Privacy policy

Tornasol, a business established in the Republic of Colombia, is the controller responsible for personal data processed under this policy. Contact: [email protected].

We process personal data in accordance with Colombia's data protection regime (Ley 1581 de 2012 and its implementing decrees — the habeas data framework) and, where they apply to you, other data protection laws such as the EU/UK GDPR and US state privacy laws. This policy also serves as the privacy notice required by those laws.

(a) Data you provide. Identity and contact data (name, email address, phone number, shipping and billing address); account credentials; order history; the contents of messages you send us; and your newsletter subscription.

(b) Payment data. Payments are processed by third-party payment providers. Your payment credentials are submitted directly to the provider and never reach our servers. We receive only transaction metadata: confirmation of payment, amount, currency, and a payment reference.

(c) Data collected automatically. When you use the Site, our infrastructure records technical and usage data: IP address, device and browser type, operating system, language and region settings, referring pages, pages and products viewed, navigation paths, timestamps, and error events.

By navigating the Site, you accept that we collect and process the technical and usage data described in section 2(c) to operate, secure, and improve our systems, catalog, and customer experience. This processing rests on our legitimate interest in running and improving the store (and, under Colombian law, on the authorization you grant by using the Site after notice of this policy). We analyse this data in aggregate to understand how the store performs; we do not use it to build advertising profiles of individuals, and we do not engage in automated decision-making that produces legal or similarly significant effects.

Optional analytics cookies are separate and are set only with your consent (section 4).

Strictly necessary cookies are required for the Site to function: cart contents, sign-in session, region and currency selection, and the record of your cookie choice. These are set without consent because the Site cannot operate without them.

Analytics cookies help us understand how the Site is used. They are set only if you select "Accept" in the cookie banner. You may withdraw consent at any time by clearing this Site's cookies in your browser, after which the banner will ask again. We honour your choice for as long as the consent cookie exists (up to one year).

We do not currently respond to "Do Not Track" browser signals, as no industry standard exists; our practices are as described in this policy regardless of such signals.

We process personal data to: (a) form and perform the sales contract — processing orders, payments, delivery, returns, and customer service (legal basis: performance of a contract); (b) operate, secure, and improve the Site and prevent fraud and abuse (legitimate interests); (c) send service communications about your orders and account (performance of a contract); (d) send the newsletter, only if you subscribed, with an unsubscribe link in every message (consent, revocable at any time); (e) comply with legal obligations, including Colombian tax, accounting, and consumer-protection requirements (legal obligation); and (f) establish, exercise, or defend legal claims (legitimate interests).

We do not sell or rent personal data, and we do not share it with third parties for their own advertising. We disclose personal data only: (a) to processors that operate the store on our instructions — payment providers, shipping carriers, our transactional and newsletter email service, and our hosting and content-delivery infrastructure — each receiving only the data its function requires and bound by contractual safeguards; (b) where required by law, regulation, court order, or a competent authority, including Colombian authorities; (c) where reasonably necessary to protect the rights, safety, or property of Tornasol, our customers, or others, including fraud prevention; and (d) in connection with a merger, acquisition, financing, or sale of all or part of the business, in which case the recipient remains bound by commitments at least as protective as this policy and you will be notified of any material change.

Because we sell worldwide and rely on international service providers, personal data may be processed outside your country, including in Colombia and the United States. Where a transfer is subject to transfer restrictions (for example under the GDPR or Ley 1581 de 2012), we rely on recognized safeguards such as adequacy decisions, standard contractual clauses, or your consent where applicable.

We retain personal data only as long as necessary for the purposes described: order, invoicing, and tax records for the periods required by Colombian commercial and tax law; account data until you delete the account or request erasure; newsletter data until you unsubscribe; technical logs for short rotation periods; and data relevant to a dispute for the duration of the dispute and applicable limitation periods. Data no longer required is deleted or irreversibly anonymized.

We apply technical and organizational measures appropriate to the risk: encryption in transit (HTTPS) across the entire Site, payment credentials handled exclusively by certified payment providers, access to customer data restricted to the two people who operate the company, and infrastructure kept minimal and updated. No system is completely secure; if a breach affecting your data occurs, we will notify you and the competent authorities as applicable law requires.

Subject to applicable law, you have the right to: know, access, and obtain a copy of your personal data; correct or update inaccurate or incomplete data; request deletion of data that is no longer required or was unlawfully processed; object to or request restriction of certain processing; withdraw consent at any time without affecting prior processing; receive your data in a portable format; and not be discriminated against for exercising these rights. Under Colombian law these include the habeas data rights to know, update, and rectify your information and to revoke authorization where processing does not rest on a legal or contractual duty.

To exercise any right, contact [email protected]. We may need to verify your identity before acting on a request, and we will respond within the period applicable law requires (and in any case within 30 days, extendable only where the law allows). You may also lodge a complaint with your supervisory authority — in Colombia, the Superintendencia de Industria y Comercio (SIC); in the EU/UK, your local data protection authority.

The Site is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us personal data, contact [email protected] and we will delete it.

We may update this policy as our operations, tools, or legal obligations evolve. The date above indicates the current version; material changes will be announced on the Site, and where law requires fresh authorization we will seek it.

Tornasol — [email protected]. See also our terms & conditions and shipping policy.