Personal Data Processing Policy

Crooki Bake Bar · Version 1.0 · Effective: October 7, 2026.

This policy explains how Crooki collects, uses, stores and protects the personal data of its customers, including those who order on www.crookibakebar.com and Club Crooki members, and how they can exercise their rights. It is issued under Law 1581 of 2012, Decree 1074 of 2015 (Chapter 25) and Law 2300 of 2023.

1. Data controller

• Business name: Crooki Bake Bar
• NIT (tax ID): 1007802103-9
• Address: Centro Historico Calle 36 # 5-70, Cartagena de Indias, Colombia
• Personal data email: holacrooki@gmail.com
• Phone / WhatsApp: +573027190084

2. Data we collect

• Identification and contact: name, mobile number and, optionally, email address.
• Birthday (day and month), optional, for the birthday benefit.
• Club history: purchase dates and amounts, Bonus earned, rewards redeemed and messages received.
• Website orders: name, email, phone / WhatsApp, delivery address, phone number of the person receiving the order, order notes and the products and amounts ordered.

Crooki does not request sensitive data (health, religion, orientation, biometric data, among others) or financial data through the Club or the website. Payments are not processed on the site.

3. Purposes

Data is used only to:

1. Receive, prepare and deliver orders placed on the website, and contact the customer and the person receiving the order by WhatsApp or phone to confirm it and arrange delivery.
2. Enroll the customer in the Club, record their Bonus and deliver their rewards.
3. Send them information by WhatsApp, SMS or email about their card, benefits, promotions, launches and their birthday benefit.
4. Analyze purchasing habits to group customers and offer benefits suited to each group.
5. Measure program results and improve products and service.
6. Handle inquiries, requests, complaints and claims.
7. Comply with legal obligations and requests from authorities.

Crooki does not sell, rent or transfer data to third parties for those third parties' own commercial purposes.

4. Authorization

The customer authorizes processing in a prior, express and informed manner when enrolling, by ticking the acceptance box on the registration form. Crooki keeps proof of each authorization.

When placing an order on the website, the customer authorizes processing by ticking the box accepting this policy before submitting the order. If the customer provides another person's phone number to receive the order, they confirm they have that person's permission to share it with Crooki for that purpose.

Joining the Club is voluntary and is not a condition for buying at Crooki. Accepting marketing messages is a separate authorization that the customer may revoke at any time.

5. Data subject rights

• Access, update and correct their data.
• Request proof of the authorization given.
• Be informed about how their data has been used.
• Revoke the authorization and request deletion of their data, when there is no legal duty to keep it.
• Access their data free of charge.
• File complaints with the Superintendence of Industry and Commerce (SIC), after first contacting Crooki.

6. Inquiries and claims

Requests are sent to holacrooki@gmail.com stating name, registered mobile number, the request and a way to reply.

• Inquiries: answered within 10 business days, extendable by 5 more business days with notice of the reason.
• Claims: answered within 15 business days, extendable by 8 more business days with notice of the reason.

To stop receiving messages, simply reply BAJA to the Club's WhatsApp; the request is applied immediately.

7. Marketing messages

• Sent only to customers who authorized them, through the channels they authorized.
• Hours: Monday to Friday 8:00 a.m. to 5:00 p.m. and Saturdays 8:00 a.m. to 3:00 p.m. No messages on Sundays or public holidays.
• At most one message per day per customer, through a single channel per week, and at most four per month.

8. Processors and data transmission

To run the Club, Crooki uses the Novu App platform and the WhatsApp Business service, which process data on Crooki's behalf as processors. Their servers may be located outside Colombia; in that case data is transmitted under a contract or clauses requiring the processor to protect it to the standards of Colombian law and to use it only for the purposes of this policy. Novu App's privacy policy is available at https://www.novuapp.ai/privacidad.

Website orders are stored in Supabase, the site's database service, and the site is hosted on Vercel. Both act as processors, may have servers outside Colombia and are subject to the same conditions described in the previous paragraph.

Internal access to the database is limited to the consultant and the partners. Checkout staff only record Bonus and redemptions.

9. Security and retention

Crooki applies reasonable technical and administrative measures to prevent loss, unauthorized use or improper access to data, such as personal password-protected users and restricted access to the platform.

Website order data is kept for as long as needed to handle the order and to meet Crooki's legal, accounting and tax obligations.

Club data is kept while the customer remains a Club member. If no purchases are recorded in 24 months or the customer asks to leave, their data is deleted, except what the law requires to be kept.

10. Minors

Minors under 18 may only enroll with authorization from their father, mother or legal guardian. Crooki does not send marketing messages to minors.

11. Changes to this policy

Any significant change will be communicated to Club members through the authorized channels before it takes effect. The current version will be available at www.crookibakebar.com/legal and in store.