Bendita - Privacy policy

Last updated:2026-09-11

1. Data controller

This policy describes how we handle the personal data of those who visit our website, create an account or place an order. The data controller is:

Legal name: Bendita Grow Shop
Trade name: Bendita Grow
Tax ID: 0123456789
Address: Calle 36 con, Cra. 6a Villa Ilusión, Local 103, Ibagué, Colombia
Email: contact@benditagrow.com
Phone: +57 313 5751807
Website: https://www.benditagrow.com

2. Scope and acceptance

This policy applies to our website, our online store and all associated services, including signing in with Google. It does not apply to third-party sites or services you may reach through links published on our site, which are governed by their own policies.

By using the site, creating an account or placing an order, you confirm that you have read and understood this policy. If you do not agree with it, please do not use our services.

3. Data we collect

3.1 Data you give us

First and last name, email address, phone number, password (always stored encrypted), shipping and billing addresses, and the history of the orders you place. Also the messages you send us through the contact form or our support channels.

3.2 Data we receive when you sign in with Google

If you choose to sign in with Google, we receive from Google only the basic profile data you authorise on the consent screen: your name, your email address, whether that email is verified, your profile picture and the unique identifier of your Google account. We never receive your Google password and we never gain access to your mail, your contacts, your calendar or any other Google service.

3.3 Data collected automatically

IP address, browser type and version, operating system, language, pages visited, time spent and referral source. This data is obtained through cookies and similar technologies for security, operational and analytics purposes.

3.4 Payment data

Payments are processed through our payment gateway. Your card details are sent directly to the processor and are not stored on our servers. We only keep the outcome of the transaction, its identifier and the amount, so that we can link them to your order.

4. What we use your data for

To create and manage your account, authenticate you, process and deliver your orders, handle payments, returns and warranties, and keep you informed about the status of your purchases.

To answer your enquiries, complaints and requests, and to send you marketing communications where you have given us your consent, which you may withdraw at any time.

To protect the site against fraud and abuse, to comply with legal and accounting obligations, and to analyse site usage in aggregate form in order to improve our products and services.

5. Basis for processing

We process your data with your consent, to perform the sales contract you enter into with us, to comply with legal obligations that apply to us, and on the basis of our legitimate interest in keeping the service secure. You may withdraw your consent at any time; doing so does not affect the lawfulness of processing carried out beforehand, nor the legal obligations we must continue to meet.

6. Use of data received from Google APIs

This application's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Specifically, the data we receive from Google is used only to create your account, identify you when you sign in, and display your name and profile picture within the site.

We do not sell the data received from Google, we do not transfer it to third parties except where strictly necessary to provide you with the service, comply with the law or respond to a request from a competent authority, we do not use it for advertising or targeting purposes, and no person reads it unless you expressly authorise it, it is necessary for security reasons or to investigate abuse, or the law requires it.

You can unlink your Google account at any time from your profile, and revoke the access granted to this application from your Google account permissions page.

7. Providers and third parties

To operate the service we rely on providers that process personal data on our behalf and under our instructions. Each of them applies its own security measures and privacy policies:

Authentication and account infrastructure: Google Firebase Authentication.
Usage analytics and aggregate metrics: Google Analytics.
Maps and address autocomplete: Google Maps and Google Places.
Protection against abuse and automated traffic: Google reCAPTCHA and Firebase App Check.
Payment processing: our payment gateway.
Delivery of transactional email, such as account verification and order notifications.
Storage and delivery of the site images and files.
Shipping and courier companies, to which we pass on strictly the data needed to get your order to you.

We do not sell, rent or trade your personal data.

8. International transfers

Some of our providers run servers outside your country of residence, so your data may be stored or processed abroad. When this happens, we require those providers to apply a level of protection equivalent to the one described in this policy through the appropriate contractual mechanisms.

9. Data retention

We keep your data for as long as your account remains active and, after it is deleted, only for the time needed to meet legal, accounting and tax obligations, or to handle claims. Once that period has elapsed, the data is deleted or irreversibly anonymised.

10. Security

We apply reasonable technical and organisational measures to protect your data: traffic encryption over HTTPS, password storage using cryptographic hashing algorithms, access control limited to authorised staff, and two-step verification available for your account.

No system is completely invulnerable. We recommend that you use a unique password, enable two-step verification and tell us immediately if you notice any suspicious activity on your account.

11. Your rights

As the owner of the data you may, at any time:

Find out what data of yours we process and obtain a copy of it.
Update or correct data that is inaccurate or incomplete.
Request the deletion of your data and the removal of your account.
Receive your data in a structured, commonly used format.
Object to certain processing or request that it be restricted.
Withdraw the consent you have given us.
File a complaint with the data protection authority of your country.

You can carry out most of these actions yourself: from your profile you can view and update your data, manage your addresses, unlink your Google account and permanently delete your account.

For any other request, write to us at contact@benditagrow.com from the email address linked to your account, clearly stating which right you wish to exercise. We will respond within the time limits set by the applicable regulations.

12. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in, remember the contents of your cart and store your language preference. We also use analytics cookies that let us understand, in aggregate form, how the site is used.

The first time you arrive we show a notice so you can choose which cookies you accept, grouped into four categories: necessary, which let you sign in, keep your cart, process payment and validate addresses, and which are always on; preferences, which remember settings such as the light or dark theme; analytics, which let us understand in aggregate how the site is used; and marketing, covering advertising and social media share buttons.

Until you choose, no cookie other than the necessary ones is activated. You can change your decision whenever you like from the Cookie settings link in the footer, and withdrawing your consent is as simple as giving it.

You can also block or delete cookies from your browser settings. Please note that if you disable the necessary cookies, some site features, such as signing in or the shopping cart, will stop working correctly.

13. Minors

Our products and services are intended exclusively for people over 18 years of age. We do not knowingly collect data from minors. If we find that we have received data from a minor, we will delete it and close the associated account.

14. Changes to this policy

We may update this policy to reflect legal or technical changes, or changes to our services. We will always publish the version in force on this page, together with the date it was updated. Where the changes are substantial, we will notify you by email or through a prominent notice on the site.

15. Provisions applicable in Colombia

For data subjects located in Colombia, personal data is processed in accordance with Ley 1581 de 2012 and its implementing rules, compiled in Decreto 1074 de 2015. This page also constitutes our data processing policy.

Under article 8 of Ley 1581 de 2012, as the owner of the data you have the right to:

Know, update and rectify your personal data before the data controller or the data processor.
Request proof of the authorisation granted for the processing, except in the cases where the law waives that requirement.
Be informed, on request, about the use that has been made of your personal data.
File complaints with the Superintendencia de Industria y Comercio for breaches of data protection rules.
Revoke your authorisation and request the deletion of your data, where no legal or contractual duty prevents it.
Access free of charge the personal data that has been processed.

We answer enquiries within a maximum of ten (10) business days from receipt. Where it is not possible to respond within that period, we will tell you why and when it will be answered, which will be no later than five (5) business days after the first period expires. Complaints are answered within a maximum of fifteen (15) business days from the day after receipt, extendable by a further eight (8) business days once we have explained the reason for the delay.

You can submit your enquiries and complaints by writing to contact@benditagrow.com, identifying yourself and clearly stating the facts and your request. If you consider that we have not dealt with your request, you may turn to the Superintendencia de Industria y Comercio, the competent authority in Colombia; the law requires that you first exhaust the procedure with us.

You are not obliged to authorise the processing of sensitive data or to answer questions about it. Nor is it obligatory to provide data relating to children and adolescents; where processing such data is appropriate, it will be carried out with respect for their prevailing rights.

16. Contact

If you have questions about this policy or about how your data is handled, write to us at contact@benditagrow.com or contact us on +57 313 5751807.