2. PRIVACY AND PERSONAL DATA PROTECTION POLICY
Last updated:  August 16, 2026
CESSAMO recognizes the importance of protecting the personal information of its users and clients.
The processing of personal data will be carried out in accordance with Law No. 29733, Personal Data Protection Law, and its current Regulations approved by Supreme Decree No. 016-2024-JUS.

2.1. Data Controller
The data controller is Cessamo.com.
2.2. Personal Data Collected
CESSAMO may collect, depending on the user's interaction:

• First and last name.

• Identity document, when necessary.

• Email address.

• Telephone number.

• Delivery address.

• Order-related data. • Information necessary to issue receipts.

• Information provided in inquiries and complaints.

• Technical navigation information.

2.3. Purposes
The data may be used to:
• Process purchases.

• Manage payments.

• Coordinate deliveries.

• Issue receipts.

• Respond to inquiries.

• Manage exchanges and returns.

• Handle complaints.

• Prevent fraud.

• Comply with legal obligations.

• Improve the platform.

• Send commercial communications when there is a legal basis or corresponding consent.

2.4. Suppliers
CESSAMO may contract with technology, logistics, financial, warehousing, customer service, and other providers necessary to carry out its operations.

When these third parties have access to personal data, such access will be limited to the purposes necessary to provide the corresponding service and will be subject to applicable obligations.

2.5. Security
CESSAMO will implement reasonable technical, organizational, and legal measures designed to protect personal data.

The current Regulation includes specific security measures for the processing of data through digital platforms.

2.6. Data Subject Rights
The data subject may exercise the rights recognized by Peruvian personal data protection regulations.

Requests may be sent to:

[EMAIL FOR PERSONAL DATA RIGHTS]
2.7. Commercial Communications
CESSAMO may send promotions and advertising when there is consent or the corresponding legal basis.

The user may request to stop receiving such communications through the enabled mechanisms.

2.8. Data Retention
Data will be retained for the time necessary to fulfill the stated purposes and applicable legal obligations.

2.9. Personal Data Bank
Where applicable, CESSAMO will manage the registration and updating of its personal data banks in accordance with applicable obligations.

The current regulations include the National Registry of Personal Data Protection and obligations related to the registration and updating of databases.