Personal Data Processing Policy

The data controller is CORA, a Colombian single-farm specialty coffee brand from Balboa, Risaralda. For anything to do with your personal data, write to hola@coracoffee.co: it is the official channel and the founding team reads it directly.

Registered name

Jessica Andrea Villegas Silva

Tax ID (NIT)

1032403585-4

Registered address

Calle 34 #64-10, Medellín, Colombia

Person handling requests

Jessica Andrea Villegas Silva

Contact email

hola@coracoffee.co

Website

coracoffee.co

CORA is the trade name of the data controller identified above. To exercise your rights, an email to the contact address is enough: no forms, no paperwork.

We only ask for what we need to reply to you or to ship what you buy. There are no hidden fields: what you see in each form is exactly what gets stored.

Online shop

Full name, email, phone (optional), shipping address and city, along with the details of your order.

Wholesale, export and become-a-seller forms

Name, email, company or business, city or country, phone when you share it, and whatever you write in the message.

Sample request

Name, email, company, role, city, the volume you are looking for and your message.

Partner Portal

Login email and password, name, phone, address, city and country, plus the record of your academy progress, your sales and your commissions.

WhatsApp

The number you write from and the content of the conversation, including whatever you tell us about your business.

We do not ask for sensitive data — ethnic origin, health, beliefs, biometrics — and we need none of it for anything we do. We also never receive card details: payment is arranged outside the site, after you confirm the order.

• Processing, shipping and invoicing your orders, and contacting you to arrange payment and delivery.
• Answering and following up on your quote requests, sample requests and commercial enquiries.
• Running the Partner Portal: granting access, recording academy progress, logging sales and settling commissions.
• Handling your questions, complaints and requests by email or WhatsApp.
• Reviewing, in aggregate, what is ordered and from which cities, so we can adjust the catalogue, delivery times and service.
• Prevent and detect fraud in site purchases, and protect the consumer and the cardholder.
• Meeting the legal, accounting and tax obligations that require us to keep the record of a sale.

We do not sell your data or hand it over for third-party advertising. If one day we want to send you commercial email you did not ask for, we will request a separate authorisation first, and you can say no without losing anything.

Processing rests on your prior, express and informed authorisation. You give it when you send a form, confirm an order or write to us on WhatsApp, with this policy visible and linked at the point of submission. Giving it is voluntary; if you would rather not, we simply cannot reply to you through these channels.

You can withdraw it at any time by writing to hola@coracoffee.co. Two honest caveats: if you withdraw it while an order is in progress, we cannot complete the shipment; and there is information about completed sales that the law requires us to keep for accounting and tax reasons even if you ask us to delete it.

To keep the site running we rely on five providers that process data on our behalf, as data processors. Each one reaches only what it needs to deliver its service, and none may use your data for its own purposes.

Supabase

The business database: orders, customers, requests and partner accounts live there.

Resend

Sending email: order confirmations, internal notifications to the team and password recovery.

Twilio

Sending and receiving the WhatsApp messages of CORA's sales assistant.

Cloudflare

The servers that deliver the site; they process the technical connection data needed to render each page for you.

Google (Google Analytics)

Visit and advertising measurement. It uses cookies once you accept them; otherwise it receives signals without cookies or identifiers. It never receives your name, email or phone number.

All five run on infrastructure outside Colombia, so by using the site you authorise the international transfer and transmission of your data to them. CORA remains answerable to you and requires of them a level of protection equivalent to the one Law 1581 of 2012 demands. Beyond these processors we hand your data to no one else, unless a competent authority requires it.

When you buy on the site you expressly, previously and informedly authorise us to process your information for fraud management, for these purposes:

• Share identification, transaction and device data with providers or partners carrying out fraud prevention activities, including some located outside Colombia, among them in the United States of America.
• Analyse that information with systems using artificial intelligence and machine learning, to identify risks and detect fraud, protecting the site's transactions.
• Train and improve those automated fraud detection and prevention systems.
• Generate transactional patterns or profiles that help prevent fraud on this site and others connected to those systems.

This processing is necessary to guarantee payment security and the correct operation of the site. It is carried out by Bold, our payment gateway, together with its anti-fraud providers: CORA never receives or stores your card details.

We use Google Analytics to understand how the site is used (which pages are visited, which search or ad brought you here, whether you asked for a quote or messaged us on WhatsApp) and to measure our advertising. Its cookies (_ga and _ga_ followed by a code) are only stored on your device if you accept them in the notice shown on your first visit. If you decline or don't answer, the site works the same and Google only receives signals without cookies or persistent identifiers (which page was viewed or which action was taken), which it cannot link to you; we never send your name, email, phone number or your order number in the page address. We do not use this data to show you personalized ads. Google keeps visit-level data for up to 14 months; after that only aggregated figures remain. You can change your choice at any time under "Cookie preferences" at the bottom of every page; if you decline after accepting, we delete those cookies from your browser. There is also a session cookie created when you log in to the Partner Portal or the admin panel, and your browser's local storage keeps your cart, your cookie choice and a technical list of orders already recorded so they are not counted twice; none of it leaves your device until you confirm an order.

Law 1581 of 2012 grants you these rights over your data, and there is no small print here limiting them:

• To access, update and correct your data, especially when it is incomplete, out of date or misleading.
• To ask for proof of the authorisation you gave us, except where the law does not require one.
• To be told, on request, how we have used your data.
• To withdraw your authorisation and ask us to delete your data, provided no legal or contractual duty requires us to keep it.
• To consult your data free of charge, at least once a month and whenever there are substantial changes to this policy.
• Refuse to provide sensitive data or data about minors, and know that answering questions about them is optional: never mandatory.
• To file a complaint with Colombia's Superintendency of Industry and Commerce for breaches of the law, once you have exhausted the enquiry or complaint process with us.

Write to hola@coracoffee.co, ideally from the address you contacted us with, telling us your name, what you need, and something that lets us find your record: order number, business name or city. There is no form and no paperwork; an email is enough.

• Enquiries (finding out what data we hold): we answer within ten (10) business days at most. If we cannot, we tell you why and answer within the following five (5) business days.
• Complaints (correcting, updating, deleting or withdrawing): we resolve them within fifteen (15) business days at most. If we cannot, we tell you why and answer within the following eight (8) business days.
• If a complaint arrives incomplete, we ask for the missing part within the following five (5) days. If two months pass without your reply, we take it as withdrawn.

Email hola@coracoffee.co

Your data lives in a database with restricted access. The connection to the site is encrypted, the keys that can read the whole database exist only on the server and never travel to the browser, Partner Portal passwords are stored encrypted — not even we can read them — and inside the team each person sees only what their job requires. No system is infallible: if an incident affects your data, we will tell you and report it to the authority where required.

The site is not aimed at minors and we do not knowingly collect data from children or adolescents. Part of the catalogue also includes coffee liqueur, which may only be bought by people over 18. If you believe a minor has given us their data, write to us and we will delete it.

This policy takes effect on 27 August 2026. We keep your data for as long as our relationship with you lasts and, afterwards, for as long as legal, accounting and tax obligations require. CORA's database stays in force while the brand operates and the purposes described here still apply; once they no longer do, the data is deleted.

We will publish the new version on this same page, with its date. When a change affects the purpose we collected your data for, we will tell you before applying it and, where the law requires, ask for a fresh authorisation.