Privacy Policy

1. Responsible Party for Data Processing

The data controller responsible for the processing of your personal information is:

This Privacy Policy governs the processing of personal data collected through our website blackstonecoffee.com and is subject to the provisions of Ley 1581 de 2012 (Colombian Statutory Law on Personal Data Protection), its regulatory decree Decreto 1377 de 2013, and the guidelines issued by the Superintendencia de Industria y Comercio (SIC) as the Colombian data protection authority. To the extent users access our services from the United States, we additionally adhere to applicable federal privacy standards.

2. Information We Collect

We collect personal data in the following categories, depending on how you interact with our platform:

2.1 Information You Provide Directly

• Account registration: full name, email address, password (stored in hashed form by Firebase Authentication).
• Membership requests: full name, email address, WhatsApp/phone number, selected membership plan.
• Wholesale applications: business name, contact name, email, phone number, business type, estimated monthly volume, and a description of your needs.
• Newsletter subscriptions: email address and the page from which you subscribed.
• Contact form: name, email, phone number, subject, and message content.
• Orders: delivery address, order contents, payment details (processed by third-party gateways — see Section 6).

2.2 Information Collected Automatically

• IP address and approximate geographic location.
• Browser type, operating system, and device information.
• Pages visited, time spent, and navigation patterns (via Firebase Analytics / Google Analytics).
• Referring URL and search terms that led you to our site.

2.3 Information from Third Parties

If you authenticate using a federated identity provider (e.g., Google Sign-In), we receive only the information that provider shares in accordance with your privacy settings on that platform, typically your name and email address.

3. Purposes of Data Processing

Your personal data is processed for the following specific, explicit, and legitimate purposes:

• Account management: creation, authentication, and maintenance of your user profile.
• Order fulfillment: processing and delivering your coffee orders, notifying you of order status, and handling returns or complaints.
• Loyalty program: tracking and crediting points earned through purchases and eligible activities, and allowing redemption of rewards.
• Membership services: processing membership plan requests, activating benefits, and managing renewals or cancellations.
• Wholesale relations: evaluating wholesale applications and establishing commercial agreements.
• Marketing communications: sending newsletters, promotional offers, and product updates to subscribers who have given express consent — and only to them.
• Analytics and improvement: understanding usage patterns to improve our website, menu, and services.
• Legal compliance: fulfilling our obligations under Colombian law, including tax and commercial regulations.
• Fraud prevention and security: detecting and preventing unauthorized access, fraudulent orders, and other malicious activity.

4. Legal Basis for Processing

Under Colombian law (Ley 1581 de 2012, Article 6) and where applicable under U.S. privacy frameworks, we process your data on the following lawful grounds:

• Consent (autorización): express, free, and informed consent obtained at the point of collection — required for marketing communications, newsletter subscriptions, and analytics. You may withdraw consent at any time without retroactive effect.
• Contractual necessity: processing necessary to perform the contract with you, such as account creation, order processing, and loyalty program management.
• Legitimate interest: fraud detection, website security, and internal analytics, subject always to your rights prevailing over our interests.
• Legal obligation: compliance with Colombian commercial, tax, and consumer-protection laws.

5. Data Retention

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable law:

• Account data: for the duration of your active account plus 5 years after account deletion (commercial record requirements under Código de Comercio).
• Order records: 10 years, in accordance with Colombian accounting and tax obligations.
• Newsletter subscriptions: until you unsubscribe or withdraw consent.
• Loyalty points history: for the duration of your membership plus 2 years.
• Analytics data: aggregated and anonymized within 26 months (Google Analytics default retention).
• Membership and wholesale applications: 5 years from the date of application or the conclusion of the commercial relationship.

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymized.

6. Third-Party Service Providers

We share your data with the following categories of trusted third-party processors, all of whom are contractually bound to process your data solely on our behalf and in accordance with applicable law:

Firebase / Google (Google LLC)

Firebase Authentication, Cloud Firestore, and Firebase Analytics are used for user authentication, data storage, and usage analytics. Google LLC is our primary data processor. Data may be stored on Google's servers, which include locations in the United States and the European Union. For more information, see Firebase Privacy and Security.

Google Analytics

We use Google Analytics 4 (GA4) to understand how visitors interact with our website. IP addresses are anonymized. You may opt out via the Google Analytics Opt-out Browser Add-on.

Payment Processors

When payment functionality is active, we use third-party payment gateways (such as Mercado Pago) that process payment card data directly under their own PCI-DSS-compliant environments. Blackstone Coffee SAS does not store full card numbers or CVV codes.

WhatsApp / Meta Platforms

Our "Order Now" button redirects to WhatsApp (operated by Meta Platforms, Inc.). Any data you share in that conversation is subject to Meta's privacy policy. We recommend you review it at whatsapp.com/legal/privacy-policy.

Web Hosting (GoDaddy)

Our website is hosted by GoDaddy Inc. (United States). GoDaddy may process server logs containing IP addresses and access timestamps for security and operational purposes.

7. International Data Transfers

As a Colombian company using cloud infrastructure based in the United States, your data may be transferred to and processed in the United States. Such transfers occur under appropriate safeguards recognized by Colombian law, including:

• Data processing agreements with our service providers that include standard contractual clauses.
• Reliance on service providers that participate in recognized compliance frameworks (e.g., Google's compliance with ISO 27001, SOC 2, and applicable data protection standards).

By using our website and providing your data, you acknowledge and consent to these international transfers as described in this Policy.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. We use the following types:

Essential Cookies

Strictly necessary for the website to function. They do not require your consent and cannot be disabled. They include session cookies used for authentication (Firebase Auth).

Analytics Cookies

Google Analytics 4 cookies (e.g., _ga, _gid) allow us to measure visits and behavior to improve our site. These are set only with your consent.

Managing Cookies

You can configure your browser to block or delete cookies at any time. However, disabling certain cookies may affect the functionality of our website. Most modern browsers include cookie management tools in their settings menu.

9. Your Rights

Under Colombian Ley 1581 de 2012 (Articles 8 and 14) and applicable U.S. privacy law, you hold the following rights with respect to your personal data:

• Access (Consulta): know what personal data we hold about you, its origin, use, and any transfers made.
• Rectification (Corrección): request correction of inaccurate, incomplete, or outdated data.
• Deletion (Supresión): request deletion of your data when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent, subject to legal retention requirements.
• Revocation of consent (Revocación): withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Objection (Reclamo): file a complaint regarding non-compliance with Ley 1581 de 2012.
• Portability: receive your data in a structured, commonly used, and machine-readable format where technically feasible.
• Unsubscribe from marketing: opt out of promotional communications at any time by clicking "Unsubscribe" in any email or contacting us directly.

To exercise any of these rights, please contact us at:

We will respond to your request within 15 business days as required by Colombian law. If you are unsatisfied with our response, you may escalate your complaint to the Superintendencia de Industria y Comercio (SIC) at www.sic.gov.co.

10. Children's Privacy

Our website and services are not directed to children under the age of 14. We do not knowingly collect personal data from children under 14 without verifiable parental consent as required by Colombian law (Ley 1581 de 2012, Article 7) and applicable U.S. laws including the Children's Online Privacy Protection Act (COPPA).

If we become aware that we have collected personal data from a child under 14 without appropriate consent, we will delete that data promptly. If you believe we have inadvertently collected such data, please contact us immediately.

11. Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction, including:

• HTTPS encryption (TLS) for all data transmitted to and from our website.
• Firebase Authentication for secure password management (passwords are never stored in plain text).
• Firebase Security Rules restricting database access to authenticated users and authorized operations only.
• Regular reviews of access controls and security configurations.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach that may affect your rights, we will notify you and the SIC in accordance with applicable legal requirements.

12. Amendments to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by sending you an email notification or displaying a prominent notice on our website.

Your continued use of our website after any modification constitutes your acknowledgment of the updated policy. We encourage you to review this page periodically.

13. Contact and Data Protection Authority

For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

If your concern is not resolved to your satisfaction, you have the right to file a complaint with the Colombian data protection authority: