Personal Data Processing Policy

1. Who we are

GRUPO ACOSTA EVENTOS Y PRODUCCIÓN S.A.S., tax ID (NIT) 901315458-0, registered at Transversal 34E Sur #32C-31, Las Margaritas, Envigado, Antioquia, Colombia, operates the website costaandbloom.com under the Costa & Bloom brand and is the data controller responsible for your personal data.

You can reach us at privacidad@costaandbloom.com.

2. What we collect

Information you give us in the quote form:

• Your name
• Your partner's name (optional)
• Your email address
• Your phone number, with its country code
• Your planned wedding date
• Your country of residence
• Whether you want our guide to destination weddings in Colombia

Details about the wedding you are planning, generated by your own choices in the calculator: region, venue, guest count, package tiers and add-on services. Together with the above, these make up the quote you receive.

Technical browsing data: pages visited, referring site, approximate country and device type. We use this to understand how the site performs and improve it.

We do not collect card or bank account details: the site does not process payments. We also do not collect sensitive data (ethnic origin, health, religious beliefs, sexual orientation, biometric data), and we will not ask you for it.

3. What we use it for

• Calculating and delivering your estimated quote.
• Sending you that quote and the PDF with the breakdown.
• Contacting you to talk about your wedding, answer questions and put together a formal proposal.
• Checking date availability with the venues you choose.
• Sending you the destination wedding guide, only if you expressly asked for it.
• Understanding in aggregate how the site is used, so we can improve it.

We do not send bulk promotional email. That is a deliberate decision, not an oversight.

4. Your authorization

Before you submit the form we ask for your express authorization to process your data for the purposes in section 3. Without it we cannot generate your quote, because we need your contact details to deliver it.

The checkbox for receiving the guide is a separate, optional authorization. You can get your quote without ticking it.

We keep a record of your authorization: date, time and the version of this policy in force at that moment.

You can withdraw your authorization at any time by writing to privacidad@costaandbloom.com, except where a legal or contractual duty requires us to keep the data.

5. Who we share it with

To run the service we use providers who access your data solely as data processors, following our instructions and without using it for their own purposes:

Two changes are planned and not yet active: storing your request in our own database (Supabase), and using measurement and advertising tools from Meta and Google. We will update this policy, its version and its date before either goes live.

We do not sell your data. We do not pass it to third parties for advertising purposes.

About the venues, explicitly: we do not give them your email or your phone number. To check availability we ask them only about the date. The couple’s names are shared later, if the process moves forward, and only as needed to make the booking.

6. International transfer

Our providers run servers outside Colombia, mainly in the United States. By authorizing the processing you also authorize that international transfer, which is essential to providing the service. We require contractual security and confidentiality commitments from every provider.

7. How long we keep it

• If we move forward to a contract: we keep your data for the duration of the relationship and afterwards for as long as legal, accounting and tax obligations require.
• If we do not reach a contract: we keep your data for up to one year from your last contact with us, and then delete it.
• If you withdraw your authorization or ask for deletion: we delete it within the timeframes in section 9, unless a legal duty requires us to keep it.

8. Your rights

As the owner of your data you have the right to:

• Know what data we hold about you and how we use it, free of charge.
• Update and correct anything outdated, incomplete or inaccurate.
• Request deletion of your data where no legal or contractual duty requires us to keep it.
• Withdraw the authorization you gave us.
• Request proof of the authorization you granted.
• File a complaint with Colombia’s Superintendency of Industry and Commerce (SIC).

You do not have to explain why you are exercising any of these rights.

9. How to exercise them

Write to privacidad@costaandbloom.com from the email address you used with us, telling us your name, what you are asking for, and how you would like us to reply.

• Enquiries (finding out what data we hold): we respond within ten business days. If we cannot, we tell you why and respond within five additional business days.
• Claims (correction, deletion, withdrawal): we respond within fifteen business days. If we cannot, we tell you the reasons and the date, not exceeding eight further business days.
• If your request is incomplete: we will ask you for the missing details within the following five days.

Before going to the Superintendency of Industry and Commerce, the law requires that you first bring your request to us.

10. Cookies and browser storage

Your quote while you browse. So you do not lose it when you switch the site language or open a venue’s details, we temporarily keep your answers in your browser’s session storage. That information stays on your device, we do not send it to any server until you submit the form, and it clears itself when you close the tab.

Site usage measurement. We use Vercel analytics, which measures pages visited and device type in aggregate, without building a profile of you across sites.

We do not currently use advertising cookies or third-party tracking pixels. When we activate advertising tools from Meta or Google, we will update this policy before doing so and explain here how to accept or refuse them.

You can delete cookies and block new ones from your browser settings. If you do, the site keeps working the same.

11. Security

We apply reasonable technical and administrative measures to protect your data: encrypted transmission, access restricted to those who need it for their work, and providers with recognized security standards. No measure is infallible; if an incident affecting your data occurred, we would act in accordance with the law and inform you where required.

12. Minors

The site is intended for adults. We do not knowingly collect data from minors. If you believe a minor has given us data, write to privacidad@costaandbloom.com and we will delete it.

13. Changes to this policy

We may update this policy. The version and the date of the last update appear at the top. If a change materially affects how we use your data, we will tell you at the email address you gave us before it takes effect.

14. Effective date

This policy is in force from September 2, 2026. Personal data you share with us is kept according to the timeframes in section 7.