Privacy Policy

Last updated: July 28, 2026

Avcom Colombia SAS ("Avcom Colombia," "we," "us," or "our") respects your privacy and is committed to protecting personal data. This Privacy and Personal Data Processing Policy explains how we collect, use, store, disclose, transfer, transmit, protect, and otherwise process personal data when you visit https://co.hollyland.com/, purchase products, create an account, contact us, or otherwise interact with our online store and related services (collectively, the "Services").

This Policy is governed by Colombia's Political Constitution, Statutory Law 1581 of 2012, Decree 1377 of 2013 as incorporated into Decree 1074 of 2015, and other applicable Colombian personal data protection rules. The Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio, "SIC") is the Colombian data protection authority.

1. Data Controller and Contact Information

The controller responsible for the processing described in this Policy is:

• Legal name: Avcom Colombia SAS
• Address: Carrera 22 # 84-36, Colombia
• Website: https://co.hollyland.com/
• Privacy email: store.co@hollyland.com

The privacy contact identified above is responsible for receiving and processing requests, consultations, and complaints from data subjects.

2. Personal Data We Process and Its Sources

Depending on your interaction with the Services, we may process:

• Identification and contact data: name, identification details when legally or operationally required, email address, telephone number, billing address, and shipping address.
• Account data: account credentials, preferences, saved settings, and account activity.
• Order and transaction data: products viewed or purchased, cart activity, orders, returns, exchanges, warranties, invoices, payment status, and delivery information. Payment card data is generally processed directly by authorized payment providers.
• Customer service data: messages, support requests, warranty information, reviews, survey responses, and other communications.
• Technical and usage data: IP address, browser, device and network information, identifiers, cookie data, pages viewed, referral source, and interactions with the Services.
• Marketing data: communication preferences and information about engagement with campaigns, where permitted.
• Fraud-prevention and compliance data: information reasonably necessary to authenticate transactions, prevent misuse, and comply with law.

We collect personal data directly from you, automatically through the Services and cookies or similar technologies, and from service providers, payment processors, logistics providers, business partners, social media platforms, analytics providers, or other lawful sources.

3. Purposes of Processing

We process personal data for the specific and legitimate purposes described below:

• To create and administer customer accounts.
• To process payments, orders, invoicing, shipping, delivery, returns, exchanges, warranties, and after-sales support.
• To respond to questions, requests, consultations, complaints, and claims.
• To communicate operational information about accounts, purchases, deliveries, product safety, and Services.
• To provide technical support and improve products, Services, website performance, and customer experience.
• To personalize content and product recommendations, where permitted.
• To send advertising, promotional, or marketing communications when we have the authorization required by Colombian law, and to maintain records of consent and opt-out requests.
• To conduct analytics, statistics, service measurement, and market research.
• To protect the Services, authenticate users, prevent fraud, investigate suspicious or unlawful activity, and enforce our terms and policies.
• To comply with accounting, tax, consumer protection, judicial, administrative, regulatory, and other legal obligations.
• To establish, exercise, or defend legal claims and to manage corporate transactions, subject to applicable law.

We will not process personal data for purposes that are incompatible with those communicated to you without providing additional notice and obtaining authorization where required.

4. Authorization and Legal Exceptions

Where required, we obtain the data subject's prior, express, and informed authorization before processing personal data, and we retain evidence of that authorization. Authorization may be obtained through written, oral, electronic, or other conduct that reasonably demonstrates consent, provided it meets Colombian legal requirements.

Authorization is not required in the cases established by law, including information requested by a public or administrative authority in the exercise of its legal functions or by court order, data of a public nature, medical or health emergencies, processing authorized by law for historical, statistical, or scientific purposes, and data related to the Civil Registry. Even where authorization is not required, we process the data in accordance with applicable legal principles and duties.

5. Sensitive Data and Data of Children and Adolescents

We do not ordinarily request sensitive personal data. You are not required to provide sensitive data unless it is necessary for a lawful purpose. If we need to process sensitive data, we will explain its sensitive nature, the purpose of processing, the optional nature of providing it where applicable, and obtain explicit authorization unless a legal exception applies.

The Services are intended for adults. We do not knowingly collect personal data from children or adolescents except where processing is lawful, respects their best interests and fundamental rights, and is authorized by their legal representative after the minor's right to be heard is considered according to their maturity. A parent or legal guardian may contact us to request review or deletion of a minor's data.

6. Data Subject Rights

Under Colombian law, data subjects may:

• Know, access, update, and rectify their personal data.
• Request proof of authorization, except where authorization is not legally required.
• Be informed, upon request, about the use made of their personal data.
• Submit consultations and complaints regarding the processing of their personal data.
• Request deletion of personal data and revoke authorization when legally appropriate, subject to legal or contractual duties that require retention or continued processing.
• Access their personal data free of charge as provided by law.
• Submit complaints to the SIC after completing the applicable consultation or complaint process with us.

Marketing consent may be withdrawn at any time by using an unsubscribe mechanism included in the communication or by contacting us. Withdrawal from marketing does not prevent us from sending transactional or legally required communications.

7. Procedure for Consultations and Complaints

To exercise your rights, email store.co@hollyland.com. The request should include the data subject's full name, contact details, a clear description of the request, evidence of identity, and supporting documents where applicable. Authorized representatives and successors must provide evidence of their authority or status.

Consultations: We will respond within ten (10) business days from receipt. If we cannot respond within that period, we will explain the delay and state the response date, which will not exceed five (5) additional business days.

Complaints: If a complaint is incomplete, we may request correction within five (5) business days after receipt. If the requested information is not provided within two (2) months, the complaint may be treated as abandoned. A complete complaint will be resolved within fifteen (15) business days after the day following receipt. If additional time is required, we will explain the delay and provide a response date, which will not exceed eight (8) additional business days.

Where a complaint concerns inaccurate or unauthorized processing, we will mark the relevant record as subject to a claim when legally required. If we are not competent to resolve the request, we will transfer it to the appropriate party where possible and inform the requester.

8. Sharing, Transmission, and International Transfer

We may disclose or transmit personal data only as necessary for the purposes in this Policy, including to Shopify; payment processors; banks; logistics, courier, warehousing, warranty, and customer-support providers; hosting, cybersecurity, cloud, analytics, advertising, and marketing providers; professional advisers; affiliates; and public authorities where legally required.

These parties may act as processors or independent controllers, depending on the circumstances. We require processors to handle personal data under our instructions, maintain confidentiality and security, and use the data only for authorized purposes.

Because Shopify and other providers may operate outside Colombia, personal data may be transferred or transmitted internationally. We carry out international transfers and transmissions in accordance with Law 1581 of 2012 and Decree 1074 of 2015, including applicable authorization, adequacy, contractual, transmission, and statutory exception requirements. We adopt reasonable contractual and organizational safeguards appropriate to the processing.

9. Shopify and Third-Party Services

Our store is hosted by Shopify, which processes personal data to provide and improve the commerce platform and related services. Information submitted through the Services may be shared with Shopify and relevant service providers. For more information about Shopify's processing, visit the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

The Services may contain links or integrations operated by third parties. Their processing is governed by their own privacy notices, and we encourage you to review them.

10. Cookies and Similar Technologies

We and our service providers use cookies, pixels, tags, local storage, and similar technologies to operate the store, remember preferences, maintain security, understand traffic and performance, and, where authorized, support analytics and advertising. You can manage cookies through available consent controls and browser settings. Blocking certain cookies may affect essential website functions. Marketing or non-essential technologies are used in accordance with applicable consent requirements.

11. Security and Retention

We implement reasonable technical, administrative, and organizational measures designed to protect personal data against loss, adulteration, unauthorized or fraudulent access, consultation, use, disclosure, or destruction. No electronic system can guarantee absolute security.

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy and to meet legal, contractual, accounting, tax, consumer protection, dispute-resolution, and security obligations. When retention is no longer necessary, we delete, anonymize, or securely restrict the data as appropriate.

12. Changes and Effective Period

This Policy is effective from July 28, 2026 and remains in force while Avcom Colombia SAS processes personal data. We may update it to reflect legal, operational, or technological changes. Material changes to processing purposes will be communicated and, where required, submitted for renewed authorization. The current version will be published on this page with its last-updated date.

13. Contact and Supervisory Authority

Questions, consultations, complaints, revocation requests, and deletion requests may be directed to:

• Avcom Colombia SAS
• Email: store.co@hollyland.com
• Address: Carrera 22 # 84-36, Colombia

After completing the applicable request or complaint procedure with us, you may submit a complaint to Colombia's Superintendence of Industry and Commerce (SIC) through its official channels.