1. Identification of the controller
CAFÉ NATIVO, S.A. DE C.V., a company duly incorporated and existing under the laws of the Republic of El Salvador (hereinafter, "CAFÉ NATIVO", "the Company" or "we"), is the controller responsible for the processing of personal data collected through the website and the coffee subscription services it offers.
For any inquiry, request or exercise of rights related to this Privacy Policy, the data subject may contact us through:
- Email: soporte@cafenativosv.com
- WhatsApp: (+503) 7571-7622
- Service hours: 9:00 a.m. - 5:00 p.m. UTC -6
2. Scope and legal framework
This Privacy Policy governs the processing of personal data of individuals who visit our website, create an account, contract a subscription, sign up for our mailing lists, or contact our service channels.
Personal data is processed in accordance with the Personal Data Protection Act of the Republic of El Salvador and other applicable regulations, including the Consumer Protection Act.
By using our website and contracting our services, the data subject declares that they have read and understood this Privacy Policy.
3. Personal data we collect
We collect only the data necessary to provide the subscription service and to comply with our legal and contractual obligations.
3.1 Account data
First and last names, email address and, where provided by the data subject, their profile picture. The access password is managed by our authentication provider and CAFÉ NATIVO has no access to it.
3.2 Data obtained when signing in with Google
When the data subject chooses to register or sign in using their Google account, we receive from Google only their name, email address and profile picture. Details on the use of this data are described in section 6 of this Policy.
3.3 Delivery data
Name of the recipient, delivery address, apartment or reference point, city, department, postal code where applicable, and contact telephone number.
3.4 Consumption preferences
The answers to the Preference Quiz and the taste profile derived from them: preferred roast level, brewing methods, flavor profiles, intensity and grind type. This data is used to select the coffees sent during the subscription.
3.5 Payment-related data
Payments are processed entirely by Wompi, operated by ACCELERA, S.A. DE C.V., as an independent payment gateway. CAFÉ NATIVO does not receive or store the full card number or the security code (CVV).
When the data subject saves a payment method for future purchases, we retain only the card brand, the last four digits, the expiration date and an encrypted identifier (token) generated by the gateway. We additionally retain the identifiers, amounts, dates and statuses of transactions necessary for billing, accounting reconciliation and the handling of claims.
3.6 Communications and support
The name, email address and content of messages sent through our contact forms or service channels. For security and abuse-prevention purposes, contact forms also record the IP address and browser identifier from which they are submitted.
3.7 Mailing lists and waitlist
The email address voluntarily provided to receive news and updates, as well as the department of interest when the data subject signs up for the delivery coverage waitlist.
3.8 Browsing and diagnostic data
Technical information generated automatically when using the site, such as pages visited, device and browser type, and error logs. This data is used in aggregate form to maintain and improve the service.
4. Purposes of processing
We process personal data for the following purposes:
- To create and administer the data subject's account and enable their authentication.
- To manage the contracting, charging, renewal and cancellation of the subscription.
- To select and prepare the coffees to be shipped, based on the preference profile.
- To coordinate and carry out deliveries.
- To send transactional communications essential to the service, such as payment confirmations, shipping notices and notifications about the status of the subscription.
- To handle inquiries, complaints, claims and refund or exchange requests.
- To comply with applicable accounting, tax and legal obligations.
- To prevent fraud and improper use of the platform.
- To send commercial communications and news, only where the data subject has consented.
- To analyze site usage in aggregate form in order to improve the experience and correct errors.
5. Basis for processing and consent
The processing of personal data is based on the free, specific, informed and express consent of the data subject, given when creating an account, contracting a subscription or voluntarily signing up for our mailing lists; on the performance of the contractual relationship arising from the subscription; and on compliance with legal obligations incumbent upon CAFÉ NATIVO.
The data subject may withdraw their consent to receive commercial communications at any time, without this affecting the provision of the contracted service or the lawfulness of prior processing.
6. Use of data obtained through Google services
When the data subject uses the sign-in with Google option, CAFÉ NATIVO accesses only the basic information of their profile: name, email address and profile picture.
With respect to such information we expressly declare the following:
- How it is accessed: the data is obtained only at the moment the data subject authorizes access from the Google consent screen, and only the minimum permissions necessary to identify the user are requested.
- How it is used: the data is used exclusively to create the data subject's account, authenticate their access to the platform, display their name and picture within their own account, and send them the transactional communications associated with the service.
- How it is stored: the data is stored in our database and in the authentication service described in section 7, under reasonable security measures and for the periods indicated in section 10.
- How it is shared: we do not sell, rent or assign the data obtained from Google. It is shared only with the processors listed in section 7, strictly to the extent necessary to provide the service.
- Limitations: data obtained from Google is not used for targeted advertising, is not transferred to data brokers, and is not used to determine creditworthiness or for any purpose other than those declared herein.
The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
The data subject may revoke the access granted to CAFÉ NATIVO at any time from the security settings of their Google account.
7. Processors and third parties with whom we share data
CAFÉ NATIVO does not sell or trade personal data. We share information only with providers acting as processors on our behalf, under contractual confidentiality and security obligations, and strictly to the extent necessary to provide the service. Those processors fall into the following categories:
- Payment processing: Wompi, operated by ACCELERA, S.A. DE C.V., as the independent payment gateway responsible for collecting subscription charges.
- Cloud infrastructure and hosting: providers that host the website, the database and the services supporting them.
- User authentication: providers that manage registration, sign-in and the safekeeping of access credentials.
- Email delivery: providers that deliver transactional communications and, where applicable, consented commercial communications.
- Analytics and technical monitoring: tools that measure website usage in aggregate and log errors to maintain the stability of the service.
- Logistics and delivery: carriers and delivery partners, who are provided only with the data essential to complete the shipment.
Additionally, we may disclose personal data where there is a legal obligation, a request from a competent authority, or where necessary to defend our rights in accordance with the law.
The data subject may request further information about the processors involved in the processing of their data by writing to soporte@cafenativosv.com.
8. International transfers
Some of the providers listed in the previous section operate servers outside the territory of the Republic of El Salvador. In such cases, the transfer is carried out for the performance of the contractual relationship, and we require our providers to maintain security and confidentiality standards appropriate for the protection of personal data.
9. Cookies and similar technologies
We use cookies and equivalent technologies that are strictly necessary for the operation of the site, such as maintaining the signed-in session and preserving the contents of the shopping cart.
Where the analytics tool is enabled, we additionally use measurement cookies that allow us to understand, in aggregate form, how the site is used. This information is not used to identify the data subject individually.
The data subject may configure their browser to block or delete cookies; however, disabling necessary cookies may prevent the account and the purchase process from working correctly.
10. Data retention
We retain personal data for as long as the data subject's account remains active and for the time necessary to fulfill the purposes described in this Policy.
Once the account or subscription is cancelled, we retain only the information required to comply with accounting, tax, warranty and legal defense obligations, for the periods established by applicable legislation. Once those periods have elapsed, the data is deleted or anonymized.
Mailing list data is retained until the data subject requests removal.
11. Rights of the data subject
The data subject may exercise the following rights at any time and free of charge:
- Access: to know what personal data of theirs we process and for what purpose.
- Rectification: to request the correction of inaccurate, incomplete or outdated data.
- Cancellation or erasure: to request the deletion of their data when it is no longer necessary for the purposes for which it was collected.
- Objection: to object to the processing of their data for specific purposes.
- Portability: to request delivery of their data in a structured, commonly used format.
- Right to be forgotten: to request the deletion of their data in the cases provided for by law.
- Restriction: to request the restriction of processing in the cases contemplated by law.
To exercise any of these rights, the data subject may write to soporte@cafenativosv.com stating their request and providing information that allows their identity to be verified. We will respond to the request within the periods established by applicable legislation.
Some actions may be carried out directly from the data subject's account, including updating their personal details, modifying their delivery addresses, managing their communication preferences and cancelling the subscription.
Notwithstanding the above, the data subject may file a complaint with the State Cybersecurity Agency (Agencia de Ciberseguridad del Estado, ACE), as the competent authority for personal data protection in the Republic of El Salvador.
12. Information security
CAFÉ NATIVO adopts reasonable technical, organizational and administrative measures to protect personal data against loss, unauthorized access, alteration or improper disclosure. These include encryption of communications through secure protocols, role-based access control, and limiting access to personnel who require it to perform their duties.
No system is completely infallible; in the event of a security incident affecting personal data, we will act in accordance with the notification obligations established by applicable legislation.
13. Minors
Our services are intended for persons over eighteen (18) years of age. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor without the corresponding authorization, we will proceed to delete it.
14. Commercial communications
Commercial communications and news are sent only to those who have given their consent. All such emails include a visible unsubscribe mechanism, and the data subject may also manage their communication preferences from their account or by writing to our support email.
Strictly transactional emails, such as payment confirmations, shipping notices and notifications about the status of the subscription, form part of the contracted service and are sent for as long as the subscription remains in force.
15. Changes to this Privacy Policy
CAFÉ NATIVO may update this Privacy Policy for legal, operational or technological reasons. Any modification will be published on the website with its corresponding update date and, where the change is substantial, will be communicated to the data subject through reasonable electronic means.