Personal data policy
Some details in this document are being updated.
The Scribes record history; of your data, only what is needed.
Version: 2026-10-16.3
In force from: 16 October 2026
Legal framework: Colombian Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and other Colombian personal data protection rules.
Draft pending legal review. This is a translation for convenience; if the two versions differ, the Spanish one prevails.
1. Data controller
The controller is Olga Cecilia Cañas Aguirre, a natural person, the owner of the VANDIUM brand, who is registering it in their own name with the Superintendencia de Industria y Comercio. There is no company yet.
Name: Olga Cecilia Cañas Aguirre
ID number (cédula) or NIT: Information being updated
Address: Information being updated, Cali, Valle del Cauca, Colombia
Email for personal data matters: [email protected]
Phone: +57 310 447 7054 (the WhatsApp one)
WhatsApp: +57 310 447 7054
Site: https://vandium.co
In this policy, "VANDIUM" or "we" is Olga Cecilia Cañas Aguirre, the controller above, and "you" or "the data subject" is the person whose data we process.
2. What data we process and where it comes from
| When | Data | Required |
|---|---|---|
| You join the access list or ask "Notify me if it's released" | email, language, the page you came from, confirmation date | yes |
| You sign in to buy | email and the one-time code we send you | yes |
| You hold an order | WhatsApp mobile (with country code); Colombian mobile for delivery; town and department; and, to ship, full name, ID number (cédula), address, neighbourhood and delivery notes | yes, for the order |
| You pay | the holder's name and the key or account you pay from, the receipt (image or PDF), and the amount and source account we see in the bank | yes, for the payment |
| Authorisations | the data authorisation you gave on the access list, in "Notify me" or when holding an order (date and time, notice version and language); and whether you accepted WhatsApp messages about your orders, news on WhatsApp and news by email, with the text you saw, its version, the date and the number | the data one, yes; WhatsApp and news, no |
| You sign the Scribes' Register | the name you choose for the canon, your email and whether you want your name shown | yes, to sign |
| You use the site | IP address and technical browser data, processed by Cloudflare for security and to check you are a person (Turnstile) | yes |
| You write to us | whatever you tell us on WhatsApp or by email | — |
We do not ask for sensitive data (health, racial origin, political or religious views, biometrics, etc.) or card data: you pay from your own bank via Bre-B. We do not sell your data.
Minors: the store is for adults. We do not knowingly process minors' data without their legal representative's authorisation; if we find out, we delete it.
3. What we use it for
Your order: holding, charging, reviewing the payment, producing, shipping, delivering and tracking; sending the emails for each status; refunding to the source account; handling changes, withdrawals, warranty claims and PQR.
Security and fraud prevention: checking that a receipt matches a real deposit, preventing hoarding with multiple emails or bots, applying per-person limits, protecting the site.
The access list: confirming your email and telling you when each movement opens, when your early access starts and, if you asked, when a piece is released.
The Scribes' Register: keeping who signed each piece, allowing transfers and publicly showing the serial, piece, date and lineage; your short name ("Ana R.") only if you chose to show it. Your email is never published.
WhatsApp about your orders (payment, shipping and delivery), only if you authorise it in its box.
News (launches and drops) on WhatsApp or by email, only if you authorise it in each channel's box.
Legal obligations: accounting, tax and consumer protection duties, and requests from authorities.
4. Authorisation
By signing in to buy and holding an order, you authorise processing for purposes 1, 2 and 7.
By joining the access list or asking "Notify me if it's released", you authorise purpose 3 with the authorisation box, which comes unticked and is required to sign up; we keep the date and time, the version of the notice you saw and its language. By signing the Register, purpose 4.
Purposes 5 and 6 have their own boxes, which come unticked and are optional: you can buy without ticking them. We keep proof of each authorisation: the exact text you saw, its version, the date and the number or email you gave it for. A WhatsApp authorisation is valid only for the number it was given for.
You can withdraw any authorisation at any time (see section 7).
5. Who else processes your data (processors) and international transfers
To run the store we use these providers, who process data on our behalf and only to provide their service:
| Processor | Purpose | Where the data is processed |
|---|---|---|
| Contabo GmbH | server (VPS) running the database, API and store | Germany · data centre: Information being updated |
| Cloudflare, Inc. | site delivery and security network (DNS, proxy, firewall), Turnstile and R2 storage: published art, payment receipts (in a private bucket) and encrypted backups | United States and its global network |
| Resend (Plus Five Five, Inc.) | sending emails | United States |
| WhatsApp (Meta Platforms) | messages with customers who authorise it or write to us: today with the WhatsApp Business app and, later, with the WhatsApp Business API (for an automated assistant) | United States and other countries |
| Interrapidísimo and Servientrega | delivering the order in Colombia: recipient's name, ID, address and mobile | Colombia |
| DHL | international shipping (quoted on WhatsApp): name, address, phone and whatever customs requires | the destination country and its global network |
Your bank and the Bre-B system process the transfer data as independent controllers, under their own policies.
Some of these providers process data outside Colombia, which is an international transmission of data. The United States and Germany are on the list of countries with an adequate level of protection of the Superintendencia de Industria y Comercio. Each processor is bound by a data processing agreement that requires it to protect the data and use it only on our instructions Information being updated.
6. How long we keep it
Access-list people who never bought (no order of theirs was ever paid; whether or not they confirmed their email): deleted 2 years after their last activity (sign-up, confirmation, authorisation or any change to their data), together with their "Notify me" rows and codes.
Orders that were never paid (expired or cancelled without any payment): deleted 2 years after their last change.
Paid orders and their proof (acceptance, payments, refunds and delivery): 10 years from delivery, the period for commercial records.
Payment and refund receipts: 10 years from delivery or, if the order was cancelled or refunded with money involved, from its last change; they are accounting proof. Then deleted.
The emails we send you: 90 days after sending we delete their recipient and content; only their type and date remain.
One-time codes (purchase and Register): deleted one day after they expire.
Backups: deleted after 30 days.
Scribes' Register: while the piece exists in the register; the lineage is the piece's history. You can ask us to remove your public name at any time.
Authorisations: the proof of each authorisation (date and time, notice version, language and where it came from) is kept for as long as our relationship lasts and 10 more years. If we delete your access-list data, we keep only that proof, use it for nothing else, and delete it once those 10 years have passed.
Minimal suppression record: if, when we delete your data, your email had bounced, complained or was blocked, we keep only a key of that email and the reason, so we never write to it again nor lift the block if someone signs it up again.
7. Your rights
As data subject you can, free of charge:
Know, update and correct your data.
Ask for proof of the authorisation you gave us.
Be told how we have used it.
Withdraw your authorisation and ask us to delete your data, when there is no legal or contractual duty to keep it.
File complaints with the Superintendencia de Industria y Comercio, after going through the procedure with us.
Access your data.
Quick ways:
Stop news by email: use the "unsubscribe" link at the foot of any news email. Emails about your orders keep coming.
Withdraw WhatsApp authorisations: message us on WhatsApp or write to the personal data email.
Remove your public name from the Register: message us on WhatsApp or by email.
Have us delete your data: message us on WhatsApp or by email. If you have no paid purchases, we delete everything of yours (except the proof of your authorisations and, where it applies, the minimal suppression record of section 6). If you have paid purchases, the law makes us keep those sales' data for 10 years; we delete everything else (list, "Notify me", WhatsApp, news and your name in the Register).
8. How to file a query or a claim
Where: at [email protected] or on WhatsApp (+57 310 447 7054). Include your name, the email or mobile you registered with, what you are asking and, for a claim, the facts and any documents.
Who handles it: Olga Cecilia Cañas Aguirre, the controller, at [email protected].
Queries: we reply within 10 business days at most. If we cannot, we tell you why and reply within the following 5 business days.
Claims (correct, update, delete or withdraw): we reply within 15 business days at most. If we cannot, we tell you why and reply within the following 8 business days. If the claim is incomplete, we ask for what is missing within 5 days; if you do not send it within 2 months, we treat the claim as withdrawn. While it is being resolved, the data is tagged "claim in progress".
To check you are the data subject, we may send a code to the registered email.
9. Security
We apply technical and administrative measures to protect your data: encrypted connections (HTTPS); receipts in a private bucket with no public address, opened only from the admin panel through a temporary link; restricted panel access on an origin separate from the store; secrets in a password manager; encrypted backups; one-time codes to sign in and to sign the Register; and the rule of refunding only to the source account. No system is infallible: if an incident affects your data, we will report it to the Superintendencia de Industria y Comercio and to you as the law requires.
10. Cookies and browser storage
The site does not use analytics or advertising cookies. It uses your browser's local storage for things you ask for: your cart (localStorage) and the checkout session and waitlist turns (sessionStorage, cleared when you close the tab). Cloudflare and Turnstile may use their own cookies or technical signals for security and to tell people from bots.
11. Changes to this policy
If we change this policy, we publish the new version with its date on the site. If the change affects the purposes or the controller's identity, we will tell you before applying it and, if needed, ask for a new authorisation.
12. Term
This policy is in force from 16 October 2026. The databases will be kept while VANDIUM carries out its activity and according to the periods in section 6.