Privacy policy

Privacy and Personal Data Processing Policy

Sumay CGC Essentials S.A.S. Last updated: 07/29/2026


At Sumay we respect your privacy and take the protection of your personal data seriously. This document explains what information we collect, what we use it for, and what your rights are as the owner of that information, in compliance with Law 1581 of 2012, Decree 1377 of 2013 and other data protection regulations in force in Colombia.


1. Data controller

Legal name: CGC Essentials S.A.S. Trade name: Sumay Tax ID (NIT): 901798745 Address: Bogotá D.C., Colombia Contact email: info@sumay.com Website: www.sumay.com

2. Data we collect

Depending on how you interact with us, we may collect:

  • Identification and contact data: name, email address, phone number, shipping and billing address.
  • Purchase data: products purchased, order history, shipping method, subscription status (if applicable).
  • Payment data: processed directly by our payment gateway (Shopify Payments and/or the payment methods enabled at checkout). Sumay does not store full credit or debit card numbers.
  • Browsing data: IP address, device type, pages visited, cookies and similar technologies (see section 8).
  • Preference data: answers to the protocol quiz, skin/wellness interests, if you choose to complete it.
  • Communications: messages you send us through the contact form, email, WhatsApp or social media.


We do not intentionally request or process sensitive data (for example, detailed health data) beyond what you voluntarily share when contacting us (for example, if you mention a skin condition when asking for advice).

3. Purposes of processing

We use your personal data to:

  1. Process and ship your orders, including payments, invoicing and delivery.
  2. Manage your account and your purchase history.
  3. Manage your subscription (Sumay Ritual), if you activate it: recurring charges, changes, pauses and cancellations.
  4. Provide support, answer inquiries and handle warranties or returns.
  5. Send you transactional communications (order confirmation, shipping, etc.).
  6. Send you commercial and educational communications (email, WhatsApp) only if you have given your express authorization. You can revoke it at any time.
  7. Personalize your experience (for example, protocol recommendations based on your quiz answers).
  8. Analyze site usage to improve the shopping experience (web analytics, campaign measurement).
  9. Comply with legal, accounting and tax obligations.

4. Authorization

By purchasing on sumayskincare.com, creating an account, subscribing to our newsletter or filling out a form, you authorize Sumay (CGC Essentials S.A.S.) to process your personal data in accordance with this policy. For commercial (marketing) communications, your authorization is always optional and separate from the purchase process: you can buy from Sumay without subscribing to our communications.

5. Your rights as a data subject

As the owner of your personal data, you have the right to:

  • Know, update and correct your personal data.
  • Request proof of the authorization granted, unless the law exempts you from this requirement.
  • Be informed about how we have used your data.
  • File complaints with the Superintendence of Industry and Commerce (SIC) for violations of data protection law.
  • Revoke your authorization and/or request deletion of your data, when there is no legal or contractual duty requiring us to keep it.
  • Access, free of charge, your personal data that has been processed.

How to exercise your rights

Write to us at info@sumay.com stating your request (inquiry or claim) and your identifying information. We will respond:

  • Inquiries: within a maximum of 10 business days, extendable by 5 additional business days if necessary.
  • Claims: within a maximum of 15 business days, extendable by 8 additional business days if necessary.

6. Who we share your data with

To operate Sumay, we share data with providers acting as data processors, under confidentiality agreements and with use limited to the contracted purpose:

  • Shopify (e-commerce platform and payment processing).
  • Carriers/couriers for the delivery of your orders.
  • HubSpot (CRM and marketing automation, if applicable).
  • Meta (Facebook/Instagram) and Google for advertising campaign measurement and analytics (Meta Pixel, Google Analytics).
  • Email marketing and customer service tools (for example, WhatsApp Business).


Several of these providers process information on servers outside Colombia (mainly in the United States). By accepting this policy, you authorize this international transfer and transmission of data, which is necessary for the operation of the service, under the security standards of those providers.


We do not sell your personal data to third parties.

7. Information security

We implement reasonable technical, human and administrative measures to protect your personal data against loss, misuse, unauthorized access or alteration, including the use of encrypted connections (HTTPS/SSL) and access control to our systems.

8. Cookies and similar technologies

We use our own and third-party cookies to: remember your shopping cart, keep you signed in, measure the performance of the site and our campaigns, and personalize content. You can manage your cookie preferences from your browser settings. [Link to Cookie Policy if published as a separate page.]

9. Minors

Sumay's products and services are intended for adults. We do not knowingly collect data from anyone under 18 years of age. If we find that we have collected data from a minor without the consent of their legal representative, we will delete it.

10. Retention period

Your data will be kept for as long as necessary for the purposes described, and thereafter for the periods required by law (accounting, tax, commercial). You may request earlier deletion unless there is a legal obligation to retain it.

11. Changes to this policy

We may update this policy to reflect legal, operational or service changes (for example, when expanding to the United States or Europe, where additional frameworks such as the CCPA or GDPR will apply). We will publish the date of the latest update at the top of this document.

12. Supervisory authority

For personal data protection matters in Colombia, the competent authority is the Superintendence of Industry and Commerce (SIC): www.sic.gov.co.

13. Contact

Sumay (CGC Essentials S.A.S.)

Bogotá, Colombia

info@sumay.com

+57 322 4737702