Privacy Policy - Agrícola EEB Perú Orgánico

Last updated: September 3, 2026

This Privacy Policy explains how Agrícola EEB Perú Orgánico S.A.C. (“EEB Perú Orgánico”, “we”, “us”, or “our”) collects, uses, discloses, stores, and protects personal data obtained through the website https://eebperu.com (the “Website”), and describes the rights available to you in connection with that data.

We process personal data in accordance with Peruvian Law No. 29733, the Personal Data Protection Law (Ley de Protección de Datos Personales), its implementing regulations, and, where applicable to visitors located in the European Economic Area or the United Kingdom, Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”) and the UK GDPR.

Please read this Policy carefully. By accessing the Website or submitting information through our contact form, you acknowledge that you have read and understood the practices described here.

1. Data Controller

The entity responsible for determining the purposes and means of processing your personal data is:

Legal name: Agrícola EEB Perú Orgánico S.A.C.
Registered activity: Agricultural production and export of certified organic products
Location: Motupe, Lambayeque, Peru
Legal representative: Claudia Espinosa
Website: https://eebperu.com

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR or under Peruvian law. Privacy enquiries may be directed to the contact address above.

2. Categories of Personal Data We Collect

2.1 Data you provide directly

When you complete and submit the contact form available on the Website, we collect the following data fields:

Full name (mandatory field)
Company or organization (mandatory field)
Email address (mandatory field)
Telephone number (mandatory field)
Nature of your enquiry, selected from a predefined list (buying product, investing or funding, research or field visit, media or press, other)
How you heard about us, selected from a predefined list
Free-text message, together with any additional personal data you voluntarily choose to include within it

Mandatory fields are marked as such in the form. If you do not provide them, we will be unable to process or respond to your enquiry.

2.2 Data collected automatically

When you browse the Website, certain technical data is collected automatically by our hosting infrastructure and by the technologies described in Section 7:

Internet Protocol (IP) address, which may be truncated or anonymized depending on the service processing it
Browser type, version, and language settings
Operating system and device type
Date, time, and duration of your visit
Pages viewed and navigation path within the Website
Referring URL, meaning the source from which you reached the Website
Server log data, including HTTP request headers, status codes, and volume of data transferred

2.3 Data we do not collect

The Website does not sell products or process payments. We do not collect payment card data, bank account details, or financial account information through the Website. We do not knowingly collect special categories of personal data as defined in Article 9 of the GDPR or sensitive data (datos sensibles) as defined in Peruvian Law No. 29733, and we ask that you refrain from including such information in the free-text fields of the contact form.

3. Purposes of Processing and Legal Bases

We process personal data only where a valid legal basis exists. The table below sets out each processing purpose alongside its corresponding legal basis.

Purpose	Categories of data	Legal basis (GDPR)
Responding to commercial, investment, research, or press enquiries submitted through the contact form	Identification and contact data, enquiry content	Article 6(1)(b), steps taken at the request of the data subject prior to entering into a contract; and Article 6(1)(f), legitimate interest in attending to enquiries
Managing and following up on commercial relationships with buyers, distributors, and partners	Identification, contact, and professional data	Article 6(1)(b), performance of a contract; and Article 6(1)(f), legitimate interest in maintaining business relationships
Coordinating farm visits, field learning experiences, and academic collaborations	Identification and contact data, institutional affiliation	Article 6(1)(b) and Article 6(1)(f)
Understanding which channels bring visitors to the Website, based on the “how did you hear about us” field	Attribution data provided in the form	Article 6(1)(f), legitimate interest in evaluating our own communication efforts
Maintaining the security, availability, and integrity of the Website, including protection against spam, abuse, and unauthorized access	Technical and server log data	Article 6(1)(f), legitimate interest in operating a secure service
Complying with tax, commercial, export, and record-keeping obligations under Peruvian law	Transactional and contractual data	Article 6(1)(c), compliance with a legal obligation
Establishing, exercising, or defending legal claims	Any relevant category	Article 6(1)(f), legitimate interest in the defence of legal rights

Under Peruvian Law No. 29733, the general legal basis for processing is the free, prior, express, unequivocal, and informed consent of the data subject, subject to the exceptions set out in Article 14 of that law, which include processing necessary for the performance of a contractual relationship and processing of data contained in publicly accessible sources.

Where we rely on legitimate interest, we have conducted a balancing assessment and concluded that our interest in operating the Website and responding to business enquiries does not override your fundamental rights and freedoms. You may request further information about this assessment using the contact details in Section 1.

4. Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Enquiries that do not result in a commercial relationship: up to twenty four (24) months from the last interaction, after which the data is deleted or irreversibly anonymized.
Enquiries that result in an ongoing commercial or institutional relationship: for the duration of the relationship and, thereafter, for the applicable statutory limitation period for contractual claims.
Data subject to tax, accounting, or export documentation requirements: for the period established by Peruvian law, which is generally five (5) years.
Server log data: retained by our hosting provider for the period defined in its own retention policy, generally not exceeding twelve (12) months.
Records evidencing consent or the exercise of data subject rights: retained for as long as necessary to demonstrate compliance with applicable law.

Once the applicable retention period expires, data is securely deleted or anonymized so that it can no longer be associated with an identifiable individual.

5. Recipients and Data Processors

We do not sell, rent, or trade personal data. We disclose personal data only in the circumstances described below, and always subject to appropriate contractual and technical safeguards.

5.1 Service providers acting as processors

We rely on the following categories of third party providers, each of which processes personal data on our behalf and under our documented instructions, pursuant to data processing agreements that meet the requirements of Article 28 of the GDPR:

Hosting and infrastructure. Our Website is hosted by Hostinger International Ltd., which stores Website files, the database, and server logs. Processing involves technical and server log data.
Form management and email delivery. The contact form is operated through WPForms, and submissions are transmitted by email to our internal address. Processing involves all data submitted through the form.
Content delivery and performance optimization. Caching and delivery technologies are used to improve load times and availability. Processing involves technical data and IP addresses.
Typography services. The Website loads web fonts, which may involve a request to the font provider’s servers and consequently the transmission of your IP address. See Section 7.3.
Search engine optimization tooling. Plugins used to manage metadata and structured data operate locally on our server and do not transmit visitor data to third parties.

5.2 Other recipients

Professional advisers, including legal, accounting, export, and certification consultants, where disclosure is necessary for the provision of their services.
Certification bodies and competent authorities, where disclosure is required in the context of organic certification audits, export documentation, or regulatory inspections.
Public authorities, courts, and regulators, where disclosure is required by a valid legal obligation, judicial order, or administrative requirement.
Successors in interest, in the event of a merger, acquisition, restructuring, or transfer of all or part of our business, subject to the recipient assuming obligations no less protective than those set out in this Policy.

6. International Transfers of Personal Data

We are established in Peru. Some of our service providers operate infrastructure located outside Peru, including within the European Economic Area and the United States. As a result, personal data may be transferred across international borders.

Where personal data originating in the European Economic Area or the United Kingdom is transferred to a country that has not been the subject of an adequacy decision, we rely on the Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR, supplemented where necessary by additional technical and organizational measures following a transfer impact assessment.

Where personal data collected under Peruvian law is transferred outside Peru, we comply with the cross border flow requirements set out in Article 15 of Law No. 29733 and its implementing regulations, ensuring that the recipient provides an adequate level of protection or that an appropriate legal mechanism is in place.

You may request a copy of the safeguards applicable to a specific transfer by writing to the address in Section 1.

7. Cookies and Similar Technologies

7.1 What cookies are

Cookies are small text files placed on your device when you visit a website. Similar technologies include local storage, session storage, pixels, and scripts that access or store information on your terminal equipment.

7.2 Cookies used on this Website

The Website operates with a minimal cookie footprint. The following categories may be present:

Strictly necessary cookies. Required for the Website to function, including session management, security tokens, and spam prevention on the contact form. These cookies cannot be disabled through a consent mechanism because the service cannot be provided without them.
Performance and caching cookies. Set by our caching layer to serve optimized versions of pages. These do not identify you individually.
Preference cookies. Store choices such as language selection where a translation feature is enabled.

The Website does not currently deploy advertising cookies or cross site tracking technologies for marketing purposes. If this changes, this Policy will be updated and, where required, a consent management mechanism will be implemented before any non essential cookie is placed.

7.3 Web fonts

The Website loads typography from an external font service. When a page is rendered, your browser may issue a request to that service, which necessarily discloses your IP address and browser characteristics to the provider. If you object to this processing, you may block third party requests using browser settings or extensions, although this may affect the visual presentation of the Website.

7.4 Managing cookies

Most browsers allow you to view, delete, and block cookies through their settings menu. Restricting cookies may impair certain functions of the Website. Instructions are available in the help documentation of your browser.

8. Social Media and External Links

The Website contains links to profiles operated on Instagram and TikTok under the name Srta. Flor de Mango, as well as links to other external resources. These links are static and do not transmit data to the platforms until you click them.

Once you leave the Website, the privacy practices of the destination platform apply. We do not control and are not responsible for the content, security, or data processing activities of third party websites and platforms. We recommend reviewing their respective privacy policies.

9. Your Rights

9.1 Rights under the GDPR

If you are located in the European Economic Area or the United Kingdom, you may exercise the following rights:

Right of access (Article 15), to obtain confirmation as to whether we process your data and, if so, a copy of it together with the information set out in this Policy.
Right to rectification (Article 16), to have inaccurate data corrected and incomplete data completed.
Right to erasure (Article 17), to obtain deletion of your data where one of the grounds set out in that Article applies.
Right to restriction of processing (Article 18), to limit how we use your data in specified circumstances.
Right to data portability (Article 20), to receive data you provided to us in a structured, commonly used, machine readable format, where processing is based on consent or contract and carried out by automated means.
Right to object (Article 21), to processing based on legitimate interest, on grounds relating to your particular situation.
Right to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
Right not to be subject to automated decision making (Article 22). We do not carry out automated decision making or profiling that produces legal or similarly significant effects.

9.2 Rights under Peruvian Law No. 29733

If you are located in Peru, you hold the rights of information, access, rectification, cancellation, and opposition, together with the rights to object to and to prevent the supply of your data, as set out in that law and its implementing regulations.

9.3 How to exercise your rights

Requests may be submitted in writing to the contact address in Section 1. To protect your data, we may ask you to provide information sufficient to verify your identity before acting on a request. We will respond within the timeframes established by applicable law, which is one (1) month under the GDPR, extendable by two (2) further months where the request is complex, and twenty (20) days for access requests and ten (10) days for rectification, cancellation, or opposition requests under Peruvian law.

Exercising these rights is free of charge, except where requests are manifestly unfounded or excessive, in particular because of their repetitive character.

9.4 Right to lodge a complaint

If you consider that our processing infringes applicable data protection law, you may lodge a complaint with:

The Autoridad Nacional de Protección de Datos Personales of Peru, part of the Ministry of Justice and Human Rights, if you are located in Peru.
The supervisory authority of the European Union Member State of your habitual residence, place of work, or place of the alleged infringement, if you are located in the European Economic Area.
The Information Commissioner’s Office, if you are located in the United Kingdom.

We would appreciate the opportunity to address your concerns directly before you approach a supervisory authority.

10. Security Measures

We implement technical and organizational measures appropriate to the risk presented by our processing activities, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, in accordance with Article 32 of the GDPR and the security obligations established under Peruvian law.

These measures include:

Encryption of data in transit through TLS across the entire Website
Access controls limiting internal access to personal data to authorized personnel on a need to know basis
Use of authenticated administrative accounts with strong credentials for the content management system
Regular application, plugin, and server software updates to remediate known vulnerabilities
Automated backups of the Website database and files
Spam and abuse protection mechanisms on the contact form
Contractual commitments imposed on processors regarding confidentiality and security

No method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect personal data using commercially reasonable means, we cannot guarantee absolute security. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, the affected data subjects, within the timeframes established by applicable law.

11. Children

The Website is directed at professional audiences, including buyers, distributors, investors, researchers, and members of the press. It is not directed at children, and we do not knowingly collect personal data from individuals under the age of sixteen (16), or under the applicable minimum age established by local law.

If you believe that a child has provided personal data through the Website, please contact us using the details in Section 1 so that we may delete it.

12. Automated Decision Making and Profiling

We do not carry out automated decision making, including profiling, that produces legal effects concerning you or similarly significantly affects you. Enquiries received through the contact form are reviewed and answered by our personnel.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, in the technologies used on the Website, or in applicable legal requirements. The version in force is the one published on this page, and the date at the top indicates when it was last revised.

Where a change is material, we will take reasonable steps to bring it to your attention, which may include a notice on the Website or, where appropriate and where we hold your contact details, a direct communication. We encourage you to review this page periodically.

14. Contact

For any question, request, or complaint relating to this Privacy Policy or to the processing of your personal data, you may contact us at:

Agrícola EEB Perú Orgánico S.A.C.
Motupe, Lambayeque, Peru
Website: https://eebperu.com