Privacy and personal data policy

Operator, data controller and contact

Personal data requests: Valentina Puerta.

1. Scope and principles

This policy explains the processing of personal data received through valbrandconsult.com and inquiries, quotes and business relationships continued by email, WhatsApp or other Valbrand channels. It covers collection, storage, access, use, disclosure, correction and deletion of information about individuals, including business contacts.

We apply the principles of lawfulness, purpose limitation, freedom, accuracy, transparency, restricted access, security and confidentiality under Colombian Law 1581 of 2012 and its regulations, consolidated in Decree 1074 of 2015. Foreign privacy rules apply where their territorial and material conditions are met; visiting from another country does not by itself determine applicability.

2. Information processed and its sources

We may receive your name, email, telephone, country and city; brand or business name; garment types, quantities, indicative budget, references, files and messages you choose to share. If you place an order, identification, invoicing, delivery and payment information needed for the transaction may be requested. Do not send passwords, security codes or complete payment card numbers in forms or messages.

Information comes mainly from you or your authorised business representative. If you share another person's information, you must be entitled to do so and inform them of its intended use. Website hosting may generate technical logs, including IP address, date, browser, requested path and errors, needed to serve and protect the website.

3. How the contact forms work

Forms prepare a draft in your browser; they do not themselves place an order or confirm receipt of an inquiry. Opening WhatsApp includes the prepared text in the link sent to that service. Valbrand receives the message when you send it. When you open email, your application manages the draft and its delivery. Check the text and recipient before continuing.

Required fields allow the request to be prepared and answered. You may omit optional fields or contact the published channel directly. The website does not store these drafts in its own form database; your browser, email application or messaging service may retain information according to its settings.

4. Purposes and authorisation

We use relevant information to answer questions, assess projects, prepare and negotiate quotes, coordinate design, patterns, samples, production, customisation and deliveries, and handle payments, invoices, warranties, complaints and legal obligations. We also use it to prevent abuse and address website incidents. An inquiry is not blanket permission for unrelated purposes.

Where Colombian law requires it, processing needs prior, express and informed authorisation in a form that can subsequently be consulted. Silence and merely browsing do not authorise advertising. Forms with an authorisation checkbox include a statement in the prepared message; for other contact channels, the appropriate authorisation must be obtained before processing that requires it, unless a legal exception applies. You may request evidence and withdraw authorisation subject to applicable law.

5. Marketing communications

Responding to your project and sending promotional updates are different purposes. Authorisation to answer an inquiry does not subscribe you to campaigns. Any promotional communications must have the required authorisation and respect selected channels, contact restrictions, permitted times and opt-out mechanisms, including Colombian Law 2300 of 2023 and the excluded-numbers register where applicable.

You may stop advertising by replying to a message or emailing the contact in this policy without cancelling a purchase. Marketing opt-out does not prevent necessary communications concerning orders, security, complaints or legal obligations.

6. Sensitive information and children

Business channels are not intended to request health, biometric, ethnic origin, sexual orientation, belief or other sensitive information. You are not obliged to provide it. If exceptionally necessary, its purpose must be explained and the required explicit authorisation obtained; services will not depend on unnecessary sensitive information.

The website is intended for people able to manage projects and enter into contracts. We do not deliberately request children's personal information. Manufacturing children's clothing does not require information about the children who will wear it. If you identify information submitted about a child, contact us so that deletion or legally permitted exceptional processing can be assessed, respecting the child's best interests, rights and required authorisations.

7. Recipients and international data flows

Information may be accessed by Valbrand personnel who need to handle your request and by hosting, email, messaging, accounting, payment or logistics providers as needed for the relevant transaction. It may also be disclosed to authorities under a valid legal obligation or request. Sharing information to fulfil an order does not give its recipient unrestricted permission to use it for advertising.

Valbrand operates in Colombia. External services may process information in other countries and act as processors or independent controllers, depending on their role. Processing on Valbrand's behalf requires applicable contractual conditions; transfers to other controllers must meet relevant protection rules, exceptions or authorisations. Where the GDPR applies, flows subject to Chapter V require an appropriate transfer mechanism. This policy does not replace those mechanisms or constitute blanket consent to transfers.

You may ask the privacy contact about recipients, countries and safeguards relevant to your case. Links to WhatsApp, social networks, maps and the external store open services with their own policies; review those terms before sharing information there.

8. Retention, confidentiality and security

Inquiries are retained while being handled and during related project follow-up; customer records are retained for the contractual relationship and periods required for accounting, tax, commercial or legal claims purposes. Duration depends on the purpose, document type and applicable obligation. Information must not be kept indefinitely merely because it might be useful in the future. You may request the retention criterion or period applicable to your records.

When purposes and required periods expire, information must be deleted or anonymised; where retention is required or a dispute exists, use must be limited accordingly. Access must be restricted to those who need it, with proportionate technical, organisational and personnel measures and confidentiality duties. No channel offers absolute security. Report suspected exposure to the listed contact; incidents must be assessed and reported to individuals or authorities where legally required.

9. Rights and procedure in Colombia

You may access, update and correct your information free of charge; request evidence of authorisation and information about its use; complain about improper processing; and request deletion or withdraw authorisation where applicable. Deletion or withdrawal does not remove legal or contractual obligations to retain particular records.

Send your request to Valentina Puerta using the email or address at the beginning, stating your name, the right concerned, relevant facts, a reply channel and supporting material. Individuals, their successors or duly authorised representatives may submit requests. Only proportionate information to verify identity or representation should be requested; do not send unnecessary sensitive documents.

Access inquiries are answered within 10 business days of receipt, extendable by up to 5 additional business days with prior notice of the reason and response date. Complaints are resolved within 15 business days from the day after receipt, extendable by up to 8 additional business days with a reasoned notice before the original deadline.

If a complaint is incomplete, correction will be requested within 5 days of receipt; after 2 months without a response to that request, it is considered withdrawn. An incompetent recipient must forward it within 2 business days and notify the applicant. Once complete, a pending-complaint notation and reason must be entered in the relevant database within 2 business days until resolution. After completing the procedure with the controller or processor, you may complain to Colombia's Superintendence of Industry and Commerce.

10. Additional information where the GDPR applies

If processing is subject to Regulation (EU) 2016/679, applicable grounds depend on the purpose: steps you request before a contract and contract performance, compliance with applicable legal obligations, consent for uses that require it, and legitimate interests in responding to professional contacts or protecting the website, subject to balancing your rights. A GDPR legitimate interest does not replace authorisation required by Colombian law.

In addition to access and correction, you may request erasure, restriction, portability where applicable and object to legitimate-interest processing; objections to direct marketing must be respected. You may withdraw consent without affecting prior lawful processing. The general response period is one month, extendable by two months for complexity or number of requests with notice during the first month. You may complain to the competent supervisory authority, including where you habitually reside, work or where an alleged infringement occurred.

Information needed for a quote or contract may be essential to fulfil it; optional information is not a condition of general website access. Current forms do not make solely automated decisions with legal effects or profile people to decide customer acceptance. For rights under other applicable laws, use the same contact and describe your request; no mandatory right is restricted because it is not listed here.

11. Effective date and changes

Published 19 August 2026; last updated 11 November 2026. Database duration depends on the purposes and retention criteria described. Material changes will be communicated before taking effect through the website and, where appropriate, available contact channels. Publishing an update alone does not authorise a new purpose requiring consent: the appropriate authorisation must be obtained. You may request the version applicable when your information was collected.