Data Processing (Habeas Data) and Privacy Policy

MOCÁN, in compliance with the Political Constitution of Colombia (Article 15), Law 1581 of 2012, Decree 1377 of 2013, and Single Decree 1074 of 2015, adopts this Policy to guarantee the fundamental right of habeas data and to regulate the collection, use, storage, transfer, and deletion of personal data belonging to its customers, suppliers, partners, and website visitors.

1. Definitions

Term: Meaning

• Personal DataI: information linked to an identified or identifiable natural person.

• Sensitive Data: Data that affects the privacy of the Data Subject or whose misuse could lead to discrimination (e.g., health, racial origin, biometrics).

• Data Subject: The natural person whose personal data is being processed.

• Processing: The collection, storage, use, circulation, or deletion of data.

• Authorization: Prior, express, and informed consent from the Data Subject.

• Data Processor: The party that processes data on behalf of the Data Controller (e.g., payment gateways, logistics operators).

2. Collected Data

• Identification and contact details: name, ID document, email, phone number, shipping address, and billing address.

• Transaction data: purchased products, order history, and data required for payment (processed by the gateway; MOCÁN does not store complete credit or debit card details).

• Browsing data: IP address, device type, cookies, and site analytics data.

• Commercial data: preferences and data provided for promotions, surveys, or newsletter subscriptions.

MOCÁN does not routinely request sensitive data. Should it be required, MOCÁN will inform the user that answering is not mandatory and will obtain specific authorization. MOCÁN does not knowingly collect data from minors without the authorization of their legal representatives; when processing data from children and adolescents, their best interests will be strictly respected.

3. Purposes of Processing

• To manage registration, orders, payments, billing, and both domestic and international shipping.

• To provide customer service and handle warranties, returns, and PQRS (Petitions, Complaints, Claims, and Suggestions).

• To comply with legal, accounting, tax, and food traceability obligations.

• To send commercial communications, promotions, and newsletters, provided the Data Subject has given authorization.

• To perform statistical analysis and improve the shopping experience.

• To transmit or transfer data to Data Processors and necessary partners to fulfill the business relationship (logistics, payments, technology).

4. Authorization

Processing requires the prior, express, and informed authorization of the Data Subject, obtained through opt-in checkboxes, physical or electronic forms, or any method that serves as proof of consent. By accepting this Policy and making a purchase or registering, the Data Subject authorizes the processing of their data for the purposes described herein.

5. Data Transfer and Transmission

MOCÁN may share data with Data Processors and partners (payment gateways, domestic and international logistics operators, technology providers, and email services). For international sales, some data may be transferred to other countries to fulfill the shipment. MOCÁN adopts necessary measures to ensure such third parties provide an adequate level of protection and process the data solely for authorized purposes.

6. Cookies

The site uses cookies and similar technologies for its operation, analytics, and personalization. The User can configure their browser to manage or reject them; however, disabling cookies may affect certain functionalities of the site.

7. Security and Retention

MOCÁN adopts reasonable technical, human, and administrative measures to protect data against unauthorized access, loss, or alteration. Data is retained only for the time necessary to fulfill its purposes and legal obligations, after which it is securely deleted.

8. Validity and Modifications

This Policy is effective upon publication and may be modified by MOCÁN at any time. The databases will remain active as long as they are necessary for the authorized purposes.