VÉNA – Moda que fluye

POLÍTICA DE PRIVACIDAD

Privacy Policy - ISLAMODAPR LLC

Effective Date: July 7, 2026
Last Updated: July 6, 2026

This Privacy Policy ("Policy") describes how ISLAMODAPR LLC d/b/a VÉNA, ("Company," "we," "us," or "our"), collects, uses, discloses, and protects the personal information of users ("you," "your," or "User") of our second-hand online marketplace platform accessible at https://joinvena.com (the "Platform" or "Site").

1. Scope and Consent

This Policy applies to all personal data collected through the Platform, including but not limited to our website, APIs, email communications, and any other services or features offered by the Company in connection with the second-hand marketplace (collectively, the "Services"). This Policy applies regardless of the device or method you use to access our Services.

By accessing, registering for, or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree to the terms of this Policy, you must immediately cease using the Platform and all associated Services.

Your consent to data collection and processing as described herein is provided at the time of account registration and is reaffirmed each time you use the Services. You may withdraw your consent at any time by contacting us at [email protected] or by following the procedures described in Section 10 below; however, withdrawal of consent may limit or prevent your ability to use certain features of the Platform.

This Policy is governed by the laws of the Commonwealth of Puerto Rico, as well as applicable federal laws of the United States.

2. Categories of Personal Data Collected

When we or our verification providers verify your identity, we may collect and process government-issued identification documents and related data. Such data is used only to verify identity and prevent fraud, is handled under our providers' data-processing agreements, and is retained only as long as necessary for those purposes or as required by law. We collect the following categories of personal data in connection with your use of the Platform:

2.1 Identifiers

Full legal name, username, and display name
Government-issued identification numbers (where required for identity verification or high-value transactions)
Account credentials (email address and encrypted password)
Unique user identifiers and account numbers

2.2 Contact Information

Email address (primary and secondary)
Phone number (mobile and/or landline)
Mailing address and shipping address
Social media handles (if voluntarily provided)

2.3 Payment and Financial Information

Credit card or debit card numbers (processed and stored by our third-party payment processor, Stripe; VÉNA does not collect or store complete card numbers)
Billing address
Transaction amounts, dates, and reference numbers

2.4 Transaction History

Records of items listed, purchased, sold, or returned
Pricing history, offers made and received
Shipping and delivery records
Disputes, claims, and resolution outcomes
Ratings and reviews submitted or received

2.5 Device and Usage Data

IP address (IPv4 and IPv6)
Device type, operating system, and version
Browser type and version
Screen resolution
Pages visited, time spent on pages, click patterns
Referring URLs and exit pages
Session duration and frequency of visits

2.6 Cookies and Similar Technologies

Session cookies and persistent cookies
Web beacons, pixel tags, and clear GIFs
Local storage objects

2.7 Geolocation Data

Approximate location derived from IP address
Zip code or municipality information provided during registration

2.8 Communications

Messages exchanged between buyers and sellers through the Platform's messaging system
Customer support inquiries, complaints, and correspondence
Feedback, survey responses, and contest entries

3. How Data Is Collected

3.1 Data Provided Directly by Users

We collect personal data that you voluntarily provide to us when you:

Create an account or register on the Platform
List items for sale, including descriptions, photographs, and pricing
Complete a purchase or initiate a transaction
Communicate with other users or with our customer support team
Participate in promotions, surveys, or contests
Submit identity verification documents
Update your account profile or preferences

3.2 Data Collected Automatically

When you access or use the Platform, we automatically collect certain information through technological means, including:

Server logs that record your IP address, browser type, referring/exit pages, operating system, date/time stamps, and clickstream data
Cookies and similar tracking technologies as described in Section 5
Analytics tools such as Google Analytics

3.3 Data from Third Parties

We may receive personal data about you from third-party sources, including:

Payment processors (transaction confirmation, chargeback notices)
Identity verification services (background checks, address verification)
Social media platforms (if you choose to link or log in via a social account)
Other users who may provide your information in connection with referrals, disputes, or reports

4. Purposes of Processing

We process your personal data for the following purposes:

4.1 Providing and Maintaining Services

Operating the Platform, including enabling listing, buying, and selling of second-hand goods
Processing transactions and facilitating payments between buyers and sellers
Verifying user identities and preventing fraudulent accounts
Displaying listings and enabling search and discovery features
Managing your account and providing personalized experiences

4.2 Facilitating Transactions

Processing payments, refunds, and chargebacks
Coordinating shipping and delivery logistics
Providing transaction receipts and confirmations
Managing escrow services, if applicable
Resolving disputes between buyers and sellers

4.3 Customer Support

Responding to inquiries, complaints, and support requests
Troubleshooting technical issues
Communicating service-related announcements and updates

4.4 Security and Fraud Prevention

Detecting, investigating, and preventing fraudulent, unauthorized, or illegal activity
Monitoring for violations of our Terms of Service
Implementing and maintaining security safeguards
Conducting risk assessments and identity verification

4.5 Marketing and Advertising

Sending promotional emails, and SMS messages (with your consent)
Personalizing advertisements and product recommendations
Conducting targeted advertising campaigns
Measuring the effectiveness of marketing efforts

4.6 Analytics and Improvement

Analyzing usage patterns to improve Platform features and functionality
Conducting A/B testing and user experience research
Generating aggregate, de-identified statistical reports
Developing new products, services, and features

4.7 Legal Compliance

Complying with applicable laws, regulations, and legal processes
Responding to lawful requests from government authorities and law enforcement
Enforcing our Terms of Service and other agreements
Establishing, exercising, or defending legal claims
Meeting tax reporting and record-keeping obligations

5. Cookies and Tracking Technologies

5.1 Types of Cookies Used

We use the following categories of cookies on the Platform:

Strictly Necessary Cookies: Essential for the operation of the Platform. These cookies enable core functionality such as security, account authentication, and session management. They cannot be disabled without impairing Platform functionality.
Performance and Analytics Cookies: Collect information about how you use the Platform, including pages visited, time spent, and error messages encountered. This data is used to improve Platform performance and user experience.
Functionality Cookies: Remember your preferences and settings, such as language, region, and display preferences, to provide a more personalized experience.
Targeting and Advertising Cookies: Track your browsing activity across websites to deliver personalized advertisements and measure advertising campaign effectiveness.

5.2 Analytics Tools

We may use the following analytics and tracking tools:

Google Analytics (with IP anonymization enabled)
Google Tag Manager for tag deployment management
Facebook Pixel for advertising measurement and retargeting

5.3 Managing Cookies

You may manage your cookie preferences through the following methods:

Browser settings: Most web browsers allow you to control cookies through their settings. You may block or delete cookies; however, doing so may affect Platform functionality.
Cookie consent banner: Upon your first visit, our cookie consent mechanism allows you to accept or reject non-essential cookies.
Opt-out links: You may opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on. You may opt out of interest-based advertising through the Digital Advertising Alliance (DAA) at optout.aboutads.info or the Network Advertising Initiative (NAI) at optout.networkadvertising.org.
Do Not Track: We honor Do Not Track (DNT) signals transmitted by your browser, where technically feasible.

6. How Data Is Shared

We do not sell your personal data to third parties for their independent marketing purposes, except as described in Section 12. We may share your personal data with the following categories of recipients:

6.1 Payment Processors

We share payment and transaction data with third-party payment processors (Stripe) to facilitate secure payment processing. These processors are contractually obligated to use your data only for the purpose of processing payments and are subject to PCI-DSS compliance requirements.

6.2 Shipping Carriers

When you purchase or sell items requiring physical delivery, we share your name, address, and contact information with shipping carriers (e.g., USPS, UPS, FedEx, local courier services in Puerto Rico) and our shipping-technology provider, Shippo, solely for the purpose of facilitating delivery.

6.3 Other Users

Certain information is shared with other users to facilitate transactions:

Sellers may see the buyer's shipping address and name to fulfill orders
Buyers may see the seller's general location, display name, and ratings
User profiles may display ratings, reviews, transaction history counts, and account age
Messages exchanged through the Platform's messaging system are visible to both parties

6.4 Service Providers

We engage third-party service providers who process personal data on our behalf, including:

Cloud hosting and infrastructure providers (e.g., AWS, Google Cloud) and our marketplace platform provider (Sharetribe)
Email service providers for transactional and marketing communications
Customer support tools and ticketing systems
Analytics and data visualization platforms
Identity verification and fraud detection services
Content moderation services

All service providers are bound by data processing agreements that restrict their use of personal data to the services they provide to us and require them to implement appropriate security measures.

6.5 Legal Disclosures

We may disclose your personal data when we believe in good faith that disclosure is necessary to:

Comply with applicable laws, regulations, legal processes, or enforceable governmental requests
Respond to valid subpoenas, court orders, or search warrants
Protect the rights, property, or safety of the Company, our users, or the public
Detect, prevent, or address fraud, security, or technical issues
Enforce our Terms of Service or other agreements

6.6 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, dissolution, or other corporate transaction involving all or a portion of our assets, your personal data may be among the assets transferred to the acquiring entity. We will provide notice before your personal data becomes subject to a different privacy policy and will require the acquiring entity to honor the commitments made in this Policy or obtain your fresh consent.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Policy, unless a longer retention period is required or permitted by law. Our retention practices are guided by the following principles:

Active Accounts: We retain your personal data for the duration of your account's active status and for a reasonable period thereafter to facilitate account reactivation and address any post-closure inquiries.
Transaction Records: We retain transaction records for a minimum of six (6) years from the date of the transaction to comply with tax, accounting, and legal obligations under Puerto Rico and federal law.
Communications: Messages and support communications are retained for three (3) years from the date of the communication for dispute resolution and quality assurance purposes.
Marketing Data: If you opt out of marketing communications, we retain your opt-out preference indefinitely to ensure continued compliance with your request.
Legal Obligations: Where required by law, regulation, or legal proceedings, we may retain data for longer periods as necessary.
Deletion Requests: Upon receipt of a valid deletion request, we will delete or de-identify your personal data within thirty (30) days, except to the extent retention is necessary for legal compliance, dispute resolution, or fraud prevention.

Upon expiration of the applicable retention period, personal data is securely deleted or irreversibly anonymized using industry-standard methods.

8. Data Security Measures

While we strive to protect your personal data, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security but commit to promptly addressing any confirmed security incident in accordance with Section 9 below and applicable law. If you have reason to believe that your account credentials have been compromised, please contact us immediately at [email protected].

9. Data Breach Notification

In the event of a security breach involving personal data, we will comply with the notification requirements of Puerto Rico Act No. 111 of 2005 ("Ley de Notificacion de Acceso No Autorizado a Informacion Personal", also known as the Citizen Information on Data Banks Security Act), as well as any other applicable federal or state breach notification laws.

9.1 Notification to Affected Individuals

If we determine that a security breach has resulted in, or is reasonably likely to result in, unauthorized access to your personal data, we will notify affected individuals without unreasonable delay. Notification will be provided by:

Written notice sent to the last known mailing address on file
Electronic notice sent to the email address associated with the affected account
Conspicuous posting on the Platform's website if substitute notice is permitted under the circumstances

9.2 Notification to Regulatory Authorities

We will notify the applicable regulatory authorities, including the Department of Consumer Affairs of Puerto Rico (DACO), without reasonable delay, where applicable and required by law.

10. Users' Rights and Choices

Subject to applicable law, you have the following rights regarding your personal data:

10.1 Right of Access

You have the right to request confirmation of whether we process your personal data and, if so, to obtain a copy of the personal data we hold about you in a structured, commonly used, and machine-readable format.

10.2 Right of Correction

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. You may also update certain information directly through your account settings.

10.3 Right of Deletion

You have the right to request the deletion of your personal data, subject to certain exceptions including legal obligations, ongoing transactions, dispute resolution, and fraud prevention. Upon a valid deletion request, we will delete or de-identify your data within thirty (30) days.

10.4 Right to Opt Out of Marketing

You may opt out of receiving marketing communications at any time by:

Clicking the "unsubscribe" link in any marketing email
Adjusting your communication preferences in your account settings
Contacting us at [email protected] with the subject line "Opt-Out Request"
Replying STOP to any SMS marketing message

Please note that even after opting out of marketing communications, you will continue to receive transactional and service-related communications (e.g., order confirmations, security alerts, policy updates).

10.5 Exercising Your Rights

To exercise any of the above rights, please submit a verifiable request to us at [email protected] or by mail to 103 C. Isabel Andreu de Aguilar San Juan, PR 00918, Attention: Data Protection Officer. We will respond to your request within thirty (30) days. We may require verification of your identity before processing your request, which may include providing your account email address, a government-issued ID, or answering security questions.

11. Children's Privacy

The Platform is intended solely for individuals who are eighteen (18) years of age or older. We do not knowingly collect, solicit, or maintain personal data from children under the age of thirteen (13), in compliance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. sections 6501-6506.

If we become aware that we have collected personal data from a child under the age of 13 without verified parental consent, we will take immediate steps to delete such information from our records. If you are a parent or guardian and believe that your child under 13 has provided personal data to us, please contact us immediately at [email protected].

The Platform is not directed to and may not be used by anyone under eighteen (18). We do not knowingly permit minors to register or transact, and we will terminate any Account we reasonably believe is operated by a person under eighteen (18) years of age.

12. California Residents (CCPA/CPRA)

This section applies solely to visitors and users who are residents of the State of California, as defined by the California Consumer Privacy Act of 2018 (Cal. Civ. Code sections 1798.100-1798.199.100), as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA").

12.1 Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which your personal information was collected, the business or commercial purposes for collecting or selling your personal information, and the categories of third parties with whom we share your personal information.

12.2 Right to Delete

You have the right to request that we delete the personal information we have collected about you, subject to certain exceptions provided by law (e.g., completing a transaction, detecting security incidents, complying with legal obligations).

12.3 Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

12.4 Right to Opt Out of Sale or Sharing

You have the right to direct us not to sell or share your personal information to third parties. While we do not sell personal information in the traditional sense, certain data sharing activities (e.g., sharing data with advertising partners for cross-context behavioral advertising) may constitute a "sale" or "sharing" under the CCPA/CPRA. To opt out, you may click the "Do Not Sell or Share My Personal Information" link on our website or contact us at [email protected].

12.5 Right to Limit Use of Sensitive Personal Information

To the extent we collect sensitive personal information as defined under the CPRA, you have the right to limit our use and disclosure of such information to purposes necessary to provide the Services.

12.6 Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge you different prices, provide a different level of quality, or suggest that you will receive different treatment for exercising your rights.

12.7 Authorized Agent

You may designate an authorized agent to submit requests on your behalf. We may require the authorized agent to provide proof of authorization (e.g., a signed written authorization or power of attorney) and may verify your identity directly.

12.8 Financial Incentives

We do not currently offer financial incentives related to the collection, sale, or deletion of personal information. If we offer such programs in the future, we will provide notice and obtain your opt-in consent.

13. GDPR Notice

This section applies to individuals located in the European Economic Area (EEA), the United Kingdom, or Switzerland who access or use our Platform (collectively, "EU Data Subjects"). If you are an EU Data Subject, the following provisions apply in addition to the rest of this Policy.

13.1 Data Controller

The data controller for your personal data is ISLAMODAPR LLC d/b/a VÉNA, located at 103 C. Isabel Andreu de Aguilar, San Juan, PR 00918. Our Data Protection Officer can be reached at [email protected].

13.2 Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 of the GDPR:

Contractual Necessity (Art. 6(1)(b)): Processing necessary for the performance of a contract to which you are a party, including providing the Platform and facilitating transactions.
Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate interests, including fraud prevention, security, analytics, and improving our services, provided such interests are not overridden by your fundamental rights.
Consent (Art. 6(1)(a)): Processing based on your freely given, specific, informed, and unambiguous consent, including for marketing communications and non-essential cookies.
Legal Obligation (Art. 6(1)(c)): Processing necessary for compliance with a legal obligation to which we are subject.

13.3 Your Rights Under GDPR

In addition to the rights described in Section 10, EU Data Subjects have the following rights:

Right to data portability (Art. 20) - receive your data in a structured, commonly used, machine-readable format
Right to restriction of processing (Art. 18) - limit processing in certain circumstances
Right to object to processing (Art. 21) - object to processing based on legitimate interests, including profiling
Right not to be subject to automated decision-making (Art. 22) - not be subject to decisions based solely on automated processing that produce legal or similarly significant effects
Right to lodge a complaint with a supervisory authority in your country of residence

13.4 International Data Transfers

Your personal data will be transferred to and processed in the United States (Puerto Rico). We ensure appropriate safeguards for international transfers through:

Standard Contractual Clauses (SCCs) approved by the European Commission
Data processing agreements with all third-party processors
Technical and organizational measures to ensure data protection

You may request a copy of the applicable transfer mechanism by contacting [email protected].

14. International and Mainland U.S. Data Transfers

The Platform is operated from the Commonwealth of Puerto Rico, a territory of the United States. If you access the Platform from outside Puerto Rico, including from the mainland United States or international jurisdictions, you acknowledge and consent to the transfer, storage, and processing of your personal data in Puerto Rico and, where applicable, in data center locations maintained by our service providers in the continental United States.

Puerto Rico is subject to the federal laws of the United States regarding data protection, including the Federal Trade Commission Act and sector-specific privacy statutes. Additionally, Puerto Rico's own data protection regime, including Act No. 111 of 2005, provides additional protections for personal data.

For data transferred from jurisdictions with data protection laws that restrict international data transfers (including the EEA, UK, Switzerland, and certain Latin American countries), we implement appropriate safeguards including:

Standard Contractual Clauses (SCCs) as applicable
Data processing agreements with service providers requiring equivalent levels of protection
Encryption of data in transit and at rest
Access controls limiting data access to authorized personnel
Regular assessments of the legal framework in the receiving jurisdiction

By using the Platform, you consent to the transfer of your personal data to Puerto Rico and the United States as described herein.

15. Third-Party Links Disclaimer

The Platform may contain links to third-party websites, applications, or services that are not owned or controlled by the Company. These third-party resources may include, but are not limited to, payment processing sites, social media platforms, advertising networks, and external marketplaces.

We are not responsible for the privacy practices, content, or security of any third-party websites or services. The inclusion of a link on the Platform does not imply endorsement of the linked site or any association with its operators. We encourage you to review the privacy policies of any third party website or service before providing your personal data.

Specifically, we disclaim all liability for:

The collection or use of your personal data by third parties after you leave the Platform
The security measures implemented by third-party sites
Any content, products, or services offered by third parties
Any damages or losses arising from your interaction with third-party websites or services

16. Marketing Communications and Opt-Out

We may send you marketing communications regarding our products, services, promotions, and events that we believe may be of interest to you. All marketing communications are conducted in compliance with the CAN-SPAM Act (15 U.S.C. section 7701 et seq.) and applicable Puerto Rico consumer protection regulations.

16.1 CAN-SPAM Compliance

All commercial electronic messages sent by us will:

Clearly identify the message as an advertisement or solicitation, where required
Include our valid physical postal address: 103 C. Isabel Andreu de Aguilar San Juan, PR 00918
Include a clear and conspicuous mechanism to opt out of future commercial messages
Honor opt-out requests within ten (10) business days
Not use deceptive subject lines or misleading header information
Not use harvested email addresses or automated means to register for accounts to send commercial messages

16.2 Types of Communications

We distinguish between the following categories of communications:

Transactional Messages: Communications directly related to your use of the Platform (e.g., order confirmations, shipping notifications, account alerts). These are not marketing and cannot be opted out of while you maintain an active account.
Marketing Messages: Promotional communications about products, services, deals, or events. You may opt out of these at any time.
Service Announcements: Important notices about changes to the Platform, this Policy, or our Terms of Service. These are considered necessary communications and may not be subject to opt-out.

16.3 Opt-Out Procedures

You may opt out of marketing communications through any of the following methods:

Email: Click the "Unsubscribe" link in any marketing email
SMS: Reply STOP to any marketing text message
Account Settings: Navigate to Settings > Communication Preferences and deselect marketing categories
Contact: Email [email protected] with subject line "Marketing Opt-Out"

We will process your opt-out request within ten (10) business days. During this processing period, you may still receive previously scheduled communications.

17. Changes to This Policy

We reserve the right to modify, amend, or update this Privacy Policy at any time in our sole discretion. When we make material changes to this Policy, we will:

Update the "Last Updated" date at the top of this Policy
Provide notice through a prominent banner or notification on the Platform for at least thirty (30) days
Send an email notification to registered users at their primary email address on file
Where required by law, obtain your renewed consent before applying changes that materially affect the processing of your personal data

Your continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you must discontinue use of the Platform and may request deletion of your account and personal data. We encourage you to review this Policy periodically to stay informed about our data practices. Prior versions of this Policy will be made available upon request by contacting [email protected].

18. Contact Information / How to Exercise Rights

If you have questions, concerns, or complaints regarding this Privacy Policy or our data practices, or if you wish to exercise any of your rights as described herein, please contact us through any of the following methods:

General Privacy Inquiries:

Email: [email protected]
Mail: VÉNA, 103 C. Isabel Andreu de Aguilar, San Juan, Puerto Rico 00918
Website: https://joinvena.com

This Privacy Policy is effective as of July 7, 2026
ISLAMODAPR LLC | 103 C. Isabel Andreu de Aguilar San Juan, PR 00918 | https://joinvena.com