Ppolicy and privacy Datos Personales

At Torii & Ko, we are committed to protecting the privacy of our users, customers, suppliers, and visitors, in accordance with current Colombian legislation on personal data protection, including Law 1581 of 2012, Decree 1377 of 2013, Sole Regulatory Decree 1074 of 2015, and any other regulations that modify, add to, or complement them.

This Privacy and Personal Data Protection Policy establishes the guidelines under which Torii & Ko collects, stores, uses, manages, transmits, transfers, protects, and deletes personal data provided by data subjects through its various physical, digital, commercial, and customer service channels.

By browsing our website, making a purchase, filling out forms, subscribing to commercial communications, or contacting us through any of our channels, you authorize the processing of your personal data in accordance with this policy.

For inquiries, requests, updates, corrections, or deletion of personal data, you can write to us at: hola@toriiandko.com

Torii & Ko, in its capacity as personal data controller, informs all data subjects that the personal data collected will be processed in accordance with the principles, rights, and duties established by Colombian regulations. This policy applies to the personal data of customers, users, suppliers, business partners, collaborators, website visitors, and third parties who have a relationship with the brand.

The purpose of this Policy is to define the general guidelines for the proper processing of personal data collected by Torii & Ko, including its collection, storage, use, circulation, transmission, transfer, protection, updating, rectification, and deletion. This policy seeks to guarantee the fundamental right to habeas data, privacy, and the protection of individuals' personal information.

For the purposes of this Policy, the following definitions will be taken into account:

Authorization: Prior, express, and informed consent of the data subject to carry out the processing of their personal data.

Database: Organized set of personal data that are subject to processing.

Personal data: Any information linked or that can be associated with one or more specific or determinable natural persons.

Public data: Information that is not semi-private, private, or sensitive, and that may be contained in public records, public documents, or publicly accessible sources.

Sensitive data: Information that affects the privacy of the data subject or whose improper use may generate discrimination, such as health data, political orientation, religious beliefs, biometric data, among others.

Data Processor: Natural or legal person who performs the processing of personal data on behalf of the controller.

Data Controller: Natural or legal person who decides on the database or the processing of personal data. For the purposes of this Policy, Torii & Ko will be the controller.

Torii & Ko will apply the following principles in the processing of personal data:

Purpose Principle: Processing will serve a legitimate purpose, of which the data subject will be informed.

Freedom Principle: Processing will only be carried out with the prior, express, and informed authorization of the data subject, except for legal exceptions.

Veracity or Quality Principle: Processed information must be truthful, complete, accurate, updated, verifiable, and understandable.

Transparency Principle: The data subject may obtain information about the existence and use of their personal data.

Restricted Access and Circulation Principle: Personal data may only be processed by authorized persons or by those permitted by law.

Security Principle: Information will be protected by reasonable technical, human, and administrative measures to prevent alteration, loss, consultation, use, or unauthorized access.

Confidentiality Principle: Persons involved in the processing of personal data will be obliged to guarantee the confidentiality of the information.

Torii & Ko may collect, among others, the following personal data:

• Full name.
• Identification document.
• Shipping or billing address.
• Email address.
• Phone or cell phone number.
• City, department, and country.
• Information related to purchases, orders, payments, and deliveries.
• Information necessary for customer service, warranties, exchanges, or claims.
• Website browsing information, cookies, and digital preferences.

If sensitive data is collected, the data subject will be informed in advance, and explicit authorization will be requested when applicable. The data subject will not be obliged to provide sensitive data.

Personal data collected by Torii & Ko may be processed for the following purposes:

• Manage purchases made on our website.
• Process payments, billing, and order confirmation.
• Coordinate product shipments and deliveries.
• Provide customer service.
• Manage exchanges, warranties, returns, or claims.
• Send information related to orders, shipping guides, and purchase status.
• Send commercial communications, promotions, launches, or news, with prior authorization when applicable.
• Improve the browsing and shopping experience on our website.
• Perform statistical, administrative, commercial, and marketing analyses.
• Comply with legal, accounting, tax, contractual, and commercial obligations.
• Address requirements from competent authorities.
• Protect the security of our operations, customers, platforms, and digital channels.

The owner of the personal data shall have the right to:

• Know, update, and rectify their personal data.
• Request proof of the authorization granted for the processing of their data.
• Be informed, upon request, about the use made of their personal data.
• File complaints before the Superintendence of Industry and Commerce for infringements of applicable regulations.
• Revoke authorization or request the suppression of their data when legal principles, rights, and guarantees are not respected.
• Access their personal data undergoing processing free of charge.

Data subjects' rights may be exercised by:

• The data subject, by proving their identity.
• Their successors, when applicable.
• The data subject's legal representative or attorney-in-fact, after proper accreditation.
• Persons authorized by the data subject or by law.

The owner must keep their information updated and ensure that the data provided is truthful, complete, and accurate. Torii & Ko will not be responsible for problems arising from erroneous, incomplete, false, or outdated information provided by the owner.

Torii & Ko, as the data controller, shall have the following duties:

• Guarantee the data subject the full exercise of the right of habeas data.
• Request and keep the authorization granted by the data subject, when applicable.
• Inform the data subject about the purposes of the processing.
• Keep the information under reasonable security conditions.
• Allow access to the information only to authorized persons.
• Process inquiries, complaints, and requests from data subjects.
• Update, correct, or delete information when appropriate.
• Inform the competent authority when security incidents occur that represent risks to data subjects.
• Comply with the instructions and requirements of the Superintendence of Industry and Commerce.
• Only use data whose processing is authorized or permitted by law.

Personal data may be collected through our website, forms, online purchases, email communications, social media, customer service channels, commercial events, or any other means provided by Torii & Ko.

By providing their personal data, the data subject previously, expressly, and informedly authorizes the processing of such data in accordance with this Policy.

Authorization will not be necessary in the following cases:

• Information required by a public or administrative entity in the exercise of its legal functions.
• Publicly available data.
• Cases of medical or health emergencies.
• Processing authorized by law for historical, statistical, or scientific purposes.
• Data related to the Civil Registry of individuals.

The processing of personal data will be valid as long as the purpose for which it was collected is maintained or as long as there is a legal, contractual, accounting, tax, or commercial obligation that justifies its retention.

Torii & Ko may:

• Appoint personal data processors.
• Transfer personal data to logistics, technology, commercial, accounting, or administrative partners.
• Share information with payment gateways, carriers, e-commerce platforms, or providers necessary to execute the purchase.
• Disclose information when required by competent authorities through administrative or judicial order.
• Use the data for pre-contractual, contractual, post-contractual, commercial, administrative, and customer service purposes.

Sensitive data are considered to be those that affect the privacy of the data subject or whose improper use may lead to discrimination. Torii & Ko will not request sensitive data unless strictly necessary and there is express authorization from the data subject or legal authorization.

When sensitive data is collected, the data subject will be informed:

• That they are not obligated to authorize its processing.
• Which data is sensitive.
• The specific purpose of its processing.
• That no activity will be conditioned on providing sensitive data, unless it is indispensable by legal or contractual provision.

Our website may use cookies and similar technologies to enhance the browsing experience, personalize content, remember preferences, analyze user behavior, and optimize our services.

Users can manage, block, or delete cookies from their browser settings. However, some website functions may be affected if cookies are disabled.

Torii & Ko will handle requests, inquiries, complaints, and claims related to the processing of personal data via email: hola@toriiandko.com

Requests must include at a minimum:

• Full name of the data subject.
• Identification document or document proving the capacity in which they are acting.
• Clear description of the request.
• Physical or email address to receive a response.
• Supporting documents, if applicable.