Privacy and Data Processing Policy

1. Data Controllers

This Privacy Policy explains how DISAR Logistics collects, uses, retains and protects your personal data when you visit disarlogistics.com, submit an order request or contact us. The data controllers are:

Each company is responsible for the data of the customers it serves within its territory. For any matter related to your personal data, you may write to clientes@disarlogistics.com with the subject line “Data protection”.

Data protection officer: the General Manager of each company handles matters relating to the processing of personal data and requests from data subjects, through clientes@disarlogistics.com.

2. Data We Collect

Data you provide to us

• Identification and contact: full name, company, email address, phone/WhatsApp.
• Invoicing: NIT, NRC or other tax document, when you provide it for invoicing purposes.
• Delivery: country, city, address and delivery method.
• Order: product, specifications, quantities and comments.
• Consents: acceptance of the terms and privacy policy, and preferences regarding commercial communications, with date and time.

Data obtained automatically

• Technical browsing data (IP address, browser and device type, pages visited) recorded by our hosting provider for security reasons.
• Your cookie preference, stored in your browser. Analytics or marketing cookies are used only if you authorize them (see Cookie Policy).

We do not request sensitive data (health, religion, ethnic origin, etc.) or payment card data through the Site.

3. Purposes and Legal Basis

We collect only the data necessary for these purposes and do not use it for incompatible purposes.

4. Recipients and Data Processors

We do not sell or rent your personal data. We may share it only with:

• Technology providers that provide services to us and act as data processors: Site hosting, corporate email service (Google Workspace) and the form submission service (Netlify Forms), which forwards your request to our email.
• WhatsApp (Meta Platforms), only if you choose to contact us through that channel, in which case that platform’s policies also apply.
• Transportation companies, customs brokers and couriers, with the data necessary to deliver your order.
• Between the DISAR companies in El Salvador and Guatemala, when necessary to handle your order from the appropriate country.
• Competent authorities, when there is a legal obligation or a valid request.

5. International Transfers

Some of our technology providers may store or process data on servers located outside El Salvador and Guatemala (for example, in the United States). Likewise, for international shipments, your delivery data is communicated to carriers and authorities in the country of destination. In all cases, we seek to ensure that such third parties offer adequate security and confidentiality safeguards. By submitting your request, you consent to these transfers to the extent necessary for the purposes described.

6. Retention Period

• Requests that do not result in a sale: up to twenty-four (24) months from the last contact, unless you request their deletion earlier.
• Customer and transaction data: for the duration of the business relationship and, thereafter, for the periods required by the commercial, tax and customs legislation of each country.
• Data for commercial communications: until you withdraw your consent.

Once these periods have expired, the data is securely deleted or anonymized.

7. Your Rights

In accordance with El Salvador’s Ley para la Protección de Datos Personales (Personal Data Protection Law) and other applicable regulations in El Salvador and Guatemala, you may exercise the following rights at any time and free of charge:

• Access: to know what data of yours we process and for what purpose.
• Rectification: to correct inaccurate or incomplete data.
• Cancellation or erasure: to request the deletion of your data when it is no longer necessary.
• Objection: to object to processing in certain circumstances, including the sending of advertising.
• Restriction: to request that we temporarily restrict processing.
• Portability: to receive your data in a structured, commonly used format.
• Withdrawal of consent, without affecting the lawfulness of prior processing.

8. Information Security

We apply reasonable technical and organizational measures to protect your data against loss, misuse, unauthorized access, alteration or disclosure: encrypted connection (HTTPS), access restricted to authorized personnel, accounts protected with two-step verification, and providers with recognized security standards. No system is completely infallible; should an incident affecting your data occur, we will notify you in accordance with the law.

9. Minors

The Site and our products are intended for businesses and persons of legal age. We do not knowingly collect data from persons under 18 years of age. If we discover that a minor has provided us with data, we will delete it.

10. Changes to This Policy

We may update this Policy to reflect legal or operational changes. The version in force will always be published on this page with its date of last update. If the changes are substantial, we will provide visible notice on the Site.