YOUR DATA IS NOT A PRODUCT.

The Controller (Responsable del Tratamiento under Colombian law) will be the natural person or legal entity that commercially operates FASE NUEVE. Before personal-data operations are enabled, its identity must be complete, accurate and available.

FASE NUEVE must apply data minimization: only data relevant to an informed purpose should be processed. The categories below describe what may be necessary; they do not mean every item is collected in every interaction.

DIRECTLY FROM THE DATA SUBJECT

When a person buys, requests a quote, creates an account once available, contacts FASE NUEVE, or requests support, warranty service, withdrawal, an exchange or a return.

AUTOMATICALLY, ONLY WHERE APPLICABLE

Through technologies necessary for site operation and, once enabled and disclosed, cookies, logs or measurement tools. This Policy does not claim that tools which have not been installed are in use.

FROM OPERATIONAL PROVIDERS

For example, a payment provider or logistics operator, only when a real integration exists and the information is needed to execute or update the transaction.

Each data item must be linked to a legitimate, specific and disclosed purpose. Operational purposes and marketing remain separate.

Where authorization is required, it must be prior, express where applicable, informed and capable of later verification. Accepting Terms or reading this Policy does not by itself replace any specific authorization that may be required.

Relevant forms must display a short privacy notice before collecting data, for example: “By continuing, your data will be processed to handle this request in accordance with our Privacy Policy.”

To manage a guest or F9 Account purchase, FASE NUEVE may process contact data, products, quantities, address, order status and confirmations necessary to perform the transaction.

In Checkout, processing required for the order, delivery, payment and confirmation must remain distinct from optional marketing consent. Advertising cannot be a purchase requirement.

Forms must request only necessary information and explain why a phone number, identity document or other data is required where applicable.

Available methods will be displayed only after a real payment integration exists. Sensitive payment information must be processed by the authorized provider through its own integration and terms.

• FASE NUEVE may receive a transaction identifier, reference, status, summarized method and amount.
• FASE NUEVE must not directly store a full card number, CVV or equivalent credentials in JavaScript, localStorage or its own forms.

Once F9 Account is active, data may be used to manage a profile, orders, tracking, favorites, addresses and preferences. No more information than necessary for those functions should be stored.

A real route for account closure or deletion must be provided later. Closing an account does not necessarily erase information that must be retained for legal or contractual duties or the defense of rights.

Anonymous local appearance, accent or typography preferences will not be mixed with an identified account until real synchronization exists.

For delivery, only the data required by the logistics provider may be shared, such as recipient, address, phone where operationally necessary and package information.

Carrier names will be added only after they are selected and genuinely operating. Coverage and delivery information is also explained in the Shipping Policy.

Handling a request may require the order number, product, serial or IMEI where relevant, issue description, photos or videos supplied by the Data Subject and contact data.

Evidence or information unrelated to the purpose will not be requested. Operational conditions are available in Warranty and Exchanges, returns and withdrawal.

Messages sent by WhatsApp, email or future forms may contain personal data. They will be used to handle the request and retain traceability where necessary.

Users should not send full card numbers, CVV, passwords or other sensitive information through support channels.

Business requests may include organization and contact-person data to prepare a proposal, verify references, quantities and availability, and respond through the selected commercial channel.

Marketing consent must be optional, separate and unchecked by default. A purchase, warranty, support request or exercise of rights cannot be conditioned on receiving advertising.

Once a newsletter or commercial automation exists, FASE NUEVE must retain evidence of consent and provide a real opt-out mechanism. This Policy does not display a button that does not work.

FASE NUEVE may use technologies required for operation and, once enabled through the appropriate settings, measurement or advertising tools.

This section does not replace the future Cookies Policy. It does not claim that any measurement or advertising tool exists unless it has actually been installed and configured.

This Policy will identify only providers that actually participate in the Processing and will explain what is necessary to understand their role.

Classification as Controller, Processor or another legal role depends on the actual legal relationship; not every provider is automatically a Processor.

This Policy does not claim that data never leaves Colombia, because the location of hosting, email, CDN, analytics or future providers must first be verified.

Any national or international transfer or transmission must comply with the applicable Colombian regime and the relevant agreements, authorizations or safeguards. This section will be updated once providers are defined.

FASE NUEVE must apply technical, administrative and organizational controls appropriate to the nature of the data and risks, including restricted access, confidentiality, credential management, backups and monitoring where applicable.

SECURITY INCIDENTS

Incidents will be handled in accordance with applicable duties, including assessment, containment, documentation and communications when required by law or by the incident assessment.

FRONTEND AND LOCAL DATA

localStorage or sessionStorage will not be the final database for accounts, orders, addresses, payments or warranties. Browser data is not authoritative for commercial or security decisions.

Data will be retained for the period necessary for the purpose that justified its Processing and for additional periods required by legal or contractual duties or the defense of rights.

No unsupported uniform period is published. FASE NUEVE must maintain a data inventory and an internal retention schedule by category, source, purpose, access, related provider and applicable duty.

As applicable, the Data Subject may exercise the rights recognized by Colombian law, and this Policy does not narrow them.

Buying technology does not generally require health data, biometrics, political views, religion or other sensitive information. Facial recognition, fingerprints or biometrics will not be introduced in F9 Account without a specific legal and technical project.

FASE NUEVE must not deliberately design processes to collect children's or adolescents' data without applying the relevant special rules. Such Processing should be avoided except where legally permitted and properly managed.

FASE NUEVE may update this Policy because of legal, operational or technological changes. Material changes must be published and, where required, communicated or supported by a new authorization.

Continued use of the site is not presented as automatic acceptance of every change. The current document version is 2026.08.1, dated August 17, 2026. Purely cosmetic changes should not alter the legal version.

Use the configured channel for inquiries, claims, updating, rectification, deletion or revocation where available. The visible channel is the enabled means for submitting the request.

You may also contact Colombia's data protection authority. Where Colombian law requires it, the applicable process before the Controller or Processor must first be completed.