PRIVACY POLICY AND PERSONAL DATA PROCESSING

Last updated: August 28, 2026

D’RASO S.A.S. (hereinafter, “D’RASO,” “we,” “our,” or the “Company”) is committed to protecting the privacy and personal data of its customers, users, and visitors.

This Privacy Policy and Personal Data Processing Policy explains how we collect, use, store, protect, and, where applicable, share personal information when you use our website, make a purchase, create an account, communicate with us, or use any of our related services.

This Policy has been prepared to comply with applicable obligations in Colombia and, where applicable, obligations arising from data protection laws applicable in other countries, including the European Union General Data Protection Regulation (GDPR), where applicable.

This Policy should be read together with our Terms and Conditions, Exchange and Return Policy, Cookie Policy, and other policies published on our website.

1. DATA CONTROLLER

D’RASO S.A.S.

Legal Representative: Mr. Robiro Ocampo

Address: Calle 66 # 48A-100, Medellín, Colombia

Email: gerencia@drasocalzado.com

Customer service and personal data requests: atencionalcliente@drasocalzado.com

WhatsApp: +57 313 621 4425

2. SCOPE OF APPLICATION

This Policy applies to personal information collected by D’RASO through its websites, online stores, forms, customer service channels, electronic communications, and other means used to provide its services.

D’RASO sells its products both in Colombia and internationally. For this reason, certain processing activities may be subject to different data protection laws depending on the country or region where the user is located.

Where the European Union General Data Protection Regulation (GDPR) applies, D’RASO will comply with the relevant provisions applicable to processing activities within its scope.

3. INFORMATION WE COLLECT

D’RASO may collect different categories of information depending on how you interact with us.

3.1. Information You Provide Directly

We may collect information that you voluntarily provide when you:

create an account;
make a purchase;
request information about our products;
contact our customer service team;
request an exchange, return, or warranty service;
subscribe to marketing communications;
voluntarily participate in promotions, surveys, or D’RASO activities.

Depending on the service used, this information may include:

first and last name;
identification number, when necessary;
billing address;
delivery address;
country, city, and postal code;
telephone number;
email address;
information related to orders and purchases;
information necessary to manage exchanges, returns, or warranty claims;
communications you have with D’RASO;
any other information you voluntarily choose to provide.

3.2. Payment Information

Payments made through our website may be processed by specialized payment service providers.

D’RASO does not directly request or store complete payment card details on its own servers.

The information necessary to process a payment may be transmitted directly to the relevant payment service provider in accordance with its own terms, security measures, and privacy policies.

Depending on the provider used and the payment method, D’RASO may receive information related to the outcome of the transaction, such as payment confirmation, transaction status, transaction reference, or other information necessary to manage the order.

3.3. Order Information

When you make a purchase, we may retain information related to the transaction, such as the order number, products purchased, purchase amount, delivery address, billing information, order status, shipping information, and communications related to the purchase.

3.4. Technical and Browsing Information

When you visit our website, certain technical data may be collected automatically by our systems or by technologies used on the website.

Depending on the technical configuration of the website and your consent preferences, this information may include:

IP address;
browser type and version;
device type;
operating system;
browser language and regional settings;
date and time of access;
pages visited;
time spent on the website;
information related to website operation and security;
technical information necessary to detect errors, abuse, or fraudulent activity.

The collection of certain technical data may depend on the use of cookies or similar technologies and the consent preferences configured by the user.

3.5. Approximate Location Information

D’RASO may use technical information such as an IP address, when necessary, to determine the approximate country or region from which the website is accessed.

This information may be used, among other purposes, to direct the user to the appropriate national or international version of the website, display commercial information relevant to their region, or enable certain website features.

This functionality does not mean that D’RASO automatically collects or stores the user’s precise GPS coordinates.

D’RASO does not claim to collect precise location information through GPS, Wi-Fi, or device sensors unless such functionality is expressly implemented and disclosed to the user and, where applicable, the required consent is obtained.

4. COOKIES AND SIMILAR TECHNOLOGIES

D’RASO uses cookies and similar technologies to enable the operation of the website, remember certain preferences, analyze website usage, improve our services, and, where applicable and with the required authorization, conduct advertising or marketing activities.

Cookies may be first-party or third-party cookies and may have different purposes and retention periods.

4.1. Strictly Necessary Cookies

These cookies are necessary for certain essential website functions to operate correctly, such as maintaining a session, managing the shopping cart, remembering certain technical settings, processing certain transactions, or providing security-related functions.

These cookies may be used when necessary to provide the requested service, comply with an applicable obligation, or ensure the technical and secure operation of the website, in accordance with applicable law.

4.2. Preference Cookies

These cookies allow us to remember certain user preferences, such as language, region, website settings, or other selected options.

When applicable law requires consent for certain preference cookies, they will only be used after obtaining such consent.

4.3. Analytics Cookies and Technologies

We may use analytics technologies to understand how visitors use our website, identify technical issues, evaluate page performance, and improve the browsing experience.

When these technologies require consent under applicable law, they will only be activated after obtaining such consent.

4.4. Advertising and Marketing Cookies

Where applicable, D’RASO may use technologies designed to measure advertising campaigns, understand the effectiveness of our marketing activities, create or measure audiences, personalize content, or display relevant advertising.

These technologies may be provided by third parties and will be subject to the consent mechanisms and other requirements established by applicable law.

4.5. Cookie Management

Users can manage certain cookie preferences through the configuration tools available on the website and through their browser settings.

Where a cookie management or consent mechanism is available on the website, users may modify their preferences according to the options provided.

Disabling certain cookies may affect some website functionalities.

For more detailed information about the cookies used, their purposes, providers, duration, and management options, users may consult our Cookie Policy and the configuration mechanism available on the website, where applicable.

5. MICROSOFT CLARITY AND ANALYTICS TOOLS

D’RASO may use Microsoft Clarity to understand how users interact with our website and to improve its operation and browsing experience.

Depending on Clarity’s configuration and the consent provided, this tool may use technologies such as cookies, behavioral metrics, heatmaps, and session recordings.

These tools may help us identify navigation issues, errors, usability difficulties, and opportunities to improve our products and services.

Where applicable law requires prior consent for these technologies, D’RASO will obtain and manage such consent before activating the relevant functionalities.

In particular, for visitors from the European Economic Area (EEA), the United Kingdom, and Switzerland, D’RASO will use consent mechanisms compatible with the requirements applicable to Microsoft Clarity, where required.

Users may find additional information about Microsoft’s processing activities in the official documentation and privacy policies applicable to Microsoft Clarity.

6. PURPOSES OF PROCESSING

D’RASO may use the personal information collected for the following purposes:

creating and managing user accounts;
processing and managing orders;
processing payments through our authorized providers;
coordinating deliveries and shipments;
providing customer service;
managing exchanges, returns, and warranties;
responding to inquiries, requests, and complaints;
maintaining records of business transactions;
complying with legal, tax, accounting, and regulatory obligations;
preventing, detecting, and investigating fraud, abuse, and unlawful activities;
protecting the security of our systems;
improving the operation and content of the website;
analyzing general browsing behavior where there is a lawful basis to do so;
conducting statistical studies and analyses;
personalizing certain website functionalities;
sending communications related to orders, accounts, services, security, or important changes to our policies;
sending marketing communications and promotions when there is a valid legal basis and, where required, the user’s consent;
conducting customer satisfaction surveys;
responding to technical support requests;
protecting and enforcing our rights and legitimate interests where legally permitted;
complying with obligations and requests from competent authorities;
managing and improving our business relationships;
any other purpose disclosed to the user at the time the information is collected.

7. LEGAL BASES FOR PROCESSING

Depending on applicable law and the specific purpose, D’RASO may process personal information on the basis of one or more of the following:

the performance of a contract or pre-contractual measures requested by the user;
compliance with legal obligations;
the data subject’s consent, where required;
the protection of D’RASO’s or third parties’ rights and legitimate interests, where legally permitted;
fraud prevention and detection and security protection;
other legal bases recognized under applicable law.

Where processing is based on consent, the user may withdraw consent at any time, without affecting the lawfulness of processing carried out previously on the basis of that consent.

Withdrawal of consent will not affect processing that may continue on another valid legal basis or where there is a legal obligation to retain or process certain information.

8. MARKETING COMMUNICATIONS

We may send information about products, news, promotions, campaigns, launches, and other marketing communications when there is a valid legal basis for doing so and, where required, the appropriate consent.

Marketing communications may be sent by email, WhatsApp, text messages, notifications, or other communication channels provided or authorized by the user, as applicable.

Where applicable law requires prior consent for certain marketing communications, D’RASO will obtain such consent before sending them.

Users may request to stop receiving marketing communications at any time by following the instructions included in those communications or by contacting us directly.

Opting out of marketing communications will not prevent the sending of communications that are strictly necessary to manage a purchase, account, warranty, return, security matter, or legal obligation.

Consent to receive marketing communications will not be a condition of making a purchase where applicable law requires such consent to be independent.

9. WHO WE MAY SHARE INFORMATION WITH

D’RASO does not sell the personal data of its customers.

We may share personal information when necessary to provide our services, manage our operations, protect our rights, or comply with a legal obligation, including with the following categories of recipients:

technology service providers;
hosting and IT service providers;
e-commerce service providers;
payment processing providers;
shipping and logistics companies;
customer service providers;
email and communications service providers;
analytics and measurement providers;
advertising and marketing service providers, where applicable;
security and fraud prevention service providers;
professional advisors when necessary;
administrative, judicial, or governmental authorities when legally required or otherwise legally permitted.

Service providers that process personal information on behalf of D’RASO must use such information in accordance with the applicable instructions and for authorized purposes, in compliance with applicable agreements and legal requirements.

10. INTERNATIONAL DATA TRANSFERS

Due to the international nature of our services, certain technology providers, platforms, payment companies, hosting services, analytics tools, communication services, or logistics providers may be located in countries other than the user’s country of residence.

When personal information is transferred, stored, or processed internationally, D’RASO will implement the measures and mechanisms required by applicable law to protect such information.

Where the GDPR applies, international transfers will be carried out using mechanisms recognized by that regulation when required, such as adequacy decisions, standard contractual clauses, or other legally valid mechanisms.

11. DATA RETENTION

D’RASO will retain personal information for as long as necessary to fulfill the purposes for which it was collected and, where applicable, for the periods required by legal, contractual, tax, accounting, or other obligations, or for the establishment or defense of claims.

The retention period may vary depending on the nature of the information, the purpose of the processing, the commercial relationship with the user, and applicable legal obligations.

For example, certain information related to orders, billing, and business transactions may be retained for the periods required by applicable tax, accounting, commercial, or other regulations.

When information is no longer necessary, it will be deleted, anonymized, or subject to measures that prevent its use for incompatible purposes, in accordance with applicable law.

12. INFORMATION SECURITY

D’RASO adopts reasonable technical, administrative, and organizational measures designed to protect personal information against loss, destruction, unauthorized access, alteration, improper disclosure, or unauthorized processing.

Where appropriate, we use security mechanisms such as encrypted SSL/TLS connections, access controls, and measures to protect our systems.

Access to personal information is limited, where appropriate, to individuals, service providers, or third parties who need to know such information to fulfill authorized purposes or applicable obligations.

However, no electronic transmission or storage system can guarantee absolute security. Therefore, D’RASO cannot guarantee that information will be completely free from security risks.

13. RIGHTS OF DATA SUBJECTS IN COLOMBIA

Under applicable Colombian personal data protection laws, data subjects may exercise, among others, the following rights:

to know, update, and correct their personal data;
to request information about how their data has been used;
to request proof of the authorization provided where required;
to submit inquiries and complaints;
to request deletion of their data where legally permitted;
to withdraw the authorization provided where legally permitted;
to access their personal data free of charge under the terms established by applicable law;
to file complaints with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio) when they believe their rights have been violated.

These rights may be exercised in accordance with the conditions, exceptions, and procedures established under Colombian law.

14. PROCEDURE FOR INQUIRIES AND COMPLAINTS IN COLOMBIA

Data subjects or their successors in title may submit inquiries or complaints regarding their personal data through the contact channels indicated in this Policy.

Requests must, where applicable, allow the identification of the data subject and clearly describe the inquiry, request, or complaint being submitted.

When acting through a representative, attorney-in-fact, or successor in title, D’RASO may request the documents necessary to establish such representation or status.

D’RASO may request information reasonably necessary to verify the identity of the requester and protect information against unauthorized access.

Inquiries and complaints will be handled within the time periods established by applicable Colombian law.

If the data subject believes that their rights have been violated and, after using the applicable mechanisms, wishes to contact the competent authority, they may file a complaint with the Superintendence of Industry and Commerce, in accordance with applicable legal requirements.

15. RIGHTS OF USERS IN THE EUROPEAN UNION AND OTHER TERRITORIES WHERE THE GDPR APPLIES

Where the GDPR applies to the processing of your personal data, you may exercise, subject to the conditions established by that regulation, the following rights:

the right to access your personal data;
the right to rectify inaccurate or incomplete data;
the right to have your data erased;
the right to request restriction of processing;
the right to data portability;
the right to object to processing in cases provided by law;
the right to withdraw consent where processing is based on consent;
the right to object to direct marketing;
the right not to be subject to certain decisions based solely on automated processing where the conditions established by law are met;
the right to lodge a complaint with the competent data protection authority.

The exercise of these rights may be subject to exceptions and limitations established by applicable law.

16. HOW TO EXERCISE YOUR DATA RIGHTS

To make an inquiry or request the updating, correction, deletion, withdrawal of consent, objection to processing, or any other action related to your personal data, you may contact us:

Email: atencionalcliente@drasocalzado.com

WhatsApp: +57 313 621 4425

To protect our customers’ information, we may request information reasonably necessary to verify the identity of the requester before processing certain requests.

D’RASO will respond to requests within the time periods established by applicable law.

Where a request cannot be fully or partially fulfilled due to a legal obligation, an applicable exception, or the need to retain certain information, D’RASO will inform the requester where appropriate and to the extent permitted by applicable law.

17. CHILDREN’S PRIVACY

Our services are not intentionally directed to minors where applicable law requires a minimum age above that required to provide certain services or authorize certain processing activities.

D’RASO does not knowingly seek to collect personal data from minors without the authorizations required by applicable law.

If a parent or legal representative believes that a minor has improperly provided personal data to D’RASO, they may contact us to request that the information be reviewed and, where appropriate, deleted.

18. SENSITIVE PERSONAL DATA

D’RASO does not knowingly request sensitive personal data that is not necessary to provide its services.

Users should avoid providing sensitive information that is not necessary to process their request.

If, in exceptional circumstances, it becomes necessary to process information considered sensitive under applicable law, D’RASO will implement the required measures and obtain any authorizations required by such law.

19. LINKS TO THIRD-PARTY WEBSITES

Our website may contain links to websites, platforms, or services operated by third parties.

D’RASO does not control the privacy practices of such third parties, and this Policy does not apply to their services.

We recommend reviewing the privacy policies of each third party before providing personal information.

20. THIRD-PARTY SERVICES

Some services necessary to operate our store may be provided by third parties, such as payment, shipping, hosting, analytics, communication, security, advertising, or technology providers.

Each provider may process certain data in accordance with the terms and policies applicable to its service.

D’RASO will seek to select providers that provide appropriate guarantees regarding the security and protection of information, in accordance with applicable legal obligations.

21. FRAUD PREVENTION AND SECURITY

We may use personal and technical information to detect, prevent, and investigate fraudulent activities, abuse, unauthorized access, attempted attacks, suspicious transactions, or other activities that may affect D’RASO, our customers, or third parties.

Where necessary, we may share information with specialized providers or competent authorities to protect our rights and prevent unlawful activities.

Certain service providers, including payment, security, or fraud prevention providers, may use automated tools to assess transactions or detect potentially fraudulent activity in accordance with their own policies and legal obligations.

22. AUTOMATED DECISION-MAKING AND PROFILING

D’RASO may use automated tools for certain technical, analytical, security, fraud prevention, or personalization functions, in accordance with applicable law.

Where a decision produces legal effects or similarly significantly affects the user and is based solely on automated processing, D’RASO will apply the safeguards required by the relevant legislation where applicable.

Where a decision or assessment is made by an external service provider, the terms and policies of that provider may also apply.

23. PUBLIC INFORMATION AND USER-PROVIDED CONTENT

If you voluntarily provide content intended to be publicly displayed, such as comments, reviews, photographs, or other material, you should be aware that such information may be visible to third parties.

Users should avoid providing personal information belonging to third parties without obtaining the appropriate authorization.

24. ACCURACY OF INFORMATION

D’RASO seeks to keep personal information accurate and up to date.

Users may request the correction or updating of their information when they determine that it is inaccurate, incomplete, or outdated.

25. DELETION AND LIMITATIONS ON THE EXERCISE OF RIGHTS

Requests for deletion, objection, restriction, or modification of data will be handled in accordance with applicable law.

In certain cases, D’RASO may be legally required to retain certain information, for example, to comply with tax, accounting, legal, contractual, or security obligations, or to establish, exercise, or defend legal claims.

Where there is a legal retention obligation, a legitimate need to protect or defend rights, or any other exception recognized by applicable law, a request for deletion or objection may be limited to the extent permitted by such law.

26. CHANGES TO THIS POLICY

D’RASO may update this Policy when necessary due to legal, regulatory, technological, business, or service changes.

The current version will be available on our website.

When significant changes occur that require specific notification under applicable law, D’RASO will use the appropriate communication methods.

The date of the latest update will appear at the beginning of this Policy.

27. APPLICABLE LAW

For processing activities carried out by D’RASO in Colombia, Colombian personal data protection laws will apply, including any regulations applicable to the processing of personal information.

When processing is subject to mandatory data protection laws in another country or territory, including the European Union GDPR where applicable, D’RASO will comply with the provisions legally applicable to such processing.

Nothing in this Policy is intended to limit any rights a person may have under the data protection laws applicable to them.

28. CONTACT

If you have questions about this Policy, wish to exercise your rights, or need additional information about how your personal data is processed, you may contact us:

D’RASO S.A.S.

General Manager: Mr. Robiro Ocampo

Address: Calle 66 # 48A-100, Medellín — Colombia

General email: gerencia@drasocalzado.com

Customer service and data protection email: atencionalcliente@drasocalzado.com

WhatsApp: +57 313 621 4425

D’RASO appreciates the trust placed in our company and is committed to handling personal information responsibly, transparently, and securely, in accordance with applicable legal obligations.