Privacy Policy

Effective date: October 3, 2026
Last updated: October 3, 2026

This is an English translation provided for convenience. In the event of any discrepancy, the Spanish version (Política de Tratamiento de Datos Personales y Privacidad) prevails.

This Personal Data Processing and Privacy Policy (the “Policy”) is issued in compliance with the Political Constitution of Colombia (articles 15 and 20), Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Chapter 25, Title 2, Part 2, Book 2 of Single Regulatory Decree 1074 of 2015) and any rules that amend or supplement them. It governs the collection, storage, use, circulation, transfer, transmission and deletion (the “Processing”) of personal data collected through the website https://bellabio.co (the “Site”) and BellaBio’s other service channels.

1. Data Controller

  • Company name: BellaBio LLC, a company registered in Wyoming, USA
  • Registered address: 1619 Sheridan Way, Wyoming, USA
  • Email: hello@bellabio.net
  • Phone: +1 408-908-8375
  • Website: https://bellabio.co

Hereinafter “BellaBio”, “we” or the “Controller”.

2. Definitions

The definitions in article 3 of Law 1581 of 2012 and article 3 of Decree 1377 of 2013 apply, including:

  • Authorization: the Data Subject’s prior, express and informed consent to the Processing of their personal data.
  • Database: an organized set of personal data subject to Processing.
  • Personal data: any information linked or that may be associated with one or more identified or identifiable natural persons.
  • Sensitive data: data that affects the Data Subject’s privacy or whose misuse may lead to discrimination, such as data concerning health, sexual orientation, or racial or ethnic origin.
  • Processor: a natural or legal person that processes personal data on behalf of the Controller.
  • Data Subject: the natural person whose personal data is processed.
  • Transfer: sending personal data to a recipient that is itself a controller, inside or outside Colombia.
  • Transmission: communicating personal data to a Processor, inside or outside Colombia, so it can process the data on the Controller’s behalf.

3. Principles

BellaBio applies the principles of legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality set out in article 4 of Law 1581 of 2012.

4. Personal data we collect

  • Identification and contact data: name, ID number (when required for electronic invoicing), email, phone, shipping and billing address, city and department.
  • Purchase data: products purchased, amounts, order history, coupons or affiliate codes used and order-related communications.
  • Payment data: card payments are processed directly by our payment provider (Stripe). BellaBio does not store the full card number or security code; we may receive only limited information such as the transaction status, card brand and last four digits.
  • Browsing data: IP address, browser and device type, pages visited, preferred language and data collected through cookies and similar technologies (see section 11).
  • Verification data: confirmation that the user is 18 or older and, where applicable, information about the buyer’s research institution or activity.
  • Account and commercial program data: username and encrypted password for the Site account, and data of people who sign up as affiliates or distributors (including commission payment details, where applicable).

Sensitive data. BellaBio does not request sensitive data, in particular health data. Please do not include this type of information in forms, messages or comments. Data Subjects are not required to authorize the Processing of sensitive data (article 6 of Law 1581 of 2012 and article 6 of Decree 1377 of 2013).

Minors. The Site and products are intended exclusively for persons aged 18 or older. BellaBio does not knowingly collect data from children or adolescents. If we discover that a minor’s data has been provided, we will delete it.

5. Purposes of Processing

  1. Processing, confirming, invoicing, shipping and tracking orders, including issuing electronic sales invoices.
  2. Managing payments, preventing fraud and verifying the legitimacy of transactions.
  3. Verifying legal age and compliance with the research-use-only conditions.
  4. Handling requests, complaints and claims, including warranty, withdrawal (retracto), payment reversal and return requests.
  5. Sharing the data needed for delivery with courier and transport companies.
  6. Managing the user’s Site account and the affiliate and distributor programs, including calculating and paying commissions.
  7. Complying with legal, accounting and tax obligations and requests from competent authorities.
  8. Ensuring the security and technical operation of the Site, remembering language and age-verification preferences, and producing aggregate usage statistics.
  9. With specific authorization, which may be revoked at any time: sending marketing communications, newsletters and information about products, news and promotions by email, WhatsApp, SMS or other channels.

Processing for marketing purposes (item 9) is optional; declining it does not prevent you from purchasing on the Site.

6. Authorization

BellaBio will request the Data Subject’s authorization no later than at the time of collection, by means that allow later verification (article 9 of Law 1581 of 2012 and article 7 of Decree 1377 of 2013), including: (i) the acceptance checkbox in the checkout, registration or Site forms; (ii) data messages or emails; or (iii) unequivocal conduct by the Data Subject from which it can reasonably be concluded that authorization was given. BellaBio will keep proof of the authorization.

Authorization is not required in the cases set out in article 10 of Law 1581 of 2012, such as information requested by a public entity exercising its legal functions or by court order, or public data.

7. Data Subject rights

Under article 8 of Law 1581 of 2012, Data Subjects have the right to:

  1. Know, update and correct their personal data held by BellaBio or its Processors.
  2. Request proof of the authorization granted, except where the law does not require it.
  3. Be informed, upon request, of how their personal data has been used.
  4. File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law, after exhausting the inquiry or claim procedure with BellaBio.
  5. Revoke the authorization and/or request deletion of their data when the Processing does not respect constitutional and legal principles, rights and guarantees. Revocation and/or deletion does not apply where there is a legal or contractual duty to remain in the database.
  6. Access their processed personal data free of charge at least once every calendar month and whenever there are substantial changes to this Policy (article 21 of Decree 1377 of 2013).

These rights may be exercised by the Data Subject, their successors, representative or attorney-in-fact, or by stipulation in favor of another, upon proof of identity or standing.

8. BellaBio’s duties

BellaBio will comply with the duties in article 17 of Law 1581 of 2012, including guaranteeing the right of habeas data, keeping information under secure conditions, updating and correcting information when appropriate, handling inquiries and claims within the legal time limits, and informing the SIC of breaches of security codes.

9. Responsible area and contact channels

Inquiries and claims are handled by BellaBio LLC customer service through the following channels:

10. Procedure for inquiries and claims

10.1 Inquiries (article 14 of Law 1581 of 2012)

Data Subjects or their successors may consult the personal information held in our databases. The request must include the Data Subject’s full name, a contact method and the information requested. Inquiries will be answered within a maximum of ten (10) business days from receipt. If this is not possible, we will explain the reasons for the delay and the date the inquiry will be answered, which may in no case exceed five (5) business days after the first deadline expires.

10.2 Claims (article 15 of Law 1581 of 2012)

Data Subjects or their successors who believe that information should be corrected, updated or deleted, or who notice an alleged breach of legal duties, may file a claim that includes: (i) the Data Subject’s identification; (ii) a description of the facts giving rise to the claim; (iii) an address or notification method; and (iv) any supporting documents.

  • If the claim is incomplete, we will ask the claimant to correct it within five (5) days of receipt. If two (2) months pass from the date of our request without the requested information being provided, the claim will be deemed withdrawn.
  • If BellaBio is not competent to resolve it, we will forward it to the appropriate party within a maximum of two (2) business days and inform the claimant.
  • Once a complete claim is received, the note “claim in process” (“reclamo en trámite”) and the reason for it will be added to the database within no more than two (2) business days and kept until the claim is decided.
  • The maximum time to resolve the claim is fifteen (15) business days from the day after receipt. If this is not possible, we will explain the reasons for the delay and the date the claim will be resolved, which may in no case exceed eight (8) business days after the first deadline expires.

10.3 Prerequisite for complaints to the SIC

Data Subjects may file a complaint with the Superintendence of Industry and Commerce only after exhausting the inquiry or claim procedure with BellaBio (article 16 of Law 1581 of 2012).

11. Cookies and similar technologies

The Site uses cookies and similar technologies (such as browser local storage) for:

  • Essential operation: keeping the shopping cart and session, processing payments securely and preventing fraud (WooCommerce, WordPress and payment-provider cookies).
  • Preferences: remembering the selected language (pll_language cookie) and the age confirmation for 30 days.
  • Order attribution: WooCommerce’s order attribution feature uses first-party cookies (prefixed sbjs_) to record where a visit came from, such as the referring site or campaign parameters, and associate it with the order. The Site does not use third-party analytics tools or advertising pixels (such as Google Analytics, Google Tag Manager or Meta Pixel).

You can set your browser to block or delete cookies. If you block essential cookies, some Site features, such as the cart or checkout, may not work properly.

12. International transmission and transfer of data

To operate the Site and process orders, BellaBio relies on providers that may store or process personal data outside Colombia, in particular:

  • Stripe, Inc. and its affiliates (United States and other countries), as card payment processor.
  • Namecheap, Inc. (United States), as hosting provider for the Site and its databases.
  • The payment page hosted on the encantocakes.com domain, to which the Buyer is directed to complete the card payment processed by Stripe, and which receives the order data needed for that purpose.

These operations are carried out under article 26 of Law 1581 of 2012 and articles 24 and 25 of Decree 1377 of 2013, to countries that provide adequate levels of protection according to the standards of the Superintendence of Industry and Commerce, or on the basis of the Data Subject’s express and unequivocal authorization, data transmission agreements or other legal exceptions, such as performance of the sales contract with the Data Subject. By accepting this Policy, the Data Subject expressly authorizes the international transmission and transfer of their data to the providers listed above for the purposes described in section 5. BellaBio requires its Processors to apply security and confidentiality measures.

13. Information security

BellaBio adopts reasonable technical, human and administrative measures to protect personal data against tampering, loss, or unauthorized or fraudulent consultation, use or access, including encryption of Site communications (HTTPS). No system is completely infallible; in the event of a security incident affecting personal data, we will notify the SIC and, where appropriate, the affected Data Subjects.

14. Data retention

Personal data will be kept for as long as necessary to fulfill the purposes described and the periods required by accounting, tax and commercial rules (including the retention period for merchants’ books and records). Afterwards, it will be deleted or anonymized unless there is a legal or contractual duty to keep it.

15. Effective period of the Policy and databases

This Policy is effective from October 3, 2026. BellaBio’s databases will remain in force for as long as the purposes for which the data was collected continue and for the applicable legal retention periods. Any substantial change to this Policy will be communicated to Data Subjects in a timely manner through the Site or by email before it takes effect; if the change concerns the purpose of Processing, a new authorization will be requested (articles 5 and 13 of Decree 1377 of 2013).