Personal data processing policy

Version borrador-2026-11 · Effective date: [EFFECTIVE DATE]

This text is a draft prepared for review by the controller's lawyer. It is not legal advice and must not be treated as final. Items in square brackets are still to be completed. Nota para el abogado: Para el despliegue en EE. UU. el abogado debe revisar leyes estatales de privacidad (p. ej. CCPA/CPRA en California) y avisos específicos.

1. Data controller

This policy is issued under Colombian Law 1581 of 2012, Decree 1377 of 2013 and Decree 1074 of 2015. The controller of your personal data is dropcel:

• Legal name: [RAZÓN SOCIAL]
• Tax ID (NIT): [NIT]
• Address: [DIRECCIÓN], [CIUDAD]
• Privacy email: [CORREO DE PRIVACIDAD]
• Phone: [TELÉFONO]

2. Definitions

• Data subject (titular): the natural person whose personal data is processed.
• Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
• Sensitive data: data that affects the subject's privacy or whose misuse may lead to discrimination (for example biometric or health data). We do not ask for sensitive data; please do not include it in photos.
• Habeas data: the right of every person to know, update and correct the information collected about them in databases (article 15 of the Colombian Constitution).

3. Data we collect

When you get a quote or sell us a device, we collect: name, phone or WhatsApp number, city, the device's IMEI or serial number, description and condition of the device, device report (what works and what does not), damage marks, asking price and chosen language. In addition, when you submit a request we record your IP address and the country deduced from it (section 10) and, only if you allow it, your browser location (section 11). Payment details are requested later, only if the order is validated (section 12).

Device photos are optional. Please avoid showing people, documents or screens with personal data (messages, accounts, emails).

We also keep an anonymous history of quotes and usefulness votes, with no data that identifies you, used for statistical purposes only.

Cookies and storage: we use a technical cookie only in the owner's panel (session). In your browser we store only two values using localStorage, idioma and operacion (your language and operating-country preferences), with no personal data. We do not use advertising or tracking cookies.

4. Purposes of processing

• Quote and, if we agree, buy the device.
• Contact you by WhatsApp or phone about your request.
• Check that the IMEI is not reported as stolen or lost, as a measure to prevent receiving stolen goods.
• Carry out the physical inspection of the device.
• Security, fraud prevention and prevention of buying stolen goods, and responding to requests from competent authorities (IP address and country).
• Coordinate pick-up or the appointment and estimate logistics (optional location).
• Pay you the agreed amount (payment details, seller only).
• Comply with legal and tax obligations.
• Produce internal statistics, using anonymous data, to adjust our offers.

5. Authorization

Before sending a request, the quote form asks you to tick a box confirming that you have read this policy and authorize the processing of your data for the purposes described. We store the date and the version of the policy you accepted. If the version changes, we will ask you to accept again.

6. Data subject rights and procedure

You have the right to: know, update and correct your data; request proof of the authorization given; be informed of how your data has been used; revoke the authorization and request deletion of your data when there is no legal or contractual duty to keep it; and file complaints with the Superintendence of Industry and Commerce (SIC).

To exercise them, write to [CORREO DE PRIVACIDAD] or call [TELÉFONO], stating your name, a contact method and what you request.

• Queries: answered within 10 business days of receipt (article 14 of Law 1581). If that is not possible, we will tell you why and give a new date, which will not exceed 5 additional business days.
• Claims (correction, update, deletion or revocation): answered within 15 business days (article 15). If that is not possible, we will tell you why and give a new date, which will not exceed 8 additional business days.

7. Retention

We keep your data for as long as our relationship lasts and for the periods required by law (including tax and accounting periods). Photos and data from requests that do not end in a purchase are deleted after [PLAZO A DEFINIR]. The anonymous quote history is kept indefinitely because it does not identify you.

The IP address is kept for [PLAZO A DEFINIR]. The optional location and the payment details are deleted together with the request, unless a rule requires keeping them.

8. Third parties and transfers

• Hosting provider (Hostinger): hosts the site and its data. Its servers may be outside Colombia, which implies an international transfer or transmission of data.
• WhatsApp (Meta): when you open the chat from the site, your data and messages are also governed by the WhatsApp and Meta policies. You send the message yourself from your own account, and it carries the order number, the device and the offer. We will never ask for bank details over WhatsApp.
• IMEI check: to verify the IMEI we use a third-party page, to which only that number is sent.

We do not sell or rent your personal data.

9. Security, minors and changes

Security. Data travels encrypted (HTTPS), only the authenticated owner can view it, and photos are stored outside the site's public folder.

Minors. We do not buy devices from people under 18 without the presence and authorization of their legal representative.

Changes. We may modify this policy. We will publish the new version on this page with its effective date and, if necessary, ask for a new authorization.

10. IP address and country

When you submit a request we record your IP address, for security, fraud prevention and prevention of buying stolen goods (receiving stolen property), and to respond to requests from authorities. Only the administrator can see it. The country is calculated with a local database: your IP is not sent to third parties for that purpose. The anonymous quote history does not store the IP. Retention: [PLAZO A DEFINIR].

11. Browser location (optional)

We may ask for your browser location, with your explicit permission and the option to share an approximate location. It is used to coordinate pick-up or the appointment and to estimate logistics. It is not required: you can get your offer without sharing it, and nothing happens if you do not. It is deleted together with the request.

12. Payment details

The details of the account where you will be paid are requested only after the order is validated, through a secure single-use link. They are stored encrypted and only the administrator can see them. They are never requested over WhatsApp. They are used only to pay the seller, who must be the account holder.

13. Operations in the United States

If you sell from the United States, you may have consumer privacy rights under the applicable state law (for example, to know, access, correct or delete your data). Details and how to exercise them: [ABOGADO EE. UU.]. These rights and the notices required for a second-hand buyer are pending review by a U.S. attorney.

14. Attribution

IP geolocation by DB-IP (dbip.com), licensed under CC BY 4.0.

Effective date. This policy applies from [EFFECTIVE DATE].