1. Information We Collect

We collect personal information provided during registration (name, email, company, phone), transaction data, browsing information, and technical cookies necessary for Platform operation.

2. Use of Information

We use your information to: operate and improve the Platform, process transactions, communicate important updates, generate commercial credit signals, prevent fraud, and comply with legal obligations. In addition, unless you have opted out, we use your browsing and purchase history to build interest profiles and send you personalized product recommendations by email and in-app notification; you may unsubscribe at any time.

3. Information Sharing

We may share information with: trade counterparts (in the context of transactions), service providers operating on our behalf, authorities when required by law, and in the event of a merger or business acquisition.

4. Data Security

We implement technical and organizational measures to protect your data, including encryption in transit and at rest, access controls, and regular security audits.

5. Data Retention

We retain your data as long as your account is active or as needed to provide services. Transaction data is retained for the period required by law (minimum 5 years for commercial records). Interaction and browsing data used to personalize recommendations is retained for a maximum of 24 months, after which it is pseudonymized and deleted no later than 48 months.

6. Your Rights

You have the right to: access your personal data, request corrections, request account deletion, export your data, and withdraw your consent for marketing communications.

7. International Transfers

Your data may be processed on servers located outside of Panama. We ensure that such transfers comply with applicable data protection standards.

8. Contact

For privacy inquiries, contact us at [email protected] or through our contact form.

9. Financing and Credit Data

If you request or use financing features (seller-to-buyer payment terms), we process financial and credit data —financial statements, tax returns, commercial references, and the derived financing score— for the specific and separate purpose of assessing and maintaining your financing profile. This processing is based on your prior, express, and informed authorization (credit-data authorization), in accordance with Law 1266 of 2008 and Law 1581 of 2012 (Colombia) and Law 24 of 2002 and Law 81 of 2019 (Panama). Restricted circulation: this data is shared only with authorized users for legitimate credit-evaluation purposes; the score is not openly published. Public visibility is optional, off by default, and, when enabled, displays only a qualitative tier or band, never the numeric score or the underlying documents. You may access, rectify, and dispute your score, and revoke your authorization at any time; revocation immediately removes public visibility. Retention: unlike interaction and browsing data, this is financial-record data, retained according to the legal periods applicable to commercial and credit records (minimum 5 years); in Colombia, negative information observes the caducidad (expiry) periods of Law 1266. Cross-border transfers: financing may involve data transfers between Colombia and Panama (CO↔PA); we apply the safeguards and transfer clauses required by Law 1581 (Colombia) and Law 81 (Panama).

10. Marketing Email and Data Processors

Marketing email —newsletters, updates, and non-transactional promotional communications— is delivered through a self-hosted marketing-automation platform that we operate under our control. Where a third party acts as a data processor (encargado del tratamiento) —for example, infrastructure or email-delivery providers— it processes your data solely on behalf of Mercazul, following our documented instructions and a data-processing agreement, and never for its own purposes. This processing relies on the authorization you granted at registration, in accordance with Law 1581 of 2012 and Decree 1377 of 2013 (Colombia) and Law 81 of 2019 (Panama). We apply data minimization: only the data needed for delivery is processed —your name, your email, and, where applicable, basic commercial preferences—, never sensitive data or financing/credit data. You may unsubscribe at any time via the link in each message or from your account settings; opt-out requests are honored bidirectionally and sync between the marketing platform and your account, so that the opt-out takes effect in both systems.