the measures adopted.
6. What Personal Data We Collect
FUERA DEL MOLDE may collect and Process different categories of personal data depending on how each Data Subject interacts with the Marketplace, the Services and our channels. Not all categories described below are collected for every User.
When a feature requires certain information, FUERA DEL MOLDE will seek to indicate whether providing it is mandatory or optional and, where applicable, the consequences of not providing it. The absence of data necessary to provide a Service, carry out a transaction, verify an account or comply with a legal obligation may prevent or limit only those features that reasonably depend on such information.
6.1. Browsing, Device and Technical Log Data
When a person accesses or uses the Marketplace, technical and access data may be generated or collected automatically, such as IP address; date and time of access; pages, sections or features used; referring site or address; browser type and version; operating system; device information; Internet access provider or domain; session identifiers; activity logs; and data related to errors, security, performance or technical operation.
When such data directly or indirectly identifies a natural person, or can reasonably be associated with one, it will be treated as personal data in accordance with this Policy.
6.2. Identification, Contact and Account Data
When a User creates or administers an account, registers to use certain features, or must be identified or verified, FUERA DEL MOLDE may Process information such as first and last name; username; email address; telephone number; contact or notice addresses; data necessary for authentication, account recovery or security; and, where necessary, information or documents intended to verify identity, age, legal capacity, representation or authorization to act on behalf of another person.
When an account belongs to a legal entity, personal data of its representatives, officers, employees, contractors or contact persons acting on its behalf may also be Processed.
6.3. Purchase, Order and Delivery Data
When a person makes or attempts to make a purchase, FUERA DEL MOLDE may Process data such as the name of the Buyer or recipient; email address; telephone number; shipping address; billing address or information; Products or Services purchased; quantities; customization specifications; information necessary for manufacturing, printing or preparation; delivery method; tracking information; Order status; purchase history; and data related to cancellations, exchanges, returns, refunds, warranties, withdrawals, payment reversals, claims or after-sales support.
When the Buyer provides names, images, photographs, text, files or other materials to customize a Product, those materials may contain personal data and will be Processed to the extent necessary to manage customization, production, delivery and the other purposes disclosed in this Policy.
6.4. Data of Sellers, Artists, Manufacturers, Printers and Other Associates
When a User offers, markets, manufactures, prints, customizes, licenses or supplies Products, Content or Services through the Marketplace, FUERA DEL MOLDE may Process identification and contact information; data relating to legal existence and representation when acting on behalf of a legal entity; commercial information; tax information; banking data or data needed to make payments; information about stores, profiles, listings, Products and Content; sales and Order history; balances, settlements, payments, returns, refunds, chargebacks and adjustments; applicable commercial category or terms; and documents or supporting records reasonably necessary to verify identity, capacity, representation, account ownership, contractual compliance, Product origin or rights in Content.
6.5. Financial, Banking, Tax and Payment Data
In connection with purchases, collections, payments, settlements or disbursements, FUERA DEL MOLDE may Process, as applicable, information about the selected payment method; transaction identifiers; payment amount, date and status; information required for reconciliation; billing data; bank accounts or other means enabled for disbursements; tax information; NIT or tax identification where applicable; withholdings; supporting documents; and other information necessary to comply with accounting, tax or contractual obligations.
Depending on the payment method and integration used, certain payment instrument information may be Processed directly by a payment service provider or financial institution, without FUERA DEL MOLDE necessarily accessing or storing all data from the instrument used. The specific information received by FUERA DEL MOLDE will depend on the payment method and provider enabled for the transaction.
6.6. Marketplace Activity and Usage Data
FUERA DEL MOLDE may Process information generated by the User’s interaction with the Marketplace, such as Order and sales history; Products viewed, saved, bookmarked or
favorited; searches; listings; actions taken on the account; interactions with features; reviews, comments or messages; participation in community spaces; status of listings or accounts; and other information derived from use of the available features.
Content uploaded, published, communicated or otherwise provided by the User may also be Processed, including photographs, images, names, text or other materials, when such Content includes personal data.
6.7. Data Provided in Communications, Support and Claims
When a person communicates with FUERA DEL MOLDE through forms, email, chat, telephone, social media, the Help Center or other enabled channels, we may Process their identification and contact data, the content of the communication, information about the related account or transaction, and any documents, photographs, files, evidence or supporting materials provided to address requests, inquiries, claims, reports, warranties, returns, security incidents or disputes, including those relating to intellectual property or third-party rights.
6.8. Data Obtained Through Third-Party Services or Platforms
When the User uses a feature that integrates third-party services, such as sign-in mechanisms, payment methods, logistics services, social networks or other tools connected to the Marketplace, FUERA DEL MOLDE may receive information that the third party is authorized to disclose according to the applicable settings, permissions, contractual relationship and law. This information may include identification or contact data, identifiers needed to link or authenticate an account, and status information or data needed to confirm a transaction, payment, delivery or service.
FUERA DEL MOLDE does not control information collected by a third party for its own purposes when that third party acts as an independent Data Controller, without prejudice to FUERA DEL MOLDE’s obligations regarding integrations incorporated into its operations.
6.9. Data for Commercial Communications and Marketing
When the Data Subject authorizes promotional communications or voluntarily participates in commercial activities, FUERA DEL MOLDE may Process contact data, information about subscriptions and preferences, records of authorization or withdrawal of consent, and information relating to interactions with communications, campaigns, promotions or commercial content.
When cookies, identifiers or other technologies are used for analytics, measurement, personalization or digital advertising, the corresponding Processing will be subject to the rules on cookies and similar technologies set out later in this Policy and to any applicable authorization or choice mechanisms.
6.10. Security, Fraud Prevention and Compliance Data
FUERA DEL MOLDE may Process data necessary to protect Users, transactions and the Marketplace, including technical and access logs; identity or account verification information; transaction history; information relating to access attempts, unusual transactions, possible breaches or fraudulent conduct; security reports and incidents; claims; evidence; communications with authorities; and other information reasonably necessary to prevent, detect, investigate or address fraud, abuse, breaches, security incidents, claims or legal requirements.
Sensitive Data and the personal data of children and adolescents will be subject to the special rules set out in this Policy and applicable law.
7. How We Obtain Personal Data
FUERA DEL MOLDE may obtain personal data through different means, depending on the Data Subject’s relationship with the Marketplace, the Service used and the nature of the information. The source of the data does not alter the obligation to Process it in accordance with this Policy and applicable law.
7.1. Information Provided Directly by the Data Subject
The primary source of information will be the Data Subject. This occurs, among other cases, when the Data Subject creates or administers an account; makes a purchase; publishes, offers or supplies Products, Content or Services; requests or receives payments; provides billing or delivery information; customizes a Product; completes forms; participates in promotions, surveys or programs; submits requests, inquiries, claims or reports; exercises their rights; or communicates with FUERA DEL MOLDE through any enabled channel.
7.2. Information Generated Automatically Through Use of the Marketplace
Certain data may be generated or collected automatically when a person accesses, browses or interacts with the Marketplace. This may include technical and security logs, IP address, browser or device information, session identifiers, dates and times of access, pages or features used, account activity, errors, technical events and other information derived from interaction with our systems.
The use of cookies, pixels, identifiers and similar technologies will also be subject to the specific rules set out later in this Policy.
7.3. Information Provided by Other Users or Marketplace Participants
FUERA DEL MOLDE may receive personal data from other Users or participants when necessary to manage a transaction, provide a Service, make a delivery, resolve a request or dispute, verify information, address a claim or comply with obligations arising from operation of the Marketplace.
For example, a Buyer may provide another person’s data as the recipient of an Order; a legal entity may provide the data of its representatives or contacts; or a User may provide information about another person when submitting a claim, report or request relating to third-party rights.
Anyone who provides FUERA DEL MOLDE with another person’s personal data must be authorized or otherwise legally entitled to disclose it when required by applicable law and must seek to ensure that the information provided is relevant and appropriate for the corresponding purpose.
7.4. Information Received from Providers, Platforms and Integrated Services
FUERA DEL MOLDE may receive personal data from providers and third parties involved in providing the Services or integrated with the Marketplace, including, as applicable, payment providers, financial institutions, logistics services, authentication tools, technology services, social networks or other platforms used by the User.
The information received will depend on the feature used, the permissions granted, the relationship between the parties and the rules applicable to the relevant third party. FUERA DEL MOLDE will Process only information it lawfully receives and that is relevant to the purposes disclosed in this Policy.
7.5. Information from Public or Lawfully Accessible Sources
Where permitted by law and necessary for a legitimate purpose related to FUERA DEL MOLDE’s operations, data from records, databases, directories, publications or publicly or lawfully accessible sources may be consulted or Processed.
The fact that certain information is publicly accessible does not mean it may be used without limitation. FUERA DEL MOLDE will seek to ensure that any such Processing respects the principles of purpose limitation, necessity, restricted circulation, security and all other applicable obligations.
7.6. Information Received from Authorities and Third Parties
FUERA DEL MOLDE may receive personal data from authorities, entities, rights holders, representatives, attorneys-in-fact, providers or other third parties when disclosed in connection with legal requests, administrative or judicial proceedings, claims, investigations, fraud or security reports, contractual disputes or matters relating to intellectual property or other rights.
8. Purposes of Processing
FUERA DEL MOLDE will Process personal data only for legitimate, specified and disclosed purposes, according to the Data Subject’s relationship with the Marketplace and the Services used. Not all purposes described below apply to every Data Subject or require the same categories of information.
Personal data may be Processed for one or more of the following purposes, as applicable. If FUERA DEL MOLDE intends to use it for additional purposes substantially different from those previously disclosed, it will inform the Data Subject and obtain a new Authorization when required by applicable law.
8.1. Account Management, Registration, Authentication and Profile
Create, enable, administer and maintain User accounts; authenticate access; manage credentials, account recovery and security mechanisms; verify identity, age, capacity or representation where necessary; keep profile information current; enable account-related features; manage preferences; and communicate necessary information about the account, its features, operational changes, security or provision of the Services.
When the User chooses to publish information in public areas of the Marketplace, FUERA DEL MOLDE may Process and display it to the extent necessary to enable the requested feature, in accordance with available settings and the rules applicable to the relevant Content and profile.
8.2. Management of Purchases, Orders and Buyer Relationships
Record, process, confirm and administer purchases and Orders; identify the Buyer and, where applicable, the recipient; manage information about Products, quantities, specifications, customization, billing and delivery; keep the Buyer informed of Order status; retain the necessary transaction history; and take any other actions reasonably necessary to complete the purchase and provide the associated Services.
8.3. Production, Printing, Customization and Delivery of Products
Coordinate the manufacture, production, printing, preparation, customization, packaging, dispatch and delivery of Products in accordance with the Order specifications and instructions provided; communicate to Sellers, Manufacturers or Producers, Printers, logistics operators and other participants only the information strictly necessary for them to perform their role; manage tracking and delivery updates; and address incidents related to Product preparation or distribution.
8.4. Management of Sellers, Artists, Manufacturers, Printers and Other Associates
Register, verify and administer the commercial, contractual and operational relationship with Sellers, Artists, Manufacturers or Producers, Printers and other Associates; manage profiles, stores, listings, Products and Content; verify information and documents relating to identity, representation, account ownership, Product origin or rights in Content where necessary; manage Orders, sales, balances, settlements, commercial terms and applicable categories; facilitate interaction with Buyers and other participants; and take the actions necessary for proper provision of the Marketplace Services.
8.5. Payments, Collections, Settlements, Invoicing and Tax Obligations
Process or facilitate payments and collections; confirm transaction status; perform reconciliations, returns, refunds, reversals, chargebacks, adjustments, settlements and disbursements; administer balances and payments to the appropriate parties; generate invoices, receipts and supporting records; comply with accounting, tax and reporting obligations; respond to audits or verifications; and retain information for the periods required by applicable law.
When a transaction is processed directly by a financial institution or payment service provider, FUERA DEL MOLDE will Process the information it receives from that third party to the extent necessary to manage the transaction and the purposes described herein.
8.6. Customer Service, Warranties, Exchanges, Returns and Claims
Receive, identify, manage and respond to requests, inquiries, petitions, complaints, claims and reports; provide support relating to accounts, Products, Services or transactions; process warranties, exchanges, returns, refunds, withdrawals, payment reversals and other applicable mechanisms; request, receive and analyze documents, photographs, files or evidence needed to assess each case; communicate with the persons involved; and retain the supporting records required to evidence the actions taken.
8.7. Security, Fraud Prevention and Marketplace Protection
Protect the security, availability and integrity of the Marketplace, accounts, data and transactions; authenticate access; prevent, detect, analyze, investigate and address fraudulent, abusive, unusual or unauthorized activities; identify vulnerabilities, errors and incidents; manage security alerts and logs; prevent impersonation and unauthorized access; take measures regarding accounts, Content or transactions where appropriate; and protect FUERA DEL MOLDE, its Users and third parties against reasonably identified risks.
8.8. Legal and Contractual Compliance, Intellectual Property and Defense of Rights
Comply with legal, regulatory, administrative, judicial, tax, accounting or contractual obligations; respond to requests from competent authorities; verify compliance with the Terms and Conditions and other applicable policies; process reports, claims and proceedings relating to intellectual property, image rights, privacy or other third-party rights; investigate possible breaches; retain and produce evidence; exercise or defend the rights of FUERA DEL MOLDE or third parties where appropriate; and manage disputes, proceedings or actions in which the information must be used.
8.9. Analytics, Operation, Development and Improvement of the Marketplace
Monitor the technical and operational functioning of the Marketplace; measure performance, availability and feature usage; identify and correct errors; conduct analyses, statistics and internal reports; understand, in aggregate or individually when authorized, Users’ interaction with the Services; evaluate and improve features, processes, user experience, capacity, security and quality; develop new features or Services related to FUERA DEL MOLDE’s operations; and support internal planning, administration and decision-making.
Where reasonably possible for these activities, FUERA DEL MOLDE will seek to use aggregated, anonymized or de-identified information that does not permit identification of the Data Subject.
8.10. Commercial Communications, Advertising and Marketing
Where the corresponding Authorization or legal basis exists, send newsletters, promotions, updates, campaigns, invitations, offers and other commercial or advertising communications; manage subscriptions and preferences; measure interaction with communications; segment or personalize content and campaigns; promote Products, Content, Services or activities of FUERA DEL MOLDE and Marketplace participants under the terms
authorized; and measure and optimize campaigns using cookies, pixels, identifiers or other technologies, in accordance with the specific rules set out later in this Policy.
Communications necessary to confirm or manage an account, Order, payment, delivery, claim, security change or provision of a Service are considered operational or transactional communications and are distinct from commercial or advertising communications. The Data Subject may use the applicable mechanisms to opt out, revoke consent or modify preferences regarding commercial communications.
9. Authorization for Processing and Cases Where It Is Not Required
As a general rule, FUERA DEL MOLDE will obtain the Data Subject’s prior and informed Authorization when required by applicable law. Authorization may be obtained by any means that allows subsequent consultation and reasonably establishes the Data Subject’s intent regarding the disclosed Processing.
9.1. How Authorization Is Granted
Authorization may be expressed in writing, verbally, through electronic mechanisms or through unequivocal conduct from which it can reasonably be concluded that the Data Subject consented to the Processing. Silence, inaction or pre-checked boxes will not, by themselves, constitute valid Authorization.
In digital channels, FUERA DEL MOLDE may implement mechanisms such as unchecked acceptance boxes, confirmation buttons, electronic forms or equivalent procedures that make it possible to associate the Data Subject’s expression of intent with the information previously provided about the Processing.
Acceptance of the Terms and Conditions will not, by itself, replace Authorization for Processing when the law requires a specific or separate expression of consent. When the same mechanism permits acceptance of contractual terms and authorization of certain Processing activities, the information must be presented clearly enough for the Data Subject to understand the scope of each decision.
9.2. Information Provided When Requesting Authorization
Before or when requesting Authorization, FUERA DEL MOLDE will inform the Data Subject, where applicable, about the Processing to which their personal data will be subject and its purposes; the optional nature of answering questions about Sensitive Data or data concerning children and adolescents; the rights available to them as a Data Subject; and the identity and contact channels of the Data Controller.
This Policy may be made available to the Data Subject as a detailed explanation of that information, without prejudice to privacy notices, informational text or specific mechanisms used at each point of collection.
9.3. Retention of Proof of Authorization
FUERA DEL MOLDE will retain, directly or through applicable technological mechanisms and providers, reasonable evidence of Authorizations obtained when there is a duty to obtain them. Depending on the channel used, such evidence may consist of forms, electronic records, acceptance traceability, date and time, the version of the disclosed text, interaction records, recordings or other means capable of subsequent consultation.
Retention of proof is intended to demonstrate, where necessary, that Authorization was obtained before Processing and that the Data Subject had access to the information required by applicable law.
9.4. Authorizations for Optional or Additional Purposes
When a purpose is not necessary to complete a purchase, administer an account, provide a Service, comply with a legal obligation or pursue another purpose essential to the relationship with the Data Subject, FUERA DEL MOLDE will seek to distinguish it from necessary purposes and request the applicable Authorization.
In particular, commercial, advertising or promotional communications and Processing based on tracking technologies that require consent will be subject to choice mechanisms, preferences or Authorization as applicable. Refusal to authorize an optional purpose should not prevent access to Services that do not reasonably depend on that purpose.
The special rules applicable to Sensitive Data and the personal data of children and adolescents are set out in the following section of this Policy.
9.5. Cases Where Authorization Is Not Required
Under Colombian law, the Data Subject’s Authorization will not be required for: information requested by a public or administrative entity in the exercise of its legal duties or by court order; Public Data; medical or health emergencies; Processing of information authorized by law for historical, statistical or scientific purposes; or data related to the Civil Registry of Persons.
Any other exceptions expressly provided by applicable law may also apply. The absence of an obligation to obtain Authorization does not eliminate other obligations arising from the personal data protection regime or permit use of the information for purposes incompatible with the law.
When FUERA DEL MOLDE receives an information request from an authority or third party and disclosure is not covered by a legal exception, it will assess the validity of the request and, where applicable, require the Data Subject’s Authorization or an order from the competent authority before disclosing protected personal data.
10. Sensitive Data and Personal Data of Children and Adolescents
FUERA DEL MOLDE recognizes that Sensitive Data and the personal data of children and adolescents require an enhanced level of protection. Such data will be Processed only when legally permissible, for specific purposes and subject to the safeguards established by applicable law.
10.1. Processing of Sensitive Data
As a general rule, FUERA DEL MOLDE will seek not to request Sensitive Data when it is unnecessary to provide the Services or fulfill a legitimate purpose previously disclosed.
When it is necessary to Process Sensitive Data, FUERA DEL MOLDE will inform the Data Subject in advance and explicitly which requested data is sensitive, the purpose of its Processing and the optional nature of providing it, unless a legal obligation provides otherwise. Where required by law, the Data Subject’s explicit Authorization will be obtained.
Sensitive Data will be Processed only in cases permitted by Colombian law and with security and confidentiality measures appropriate to the risks associated with its nature. FUERA DEL MOLDE will not use Sensitive Data to make discriminatory decisions or for purposes incompatible with those disclosed or legally authorized.
10.2. Sensitive Data Included in Content or Information Provided by Users
As a general rule, FUERA DEL MOLDE does not require Users to include Sensitive Data in Content, files, images, text or materials they upload or provide to use the Marketplace, except where a specific feature makes this necessary and the Processing is legally permissible.
If a User chooses to provide information containing their own or a third party’s Sensitive Data, the User must have the necessary authorization, legal standing or legal basis to do so. FUERA DEL MOLDE may restrict access to, circulation, publication or Processing of such information when necessary to protect the Data Subject’s rights, comply with the law, address a claim or prevent a risk to the persons involved.
10.3. Personal Data of Children and Adolescents
FUERA DEL MOLDE’s Services are primarily intended for adults with legal capacity to enter into acts and contracts. Under the Terms and Conditions, minors must not use the Marketplace independently and may do so only under the proper supervision of their parents, representatives or legal guardians where legally permissible.
When FUERA DEL MOLDE must Process the personal data of a child or adolescent, such Processing must serve and respect their best interests and ensure respect for their fundamental rights. Where Authorization must be obtained, it will be granted by the minor’s legal representative after the minor has had the opportunity to be heard, with their views considered according to their maturity, autonomy and ability to understand the Processing.
When requesting personal data concerning children or adolescents, FUERA DEL MOLDE will, where applicable, inform them that answering questions related to such data is optional and will adopt reasonable measures to limit collection to information strictly relevant to the authorized purpose.
FUERA DEL MOLDE does not intend for minors to independently establish contractual relationships, engage in commercial activities or assume obligations on the Marketplace when the law requires full legal capacity or intervention by their legal representatives.
10.4. Content, Customizations or Orders Involving Data of Minors
In certain contexts, an adult User may provide names, images, photographs, text or other data relating to a minor, for example to customize a Product, identify the recipient of an Order or manage a request. Anyone providing such information must be authorized or otherwise legally entitled to do so and must respect the rights of the minor involved.
FUERA DEL MOLDE will Process such data only to the extent necessary for the corresponding purpose and will seek to avoid public exposure where it is unnecessary to provide the Service. Where there are reasonable doubts regarding the legitimacy of the disclosure, protection of the minor or permissibility of the Processing, FUERA DEL MOLDE may request additional information, restrict the Processing, remove or block the Content, or take any other appropriate measures.
If FUERA DEL MOLDE determines that it has collected a minor’s personal data contrary to this Policy or applicable law, it may take measures to restrict its use and delete it where appropriate, without prejudice to information that must be retained due to a legal obligation or for the protection and defense of rights.
11. Sharing and Circulation of Personal Data
FUERA DEL MOLDE may disclose or permit access to personal data only when necessary for the purposes disclosed in this Policy, where an applicable legal or contractual basis exists, or where the Data Subject’s Authorization has been obtained when required. In each case, FUERA DEL MOLDE will seek to limit the information shared to what is relevant and necessary for the corresponding purpose.
A third party’s involvement in Processing does not, by itself, mean that a Transfer occurs. Its classification will depend on the role the third party performs with respect to the personal data, particularly whether it acts on behalf of FUERA DEL MOLDE as a Data Processor or determines its own purposes and means as an independent Data Controller.
11.1. Participants Necessary to Manage Products, Orders and Services
FUERA DEL MOLDE may disclose personal data to Sellers, Manufacturers or Producers, Printers, logistics operators and other participants whose involvement is necessary to prepare, customize, manufacture, print, dispatch, deliver or manage a Product, Order or Service.
The information disclosed may include, as applicable, identification and contact data, delivery address, Order information, customization specifications and other data strictly necessary for each participant to perform its role. Such data must not be used for purposes incompatible with those that gave rise to the disclosure or for the recipient’s own marketing unless an independent legal basis exists and, where applicable, the Data Subject’s Authorization has been obtained.
11.2. Payment, Financial Services, Invoicing and Accounting Compliance Providers
FUERA DEL MOLDE may disclose data to payment service providers, financial institutions, collection operators, invoicing, accounting, auditing, debt collection or related service providers when necessary to process or confirm transactions, make disbursements, manage returns or reversals, issue supporting records, perform reconciliations or comply with accounting, tax or regulatory obligations.
When any such third party independently determines the purposes and means of its Processing, it may act as an independent Data Controller, and its activities will also be subject to its applicable policies, terms and legal obligations.
11.3. Technology and Operational Providers
FUERA DEL MOLDE may use providers that support operation of the Marketplace and its Services, such as technology infrastructure, hosting, storage, databases, authentication, messaging, email, customer service, analytics, monitoring, technical support, cybersecurity, fraud prevention or other equivalent tools incorporated into its operations.
When such providers Process personal data on behalf of FUERA DEL MOLDE, they will act as Data Processors and must comply with applicable instructions, contractual obligations and protective measures. When they act as independent Data Controllers, Processing conducted for their own purposes will also be governed by their respective policies and legal obligations.
11.4. Authorities, Rights Holders and Legally Entitled Third Parties
FUERA DEL MOLDE may disclose personal data to administrative, judicial, tax, regulatory or law-enforcement authorities where there is a valid request, legal obligation or statutory basis for doing so.
It may also disclose information to rights holders, representatives, attorneys-in-fact or other third parties where legally appropriate to address claims, investigate possible infringements, manage disputes, protect intellectual property rights, image rights or other rights, or exercise and defend the rights of FUERA DEL MOLDE or third parties. The disclosure will be limited to information reasonably necessary and must have the corresponding legal basis.
11.5. Professional Advisers and Corporate Transactions
FUERA DEL MOLDE may permit legal, accounting or financial advisers, auditors or other professionals to access personal information when necessary to obtain advice, conduct audits, comply with obligations or manage internal or external proceedings.
Likewise, if Grupo Tecnológico CATO S.A.S. participates in a corporate reorganization, merger, spin-off, acquisition, sale, asset transfer, investment, financing or other corporate transaction requiring information to be reviewed or transferred, personal data may be disclosed to the extent necessary to evaluate, structure or execute the transaction, while seeking to apply confidentiality, minimization and security duties and respecting applicable authorizations or legal requirements.
12. Transmission of Personal Data
A Transmission occurs when FUERA DEL MOLDE communicates personal data to a third party so that the third party may Process it on behalf of FUERA DEL MOLDE and in accordance with its instructions, in its capacity as a Data Processor.
FUERA DEL MOLDE may engage Data Processors located in Colombia or abroad to support activities necessary for operation of the Marketplace and provision of the Services. Where
applicable, the relationship with the Data Processor will be documented through contracts or other legal instruments defining the scope of Processing, authorized activities and the parties’ personal data protection obligations.
Data Processors must Process information in accordance with applicable instructions, respect data protection principles, maintain confidentiality, implement appropriate security measures, limit access to authorized personnel, and cooperate in addressing Data Subject rights and other applicable obligations.
12.1. Transmissions Within Colombia
Transmissions to Data Processors located in Colombia will be subject to Law 1581 of 2012, Decree 1074 of 2015, and other applicable provisions and instructions. FUERA DEL MOLDE will seek to select providers offering reasonable compliance and security safeguards appropriate to the nature of the Processing entrusted to them.
12.2. International Transmissions
When a Data Processor is located outside Colombia, FUERA DEL MOLDE will comply with the rules applicable to international Transmission of personal data. Where a transmission agreement satisfies the requirements of Colombian law, the operation will be subject to that instrument and to the corresponding obligations of the Data Controller and Data Processor.
Where no instrument exists that permits application of the international Transmission regime, FUERA DEL MOLDE will verify the applicable legal basis in accordance with Colombian law and the current instructions of the Superintendence of Industry and Commerce.
13. Domestic and International Transfers of Personal Data
A Transfer occurs when FUERA DEL MOLDE or a Data Processor communicates personal data to another Data Controller, located within or outside Colombia, that determines the purposes or means of the Processing it will conduct with respect to the information received.
FUERA DEL MOLDE will make Transfers only when a legal basis permits them and the principles of purpose limitation, freedom, restricted circulation, security, confidentiality and accountability are respected.
13.1. Transfers Within Colombia
When information is disclosed to another Data Controller located in Colombia, FUERA DEL MOLDE will verify that the Transfer is compatible with the disclosed purposes, is permitted by law, or has the Data Subject’s Authorization where required. The receiving Data Controller will assume the obligations applicable to the Processing it conducts for its own purposes and under its own decisions.
13.2. International Transfers
Transfers of personal data to Data Controllers located outside Colombia will be carried out in accordance with Article 26 of Law 1581 of 2012, its regulatory provisions and the current instructions of the Superintendence of Industry and Commerce.
FUERA DEL MOLDE will verify, as applicable, that the receiving country provides an adequate level of data protection under the standards established by the Superintendence of Industry and Commerce; that the Transfer falls within an exception provided by Colombian law; or that a Declaration of Conformity or other valid mechanism has been issued or recognized by the competent authority.
When a Transfer relies on the Data Subject’s Authorization as a legal exception, the express and unequivocal manifestation required by applicable law will be requested. An international Transfer does not relieve FUERA DEL MOLDE of the obligation to adopt appropriate and effective measures to demonstrate that the transferred information receives adequate protection during the relevant operation.
14. Personal Data Security and Incident Management
FUERA DEL MOLDE will adopt reasonable and appropriate technical, human, administrative and organizational measures to protect personal data against alteration, loss, consultation, use, access, modification, disclosure or unauthorized or fraudulent circulation, taking into account the nature of the information, the purposes of Processing, identified risks and the characteristics of the operation.
Security measures may include, as applicable, access and authentication controls; permission and privilege management; credential protection; event logging and monitoring; backup and recovery mechanisms; system updating and maintenance; security measures for communications and storage; vulnerability management; internal procedures; confidentiality duties; personnel training; provider assessment; and controls designed to prevent, detect, contain and respond to security incidents.
Access to personal data must be limited to persons, departments, providers or participants that need the information to perform authorized functions or purposes. Persons involved in Processing will be subject to confidentiality duties and must use the information only within the applicable scope.
No technological system or security mechanism can completely eliminate all risks. Accordingly, FUERA DEL MOLDE will implement reasonable measures aimed at reducing such risks and will review its controls when necessary in light of technological, operational or regulatory changes or changes in risk levels.
14.1. Security Incident Management
FUERA DEL MOLDE will maintain procedures to identify, analyze, contain, document and manage incidents that may compromise the confidentiality, integrity or availability of personal data.
When an incident occurs, FUERA DEL MOLDE will assess its nature, scope, affected information, potential consequences and necessary containment or corrective measures. It will also retain relevant records and evidence to document the response and take actions intended to prevent or reduce recurrence.
When the law or instructions of the Superintendence of Industry and Commerce require a security incident to be reported, FUERA DEL MOLDE will make the report through the applicable mechanisms and within the required timeframes. When necessary to protect Data Subject rights, comply with a legal obligation or mitigate material risks, FUERA DEL MOLDE may make any additional communications that are appropriate.
14.2. Users’ Responsibility for Their Accounts
Users must take reasonable measures to protect their credentials and access devices, avoid sharing passwords or authentication mechanisms, and notify FUERA DEL MOLDE when they detect or suspect unauthorized access, loss of credentials, impersonation or any situation that may compromise account security.
Measures adopted by the User do not replace FUERA DEL MOLDE’s applicable security obligations, but they help reduce risks associated with use of accounts and Services.
15. Retention, Deletion and Anonymization of Personal Data
FUERA DEL MOLDE will retain personal data for as long as necessary, relevant and proportionate to fulfill the purposes for which it was collected and the other legitimate purposes disclosed in this Policy.
The duration of Processing may vary depending on the category of information, the relationship with the Data Subject, the Service used and applicable obligations. In establishing retention periods, FUERA DEL MOLDE may consider, among other factors, the duration of the account or contractual relationship; the duration and performance of Orders and transactions; warranty, exchange, return or claim periods; accounting, tax and commercial duties; the need to prevent fraud or investigate incidents; applicable limitation periods; the existence of administrative or judicial proceedings; and the need to retain evidence for the exercise or defense of rights.
15.1. End of a Purpose or Relationship with the Data Subject
When the purpose that justified collection ends or the relationship with the Data Subject terminates, personal data may be deleted, anonymized, de-identified or retained on a restricted basis where a legal or contractual obligation or legitimate purpose permits or requires retention for an additional period.
Cancellation of an account, termination of a contractual relationship or a deletion request does not necessarily result in immediate deletion of all information.
FUERA DEL MOLDE may retain data that must be preserved to comply with legal obligations, address claims, prevent fraud, resolve disputes, conduct audits, evidence transactions or exercise and defend rights, always within the limits permitted by applicable law.
15.2. Deletion, Anonymization and Backups
Where deletion is appropriate, FUERA DEL MOLDE will adopt reasonable measures to remove the information from active systems or prevent its continued use for purposes incompatible with permitted retention.
Where appropriate, information may be anonymized or de-identified so that it no longer permits identification of the Data Subject and may be used for statistical, analytical, security, research, planning or Service-improvement purposes without constituting identifiable personal data.
Certain information may remain temporarily in backups, technical logs or recovery systems until it is replaced or deleted according to applicable technical cycles and retention policies, and during that period will remain subject to security measures and use restrictions.
16. Cookies and Similar Technologies
FUERA DEL MOLDE may use cookies and similar technologies on the Marketplace and its digital channels to enable operation, remember settings, maintain sessions, strengthen security, understand feature usage, measure performance, perform analytics and, where applicable, support personalization, marketing or digital advertising activities.
A cookie is a small file or identifier that a website or service may store or access in the User’s browser or device. Equivalent technologies may also be used, such as local storage, identifiers, tags, pixels, SDKs or other mechanisms that make it possible to recognize a session, browser or device or record certain interaction events.
16.1. Categories of Cookies and Similar Technologies
Depending on the features actually used, FUERA DEL MOLDE may employ technologies necessary for Marketplace operation and security; preference or functionality technologies; measurement, performance and analytics technologies; and advertising, personalization or marketing technologies.
Necessary technologies enable essential functions such as maintaining sessions, authenticating Users, remembering essential actions, managing security, distributing traffic or preserving technical settings. Preference technologies may remember choices made by the User. Analytics technologies make it possible to understand, in aggregate or, where applicable, associated with a User, how the Marketplace is used, detect errors and improve its operation. Advertising or marketing technologies may be used to measure campaigns, limit repetition, personalize
content or evaluate interactions with advertisements when such features are enabled.
16.2. First-Party and Third-Party Cookies
Some technologies may be managed directly by FUERA DEL MOLDE and others by providers supplying technology, analytics, security, communications, social media, advertising or other integrated services or features.
When a third party Processes information on behalf of FUERA DEL MOLDE, the rules on Data Processors and Transmission set out in this Policy will apply. When the third party determines its own purposes and means of Processing, it may act as an independent Data Controller, and use of the information will also be subject to its terms and privacy policies.
16.3. Duration and Preference Management
Cookies and similar technologies may be session-based, when they are deleted or cease operating at the end of a session or when the browser is closed, or persistent, when they remain for a specified period or until deleted by the User or the relevant provider.
When applicable law requires Authorization or a choice regarding certain cookies or technologies, FUERA DEL MOLDE will provide the corresponding information and management mechanisms. The User may also use browser or device settings to block, limit or delete certain cookies, taking into account that disabling necessary technologies may affect operation of some Marketplace features.
The specific list of cookies, identifiers, providers, purposes and retention periods may vary as the Services and technology integrations evolve. When FUERA DEL MOLDE provides a cookie panel, notice or specific cookie settings, the information available there will supplement this Policy and allow the applicable choices to be managed.
17. Data Subject Rights
In accordance with Law 1581 of 2012 and other applicable rules, Data Subjects may exercise the rights available to them with respect to personal data Processed by FUERA DEL MOLDE.
17.1. Know, Update and Rectify Personal Data
The Data Subject may obtain information about the personal data FUERA DEL MOLDE Processes concerning them and request its updating or rectification when it is partial, inaccurate, incomplete, fragmented, misleading, outdated, or when its Processing is expressly prohibited or was not authorized where Authorization is required.
17.2. Request Proof of Authorization
The Data Subject may request proof of the Authorization granted to FUERA DEL MOLDE for the Processing of their personal data, except where the law expressly exempts this requirement.
17.3. Be Informed About the Use of Personal Data
The Data Subject may request information about how FUERA DEL MOLDE has used their personal data and the purposes for which it has been Processed, within the limits established by applicable law.
17.4. File Complaints with the Superintendence of Industry and Commerce
The Data Subject may file complaints with the Superintendence of Industry and Commerce regarding possible violations of the personal data protection regime after exhausting the inquiry or claim procedure before FUERA DEL MOLDE where that procedural prerequisite applies.
17.5. Revoke Authorization and Request Deletion of Data
The Data Subject may request revocation of Authorization and/or deletion of their personal data where permitted by applicable law. Revocation or deletion will not apply to information that must remain in Databases due to a legal or contractual duty, an ongoing relationship, or another legally valid basis that permits or requires its retention.
17.6. Access Personal Data Free of Charge
The Data Subject may access their personal data that has been subject to Processing free of charge, in accordance with the mechanisms, conditions and frequency established by applicable law.
18. Responsible Department and Channels for Exercising Rights
Grupo Tecnológico CATO S.A.S., through FUERA DEL MOLDE’s Customer Service department, will be responsible for receiving and coordinating responses to inquiries, claims and requests submitted by Data Subjects in exercising their personal data protection rights, with support from the legal, technology, administrative or operational departments appropriate to the nature of each case.
Data Subjects may submit their requests through the following channels:
Email: [email protected]. We recommend using “Personal Data Protection” as the subject line.
Mailing and business address: CL. 152 # 72-03, Tower 4, Bogotá D.C., Colombia.
FUERA DEL MOLDE may additionally provide electronic forms, Marketplace features or other specific channels, provided they allow evidence of the request and its handling to be retained.
19. Procedure for Inquiries, Claims and Exercise of Rights
Requests relating to personal data will be handled according to their nature and within the timeframes established by applicable Colombian law. FUERA DEL MOLDE may request only the information reasonably necessary to verify the identity or legal standing of the requester, understand the request and protect the data against unauthorized access or modification.
19.1. Persons Authorized to Submit Requests
Rights may be exercised by the Data Subject; by their successors-in-interest, upon proof of such status; by their representative or attorney-in-fact, upon proof of representation or power of attorney; by persons expressly authorized by the Data Subject or by law; and, in the case of children and adolescents, by persons authorized to represent them, without prejudice to the special safeguards established in this Policy.
19.2. Content and Filing of the Request
The request must contain sufficient information to identify the Data Subject or legally entitled person; specify a means for receiving the response; clearly describe the inquiry, facts or action requested; and, where applicable, include documents evidencing representation, legal standing or the facts relied upon.
The request will be deemed received on the date it enters through one of the enabled channels and can reasonably be identified as a request relating to personal data protection.
19.3. Inquiries
The Data Subject or other legally entitled persons may inquire about personal information held in FUERA DEL MOLDE’s Databases. The inquiry will be answered within a maximum of ten (10) business days from the date of receipt.
When the inquiry cannot be answered within that period, FUERA DEL MOLDE will inform the interested party, before the deadline expires, of the reasons for the delay and the date on which it will be answered, which may not exceed five (5) business days following expiration of the initial period.
19.4. Claims
When the Data Subject or a legally entitled person considers that information should be corrected, updated or deleted, seeks to revoke Authorization, or identifies a possible
breach of duties relating to the Processing of personal data, they may file a claim with FUERA DEL MOLDE.
If the claim is incomplete, FUERA DEL MOLDE will ask the interested party within five (5) days after receipt to cure the deficiencies. If two (2) months pass from the date of that request without the claimant providing the required information, the claim will be deemed withdrawn.
If the person receiving the claim is not competent to resolve it, the claim will be forwarded to the appropriate party within a maximum of two (2) business days, and the interested party will be informed accordingly.
Once a complete claim is received, FUERA DEL MOLDE will, where applicable, enter a notation in the Database stating “claim pending” together with the reason for the claim within no more than two (2) business days. The notation will remain until the claim is decided.
The maximum period for responding to a claim will be fifteen (15) business days counted from the day following receipt. When it cannot be resolved within that period, FUERA DEL MOLDE will inform the interested party of the reasons for the delay and the date on which it will be resolved, which may not exceed eight (8) business days following expiration of the initial period.
19.5. Updating, Rectification, Deletion and Revocation
Requests to update, rectify or delete data or revoke Authorization will be handled as claims. The requester must identify with sufficient clarity the information or Processing in respect of which action is requested.
When a deletion or revocation request cannot be fulfilled in whole or in part because of a legal or contractual duty to retain the information, an ongoing relationship or another legally valid basis, FUERA DEL MOLDE will inform the requester and limit Processing to purposes that remain legally authorized.
19.6. Procedural Prerequisite Before the Superintendence of Industry and Commerce
The Data Subject or their successor-in-interest may file a complaint with the Superintendence of Industry and Commerce after exhausting the inquiry or claim procedure before FUERA DEL MOLDE, where this requirement applies under Article 16 of Law 1581 of 2012.
20. Amendments, Effective Date and Version Retention
FUERA DEL MOLDE may amend this Policy when necessary to reflect legal, regulatory, technological, operational, contractual or Service-related changes or changes relating to the Processing of personal data.
When material changes occur that may affect the content of the Authorization, particularly regarding the identity of the Data Controller or the purposes of Processing, FUERA DEL MOLDE will inform the Data Subject through the
reasonably available means and will request a new Authorization where required by applicable law.
This Policy will become effective upon its official publication by FUERA DEL MOLDE. The Databases and Processing of information will remain in effect for as long as the purposes justifying the Processing, relationships with Data Subjects, and legally or legitimately applicable retention periods continue to exist.
FUERA DEL MOLDE may retain prior versions of this Policy for traceability, compliance, auditing and evidentiary purposes regarding the terms applicable at any given time.