Privacy policy

This policy explains what personal data the Asociación Campesina LEGADOS receives through legados.co, what it uses it for, who it shares it with and how you can exercise your rights. It also explains what data it publishes about the Association’s coffee growers who authorize it (section 10). It is governed by Colombian Law 1581 of 2012 and its implementing decrees and, for people in the European Union, by Regulation (EU) 2016/679 (GDPR).

1. Data controller

Asociación Campesina LEGADOS · Registered address: Taminango, Nariño, Colombia · [email protected] · +57 311 777 4467.

EU representative (Art. 27 GDPR): Marc Gomes · [email protected] (write “EU Representative” in the subject line).

2. Data we receive

We do not ask for sensitive data. The site is not directed at minors.

3. What we use it for

• Answering quote requests and sending samples. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); in Colombia, the authorization you give when submitting the form.
• Managing shop orders: payment, grouped shipment, delivery, refunds and claims. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Meeting accounting and tax obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Protecting forms against abuse and spam. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Remembering the market you chose. Legal basis: legitimate interest, necessary to show you the shop you asked for.

We do not sell your data or use it for advertising. We will only send you marketing communications if you give us your express authorization.

4. Who we share it with

Providers that process data on behalf of the Association:

• Cloudflare: website hosting and form protection (Turnstile).
• Google: spreadsheet and automation where requests and orders are recorded.
• Zoho: email.

Third parties with their own privacy policy:

• PayPal or another payment provider, depending on the country: they process the payment.
• Carrier: receives name, address, phone number and email to deliver the order.
• WhatsApp (Meta), if you write to us there.

We may also share data with authorities when required by law.

5. International transfers

The Association operates from Colombia, and some providers store data in the United States or other countries. If you are in the European Union, your data is transferred to Colombia when necessary to handle your request or perform your purchase (Art. 49(1)(b) GDPR), and to providers under the safeguards each one offers, such as the European Commission’s standard contractual clauses.

6. How long we keep it

• Requests that do not lead to a sale: 2 years from the last contact.
• Orders and customer data: 10 years, for accounting and commercial obligations.
• Market preference: see the Cookie policy.

After these periods, the data is deleted.

7. Your rights

Law 1581 (Colombia): to know, update and correct your data; to request proof of your authorization; to be informed of how it is used; to revoke your authorization or request deletion when there is no legal duty to keep it; to access it free of charge; and to file a complaint with the Superintendence of Industry and Commerce (SIC) after completing the procedure with the Association.

GDPR (European Union): access, rectification, erasure, restriction, portability and objection; to withdraw your consent at any time; and to lodge a complaint with the data protection authority of your country.

8. How to exercise them

Write to [email protected] with the subject “Personal data”, your name, your request and a way to reply to you. We may ask you to confirm your identity.

Response times:

• Inquiries (Law 1581): 10 business days, extendable by up to 5 more business days with notice.
• Claims (Law 1581): 15 business days, extendable by up to 8 more business days with notice. If a claim is incomplete, we will ask you to complete it within 5 business days; if 2 months pass without you completing it, it will be considered withdrawn.
• Requests under the GDPR: 1 month, extendable by 2 more months in complex cases, with notice.

9. Security

Access to data is limited to the people in the Association who need it for their work, the site uses encrypted connections (HTTPS) and providers apply their own security measures. If an incident affects your data, we will inform you as required by law.

10. Coffee grower profiles

The Asociación Campesina LEGADOS publishes the profile of a member coffee grower only with their prior, express and informed written authorization, under Law 1581 of 2012. They may revoke it at any time, in person with the Association.

Where it is published:

• On their profile page at legados.co, in Spanish, English and French.
• On the pages of their lots, in the Portfolio and in the shop, with a link to their profile.
• On the packaging and sales sheets of their lots: their name and a QR code that leads to their profile.

What is published: full name, portrait and photos of their farm (without minors), farm name, municipality, altitude, varieties, processes, a text about their story and the way they work that they approve, and a quote from them only if they approve it.

What is never published: village (vereda), children or other identifiable family members, minors, contact details, ID number, address or coordinates, age, income, prices or sales volumes, or health or socio-economic information.

Revocation: we remove the profile from the site within 5 business days. From then on, its link and the QR codes already printed lead to the Origin page, and the name is no longer printed on new packaging or sheets. Packaging and sheets already delivered keep the printed name. We ask search engines to remove stored copies of the profile.

Retention: the profile is published while the authorization is in force. The Association keeps the written authorization as proof, also after a revocation, for as long as the law requires.

Hosting: profiles are hosted by Cloudflare and can be viewed from any country. The authorization covers this publication on the internet.

11. Facilitator code

• If you use a code, we store it with your order to apply the discount and calculate the facilitator’s points. The facilitator does not receive your details: they only see how many kg were bought with their code in each shipment.
• Each code carries the name or alias the facilitator chose, with their consent; anyone who receives or uses the code can see it.
• For facilitators, we process their name, email, code and points to run the programme and give them access to their account, for as long as they take part and until their last points expire. To sign in, we email them a single-use code, which is stored encrypted for 10 minutes.

12. Changes

Any changes will be published here with their date. If a change is significant, we will announce it on the site.