Privacy Policy

1 · Data Controller

2 · Data we collect

We only collect the data necessary to provide our commercial services:

• Identification data: first and last name, document type and number.
• Contact data: home and shipping address, email, landline and/or mobile phone.
• Purchase and transactional data: products purchased, order history, preferences, transaction value and billing data. We do not store complete credit or debit card information.
• Browsing data: IP address, browser type, device, operating system, pages visited, time spent and traffic source.
• Meta Pixel and TikTok Pixel data: cookie identifiers, pixel ID, standard events (ViewContent, AddToCart, InitiateCheckout, Purchase), ad interactions and device data to build custom audiences and run remarketing.
• WhatsApp Business data: phone number, profile name, photo, messages, audio, video or documents you voluntarily share when contacting us through the WhatsApp Business API.

3 · How we use your data

Your data will be used for the following authorized purposes:

• Order management, payment processing, billing, shipping, logistics and after-sales service.
• Customer service and commercial support via WhatsApp Business, email, phone and website chat.
• Direct marketing, sending promotions, launches, discounts and personalized advertising via email, SMS, WhatsApp and audiences on Meta (Facebook and Instagram) and TikTok.
• Compliance with legal, accounting, tax and commercial obligations.
• Fraud prevention, identity verification, transaction security and platform protection.
• Web analytics, conversion measurement, optimization of advertising campaigns and internal consumption statistics.

4 · Legal basis

Processing of your data is based on: (a) your prior, express and informed consent; (b) the performance of a contractual relationship arising from the purchase and sale of products; (c) compliance with a legal obligation incumbent on the Controller; and (d) the legitimate interest of the Controller for fraud prevention, IT security and service improvement, always without prevailing over your fundamental rights.

5 · Third-party platforms & international transfers

To operate our business we use international technology providers:

• Meta Platforms Inc. (USA) — Meta Pixel, Conversions API and Facebook/Instagram ads.
• TikTok Pte. Ltd. (Singapore) — TikTok Pixel and advertising.
• WhatsApp LLC (USA, a Meta company) — conversation management via WhatsApp Business API.
• Cloudflare, Inc. (USA) — security, CDN and site hosting.
• Google LLC (USA) — email services (admin@getlucky.company), Google Workspace and analytics.

Consequently, your data may be transferred, transmitted and stored on servers outside Colombia, primarily in the United States, Singapore and Ireland. These international transfers are made guaranteeing an adequate level of protection through Standard Contractual Clauses and the providers' own privacy policies, in accordance with Article 26 of Colombian Law 1581 of 2012 and Chapter V of the GDPR.

6 · Cookies and similar technologies

Our website getlucky.company uses first- and third-party cookies, including Meta Pixel and TikTok Pixel, to remember preferences, analyze traffic and display relevant advertising. On your first visit, you can accept or reject non-essential cookies. You can configure your browser to block them at any time. For more information, see our Cookie Policy.

7 · Data sharing

We do not sell or rent your personal data. We only share your information with third parties strictly necessary for the purposes described:

• Logistics providers and courier companies for order delivery.
• Payment gateways (Wompi, PayU, Mercado Pago, Nequi, Daviplata) to process transactions securely.
• Meta Platforms Inc. and TikTok Pte. Ltd. for audience creation, remarketing and campaign measurement.
• Administrative or judicial authorities when there is a legal requirement.

All our data processors are contractually obligated to maintain the confidentiality and security of the information.

8 · Your rights

As a data subject, you have the right to: know, update and rectify your data; request proof of the authorization granted; be informed about the use given to your data; file complaints with the Colombian Superintendence of Industry and Commerce (SIC) for infringements; revoke authorization and/or request deletion of data; and access your data free of charge.

If you are a resident of the European Union, you additionally have the right to: portability, restriction of processing, and object to processing under the GDPR. If you are a California resident, you have rights under the CCPA, including the right to know, delete and opt-out of the sale of personal information.

9 · Minors

Our products and services are directed exclusively to persons over 18 years of age. We do not knowingly collect information from minors. If we verify that we have received data from a minor without the authorization of their parents or guardians, we will proceed to its immediate deletion from our databases.

10 · Security and retention

We implement reasonable technical, human and administrative measures to protect your data against unauthorized access, loss or alteration, including SSL/TLS encryption, restricted access and Cloudflare-level firewalls. We will retain your personal data for a term of five (5) years from the end of the commercial relationship, in compliance with tax and accounting obligations, or until you request its deletion and there is no legal duty to retain it, whichever occurs first.

11 · Changes to this policy

We reserve the right to modify this Privacy Policy at any time to adapt it to legislative updates or service improvements. Any change will be published on this page with the updated date. We recommend reviewing it periodically.

12 · Contact and supervisory authority

For any questions, requests or complaints related to the processing of your personal data, you can contact us using the details indicated in section 1. You also have the right to file complaints with the competent authority in Colombia: