About

Personal Data Processing Policy

1. About this policy

This Personal Data Processing Policy ("Policy") explains how Victoria Lab S.A.S. collects, uses, shares and protects personal data through juliovictoria.com and the channels linked to it. It also explains your rights and how to exercise them.

This Policy is issued under Colombian Statutory Law 1581 of 2012 and Chapter 25 of Decree 1074 of 2015. Because many of our visitors live outside Colombia, it also includes the information required by other laws where they apply to us, including the EU and UK General Data Protection Regulation (GDPR) and United States privacy laws (sections 14 and 15).

This Policy applies to:

● the website juliovictoria.com and its online store;

● our newsletter;

● messages you send us by email, WhatsApp or other contact channels, including booking and professional inquiries; and

● personal data we receive when you interact with our official social media pages.

It does not apply to third-party platforms we link to or embed, such as Spotify, SoundCloud, Apple Music, YouTube, Vimeo, Instagram, Facebook, TikTok, Beatport or Juno. Those platforms process your data under their own privacy policies.

2. Data Controller

The Data Controller (Responsable del Tratamiento) is:

● Legal name: Victoria Lab S.A.S.

● Tax ID (NIT): 901.805.920-5

● Domicile: Armenia, Quindío, Colombia

● Email: contact@juliovictoria.com

● Website: www.juliovictoria.com

In this Policy, "Victoria Lab", "we", "us" and "our" refer to Victoria Lab S.A.S., the company that manages the music, performances and communications of Julio Victoria.

Data protection contact. Victoria Lab's administration area handles inquiries, requests and complaints about personal data. You can reach it at contact@juliovictoria.com, with "Personal data" in the subject line.

We have not appointed a Data Protection Officer under the GDPR because we are not required to do so.

3. Personal data we collect

We collect only the data we need for each purpose. Most of it you give us directly; some is collected automatically when you use the website.

● Newsletter: your email address; your name and country if you provide them; the date, time, source page and IP address of your sign-up and consent; and whether you open or click our emails.

● Messages and booking or professional inquiries: name, email, phone, company or venue, role, event details and the content of your message.

● Purchases on our online store or through WhatsApp: name, email, phone, delivery address, order details and payment status. Card data is handled by the payment provider; we do not receive full card numbers.

● Contracts with promoters, venues and collaborators: contact and billing details, tax ID and other data required for contracts and invoices.

● Browsing the website: IP address, approximate location derived from it, device and browser type, pages visited, referring site and time of visit, collected through cookies (section 6).

● Performances: photos and videos of shows, in which audience members may appear.

● Social media: your public username, comments and messages on our pages, and aggregated statistics the platforms provide to us.

Sensitive data. We do not request sensitive data, such as data about health, racial or ethnic origin, political opinions, religious beliefs or biometric data. You are not required to provide it or to authorize its processing, and no service depends on it. If you choose to share it (for example, accessibility needs for an event), we will use it only to respond to that request and with your express authorization.

Data about others. If you give us data about another person (for example, a colleague in a booking inquiry), you confirm that you are allowed to share it with us.

4. Your authorization

We ask for your prior, express and informed authorization before, or at the latest when, we collect your data. At that point we tell you which data we collect and why.

You may give your authorization:

● in writing, including electronically (for example, by ticking an unticked box in our forms);

● orally (for example, during a recorded call); or

● through unequivocal conduct that reasonably shows you agree (for example, sending us an inquiry by email so we can answer it).

Silence or inactivity never counts as authorization. We never use pre-ticked boxes.

We keep proof of your authorization, such as the date, time, IP address, form used and the version of this Policy you accepted.

Under Colombian law, authorization is not required in limited cases, such as data that is public by nature, data requested by a public authority exercising its legal functions or by court order, or medical or health emergencies (Article 10 of Law 1581 of 2012).

Withdrawing your authorization. You may withdraw your authorization at any time, free of charge, by using the unsubscribe link in our emails or by writing to contact@juliovictoria.com. Withdrawal does not affect processing carried out before it. We may refuse withdrawal or deletion only while you have a legal or contractual duty to remain in our database, and we will tell you why.

5. Purposes and legal bases

We process your data only for the purposes below. Under Colombian law, each purpose relies on your authorization or on a legal exception. Where the GDPR or UK GDPR applies, the legal basis is shown in brackets.

1. Newsletter. To send you news about the music, releases, shows, tours, merchandise and projects of Julio Victoria and Victoria Label, tailored to your country if you share it. (Consent.)

2. Inquiries. To answer your messages and booking or professional inquiries. (Steps you request before a contract; our legitimate interest in replying.)

3. Contracts. To negotiate, sign and perform contracts for shows and collaborations. (Contract.)

4. Orders. To process, deliver and support your purchases. (Contract.)

5. Legal duties. To issue invoices, keep accounting records and meet tax and legal obligations. (Legal obligation.)

6. Security. To run the website securely and prevent fraud or abuse. (Legitimate interests.)

7. Analytics. To measure website traffic and improve the site. (Consent.)

8. Artistic record. To publish photos and videos of performances that document and promote the artist's work. (Legitimate interests; you may object.)

9. Legal claims. To respond to authorities and to establish or defend legal claims. (Legal obligation; legitimate interests.)

We do not sell your personal data. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

If we want to use your data for a new purpose, we will inform you and, where the law requires it, ask for a new authorization first.

6. Cookies and similar technologies

We place non-essential cookies only after you accept them in our cookie banner. You can change your choice at any time through the cookie preferences option on the website.

Cookies are small files stored on your device. Similar technologies include pixels in emails. Our website runs on Squarespace, which uses these categories:

● Essential: keep the site working, including the shopping cart, checkout, security and your cookie choice. They are always on, because the site cannot work without them.

● Analytics and performance: Squarespace Analytics counts visits, traffic sources and pages viewed so we can improve the site. Used only with your consent.

● Embedded content: players and posts from SoundCloud, YouTube, Vimeo, Spotify or Instagram may set their own cookies when they load or play, under each platform's policy.

● Newsletter tracking: pixels and tracked links in our emails tell us whether an email was opened or a link was clicked. You can block images in your email app or unsubscribe.

We do not use advertising or remarketing cookies.

You can also block or delete cookies in your browser settings. Blocking essential cookies may prevent the store from working.

Do Not Track. We do not track you across other websites, and our cookie banner lets you refuse all non-essential cookies. We do not currently change our practices in response to browser "Do Not Track" signals. Embedded third-party platforms may collect data about your activity across websites under their own policies.

7. Who we share your data with

We share your data only with the recipients below, and only as needed for the purposes in section 5. We do not sell or rent your personal data.

Processors (Encargados). These providers process data on our behalf and under our instructions, under contracts that require security and confidentiality:

● Squarespace (United States): website hosting, online store and site analytics.

● beehiiv Inc. (United States): newsletter delivery and subscriber management.

● Payment processors: card and online payments for our store.

● Email and cloud storage providers: our inbox and files.

● Accountants and legal advisers (Colombia): accounting, tax and legal services.

Other recipients. We may also share data with:

● couriers and delivery companies, to ship your orders;

● promoters, venues, festivals, booking agents and collaborators, when needed to organize a show or project you are part of;

● public authorities, courts and regulators, when the law or a valid order requires it; and

● a buyer or successor, if Victoria Lab or its music catalogue is reorganized, merged or sold, subject to this Policy.

These recipients use the data under their own privacy policies.

Platforms you use. When you message us on WhatsApp or social media, or play embedded music and video, those platforms (for example Meta, Google or Spotify) also process your data as independent controllers.

8. International transfers

Your data is stored and processed in Colombia and in the United States, where our main providers operate.

Under Colombian law. Colombian law distinguishes two cases:

● A transmission sends data to a processor that acts on our behalf (for example, Squarespace or beehiiv). We sign data processing contracts that bind the processor to our instructions and to this Policy, and to security and confidentiality duties (Article 2.2.2.25.5.2 of Decree 1074 of 2015).

● A transfer sends data to another controller. We transfer data only to countries the Superintendence of Industry and Commerce (SIC) recognizes as providing an adequate level of protection, or under the exceptions in Article 26 of Law 1581 of 2012. The SIC list, in Chapter 3 of Title V of its Circular Única, includes the United States and European Union countries, among others.

For data protected by the GDPR or UK GDPR. When we send such data to a country without an adequacy decision, we use one of these safeguards:

● the EU-U.S. Data Privacy Framework and its UK Extension, for U.S. providers certified under it; or

● the European Commission's Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum, which beehiiv includes in its Data Protection Addendum.

You can request a copy of the relevant safeguards by writing to us (section 11).

9. How long we keep your data

We keep personal data only as long as each purpose requires, and then delete or anonymize it, unless a law requires us to keep it longer.

● Newsletter: while you remain subscribed. After you unsubscribe, we keep only your email in a suppression list, so we do not contact you again, and the record of your consent and withdrawal for 3 years.

● Inquiries that do not lead to a contract: 2 years from our last communication.

● Orders, invoices, contracts and accounting records: 10 years from the last entry or document, as required by Article 28 of Law 962 of 2005.

● Analytics cookies: up to 2 years, or until you delete them or withdraw consent.

● Photos and videos of performances: while they form part of the artist's archive, unless you object (section 10).

● Records of your rights requests: 2 years from our final answer.

Validity of our databases. Our databases remain in force for as long as Victoria Lab carries out the activities described in this Policy. The data in them is kept only for the periods above.

10. Your rights

Wherever you live, you have the following rights over your personal data. Under Colombian law they arise from Article 8 of Law 1581 of 2012; some laws abroad grant additional rights, described in sections 14 and 15.

● Know and access your data and how we use it, free of charge at least once each calendar month and whenever this Policy changes substantially.

● Update and correct data that is partial, inaccurate, incomplete or misleading.

● Request proof of the authorization you gave us.

● Withdraw your authorization and request deletion of your data, unless a legal or contractual duty requires us to keep it.

● Object to processing based on our legitimate interests, and to direct marketing at any time.

● Restrict processing while we review a complaint, and receive a copy of the data you gave us in a portable format, where the applicable law grants these rights.

● Complain to the Superintendence of Industry and Commerce (SIC) or to your local data protection authority (section 11).

You may exercise these rights yourself, through your heirs, or through a representative or attorney who proves their authority. The rights of children and adolescents are exercised by their legal representatives.

11. How to exercise your rights

Send your request to contact@juliovictoria.com with "Personal data" in the subject line. Requests are free of charge.

Your request should include:

1. your full name and the email or phone linked to your data;

2. what you are asking for (access, correction, deletion, withdrawal of authorization, objection or other) and, for complaints, a description of the facts;

3. a postal or email address for our reply; and

4. any documents you want us to consider. Representatives must attach proof of their authority.

We may ask for reasonable information to verify your identity before we act.

We apply the deadlines of Colombian law (Articles 14 and 15 of Law 1581 of 2012) to every request, unless the law of your country sets a shorter one:

● Queries (access to your data or information about its use): we answer within 10 business days of receipt. If that is not possible, we will tell you why and answer within 5 business days after the first deadline.

● Complaints (correction, update, deletion, withdrawal of authorization, or an alleged breach of the law): we answer within 15 business days from the day after receipt. If that is not possible, we will tell you why and answer within 8 business days after the first deadline.

For complaints:

● If your complaint is incomplete, we will tell you what is missing within 5 days of receiving it. If you do not complete it within 2 months of our request, we will treat it as withdrawn.

● Within 2 business days of receiving a complete complaint, we will mark the data concerned as "complaint in progress" until it is resolved.

Complaints to the authority. In Colombia, you may file a complaint with the Superintendence of Industry and Commerce (www.sic.gov.co) after first submitting your query or complaint to us (Article 16 of Law 1581 of 2012). If you are in the EEA, Switzerland or the UK, you may complain directly to your data protection authority (section 14).

12. Children and adolescents

Our newsletter, store and contact channels are intended for people aged 18 or over. We do not knowingly collect personal data from anyone under 18 without the authorization of their parent or legal guardian, and we never knowingly collect data from children under 13.

When we process data of minors with that authorization, we do so only in their best interest and respecting their fundamental rights, as Colombian law requires (Article 7 of Law 1581 of 2012 and Article 2.2.2.25.2.9 of Decree 1074 of 2015). The minor's opinion is heard and weighed according to their maturity.

If you believe a minor has given us data without authorization, write to contact@juliovictoria.com and we will delete it.

13. Security

We protect your data with technical, administrative and organizational measures suited to the data we hold and the risks involved. These include restricted access on a need-to-know basis, strong passwords and two-factor authentication on our accounts, encrypted connections (HTTPS) on the website, and contracts that require our processors to keep data secure and confidential.

No system is completely secure. If a security incident puts your data at risk, we will act to contain it and will notify the Superintendence of Industry and Commerce, other competent authorities and, where required, the people affected, within the time limits set by applicable law.

14. Additional information for users in the EEA, Switzerland and the UK

This section applies when the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing of your data, for example because we offer you our newsletter or products while you are in those territories.

Controller. The controller is Victoria Lab S.A.S. (section 2), established in Colombia. You can write to us about any matter under these laws at contact@juliovictoria.com.

Legal bases. Section 5 lists the legal basis for each purpose. Where we rely on legitimate interests, we have balanced them against your rights; you can ask us for details.

Is providing data required? No law requires you to give us personal data. Your email is needed to receive the newsletter, and your order and delivery details are needed to complete a purchase. Without them, we cannot provide that service.

Your rights. In addition to section 10, you have the rights of access, rectification, erasure, restriction, data portability and objection (Articles 15 to 21 GDPR). You may withdraw consent at any time, as easily as you gave it. We answer within the deadlines in section 11, which are shorter than the one month allowed by Article 12(3) GDPR.

Complaints. You can complain to us first (section 11). For users in the UK, we acknowledge data protection complaints within 30 days and keep you informed of their progress, as section 164A of the UK Data Protection Act 2018 requires. You also have the right to complain to the data protection authority where you live or work, or where an alleged breach occurred. In the UK this is the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner.

Transfers. See section 8 for the safeguards we use.

15. Additional information for users in the United States

We do not sell your personal information, and we do not share it for cross-context behavioral or targeted advertising. We have not done so in the past 12 months.

State privacy laws. Given our size and activities, we do not currently meet the thresholds of the California Consumer Privacy Act (CCPA) or of similar comprehensive state privacy laws. Even so, we honor the rights in section 10 for users in every U.S. state, using the procedure in section 11, and we do not discriminate against anyone for exercising them.

California notices. Under the California Online Privacy Protection Act, this Policy describes the categories of data we collect (section 3), the parties we share it with (section 7), how you can review and correct it (section 11), how we respond to Do Not Track signals (section 6) and how we notify changes (section 16). Under California's "Shine the Light" law, we do not disclose personal information to third parties for their own direct marketing.

Children. We do not knowingly collect personal information from children under 13 (section 12), consistent with the Children's Online Privacy Protection Act.

16. Changes, language and effective date

We may update this Policy to reflect legal, technical or business changes. We will publish each new version on this page with its date.

If a change affects the identity of the Controller or the purposes of processing, we will tell you by email or by a notice on the website before, or at the latest when, the change takes effect. If the change adds or alters a purpose, we will ask for your new authorization before using your data for it (Article 2.2.2.25.2.2 of Decree 1074 of 2015).

Language. This Policy is published in English and Spanish, with the same content. For matters governed by Colombian law, the Spanish version prevails.

Effective date. This version takes effect upon its publication on this website in October 2026 and replaces the version of September 2026.