Privacy policy
What personal data Heragon receives through this website and its contact channels, what we use it for, how long we keep it, and how you can ask us to see, correct or delete it.
Version of 21 October 2026
In short
- This website has no user accounts, no analytics, no advertising and no tracking tools.
- The only form that stores data on our server is the review form: your name, your city if you add it, your rating if you give one, and what you tell us. We never ask for your email, phone number or ID.
- Your review is only published if you tick the consent box, and we read it first.
- If you write to us on WhatsApp, by email or on social media, we use what you send us to reply.
- You can ask us at any time to see, correct or delete your data and to withdraw your consent.
Who is responsible for your data
The controller of your personal data is Heragon, the cacao wine and chocolate workshop in Guamal (Meta, Colombia). These are its contact details:
- Name
- Heragon
- Address
- Vereda Pío XII, 3 km from the town of Guamal, Meta, Colombia. Postcode 507051.
- Phone and WhatsApp
- +57 313 410 9847
What data we process and why
When you leave a review
To leave a review you need the link or QR code we hand out with a product, at an event or during a visit. The form is on the “Tell us what you thought” page and on each product and event page. We store:
- The name you sign with, your city (if you add it) and your rating from 1 to 5 (if you give one).
- What you write and the language you write it in.
- What you are reviewing —the product, the event or the visit—, the link you came through, and the date.
- The date and time you ticked the consent box to have it published: our proof that you gave consent.
- A browser token that tells us whether you have already left a review (see Cookies). We only keep a fingerprint of it: a cryptographic digest that cannot be turned back into the token.
- The IP address you send it from.
We use this to:
- Read your review before publishing it and decide whether to publish it. Reviews we do not publish are kept as well.
- Publish it, if you gave consent. The website shows your name, city, rating, review, the date and what it is about. If you wrote in another language, we also publish our translation, and your original text can always be read.
- Know whether you have already reviewed the same thing, following the rule of each link (for example, once every 30 days).
- Prevent abuse of the form: we use the IP address to limit how many reviews can arrive from the same connection, and to keep a record of when each one arrived.
When someone opens a review link we count that it was used, to know whether our QR codes get scanned. That count does not record who opened it.
When you write to us
You can reach us on WhatsApp, by phone, by email or on our social media. We receive what you send us and whatever those services show us, such as your phone number, email address or profile name. We use it to reply and to handle what you ask for: an order, a visit, a question about an event.
On the Contact page you can put your message together with your name, where you are writing from and what you need. That message is composed in your browser and never goes through our server: it opens in WhatsApp, and you decide whether to send it. The same goes for “Let us know you're coming” on an event page.
WhatsApp, our email provider (Outlook.com) and the social networks are run by other companies, under their own privacy policies.
Cookies and storage in your browser
The website stores very little in your browser, and nothing for advertising or tracking:
hg_opinion- What it is
- Our own cookie, holding a random number.
- What for
- To recognise —without knowing who you are— whether you have already reviewed through a link, and apply its rule. It is only created when you open the review form, and no script on the page can read it.
- How long
- Two years from the last time you open the form.
hg-tema- What it is
- Browser local storage.
- What for
- To remember whether you chose the light or the dark theme.
- How long
- Until you clear this website’s data in your browser.
hg-aviso-idioma- What it is
- Browser local storage.
- What for
- To remember that you closed the notice suggesting the website in another language.
- How long
- Until you clear this website’s data in your browser.
The team members who manage the website also use the session and security cookies of the admin panel, plus a preference for its menu. They only exist for people who log in to the panel.
Since all of this only makes the website work the way you ask it to, we do not ask you to accept it in a banner. You can delete it at any time from your browser settings; if you delete hg_opinion, the website will no longer know whether you have already left a review.
Content from other companies on the website
- Google Maps. The map in “Where it is made” (on the Home and Contact pages) and the “How to get there” map on some product and event pages load from Google as you get close to them. When they load, Google receives your IP address and may use its own cookies.
- YouTube and Vimeo videos. Some product and event pages include a video. The player only loads if you press play, and we use their enhanced privacy modes (youtube-nocookie.com and Vimeo’s “do not track” option). If a YouTube video has no cover image of its own, its thumbnail is requested from YouTube when it is shown.
- Links to WhatsApp, Instagram, Facebook, TikTok and Google Maps. They only take you to those services if you tap them.
What those companies do with the data they receive is governed by their own policies, which we recommend you read.
Who we share your data with
We do not sell or hand over your personal data. It only reaches:
- Anyone who visits the website, in the case of the reviews you agreed to publish, as explained above.
- Our web hosting provider (Hostinger), which stores the website and its database and processes your data on our behalf. Its servers may be located outside Colombia.
- The authorities, when they request it in the exercise of their legal duties or by court order.
How long we keep it
- Published reviews: for as long as they remain published, or until you ask us to remove them.
- Reviews we do not publish: in our admin panel, hidden, until you ask us to delete them. While they are there, they still count when checking whether you have already left a review.
- Your browser token (hg_opinion): two years from the last time you open the form.
- IP addresses used to limit submissions: deleted in the automatic clean-ups of records older than one day.
- The IP address recorded with each review we receive: kept with that record. You can ask us to delete it.
- Messages on WhatsApp, by email or on social media: for as long as we need to handle your request and to meet legal obligations, such as accounting ones if you made a purchase.
Once we no longer need it for these purposes we will delete it, unless the law requires us to keep it.
Your rights
As the owner of your data, you have the right to:
- Know, update and correct your data, including when it is partial, inaccurate or incomplete.
- Ask for proof of the consent you gave us.
- Be told how we have used your data.
- File complaints with the Superintendence of Industry and Commerce for breaches of the law.
- Withdraw your consent and ask us to delete your data, unless there is a legal or contractual duty to keep it.
- Access your data free of charge.
How to exercise them
Email us at vinoartesanalheragon@hotmail.com —or, if you prefer, on WhatsApp— and tell us what you need. To find your review, give us the name you signed with, what you reviewed and, if you remember it, the date. Before giving you or changing any information, we may ask for something else to confirm it is really you.
- Queries —knowing what data we hold and how we use it—: we reply within ten (10) business days of receiving them. If that is not possible, we will let you know beforehand, with the reason and a new date no more than five (5) business days later.
- Claims —correcting, updating or deleting data, withdrawing consent or reporting a breach—: include your identification, what you are asking for and why, a contact address and any documents you wish to provide. If anything is missing, we will ask for it within five (5) days; if we have not received it two (2) months later, we will consider the claim withdrawn. While we handle it, your data will be flagged “claim in progress”. We resolve claims within fifteen (15) business days; if that is not possible, we will let you know, with the reason and a new date no more than eight (8) business days later.
If you are not satisfied after going through your query or claim with us, you can turn to the Superintendence of Industry and Commerce (sic.gov.co), Colombia’s data protection authority.
How we protect it
The website only works over an encrypted connection (HTTPS). Access to the admin panel and the database is protected by a username and password. And the review form asks for no more than it needs: no email, no phone number, no ID.
Sensitive data and data about minors
We ask no questions about sensitive data —health, ethnic origin, beliefs, political or sexual orientation, among others— or about children and adolescents. Please do not include such data in your reviews or messages.
Changes to this policy
If we change this policy, we will publish the new version here with its date. If the change affects who the controller is or the purpose for which we use your data, we will announce it on the website before applying it and, if the purpose changes, we will ask for your consent again.
Applicable law
- Statutory Law 1581 of 2012, on personal data protection.
- Decree 1377 of 2013, now compiled in Single Regulatory Decree 1074 of 2015 (Book 2, Part 2, Title 2, Chapter 25).
This English version is provided for convenience. In case of any discrepancy, the Spanish version prevails.