diff --git a/README.md b/README.md
index 0f2dfde..14d16a5 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,8 @@ This README aims to document functionality of backend as well as required steps
 
 - [First Steps](#first-steps)
 - [Location Data](#location-data)
+- [Endpoints](#endpoints)
+- [Data Load](#data-load)
 
 ## First Steps
 
@@ -34,3 +36,133 @@ python manage.py migrate
 ## Location data
 
 To load initial location data use: `python manage.py addgeo`
+
+
+## Endpoints
+
+
+### User Management
+
+Creation:
+- endpoint: /api/v1/users/
+- method: GET
+- payload:
+```json
+{
+  "email": "test@email.com",
+  "full_name": "TEST NAME",
+  "password": "VENTILADOR2ES1234499.89",
+}
+```
+
+Change password:
+- endpoint: api/v1/user/change_password/{user.pk}/
+- method: POST
+- payload:
+```json
+{
+  "old_password": "my_old_password",
+  "password": "SUPERSECRETNEWPASSWORD",
+  "password2": "SUPERSECRETNEWPASSWORD"
+}
+```
+
+Update user profile:
+- endpoint: api/v1/user/update/<int:pk>/
+- method: PUT
+- payload:
+```json
+{
+  "email": "new_user@email.com",
+  "full_name": "Mr. TEST NAME",
+}
+```
+
+
+### Authentication
+
+Implemented using `djangorestframework-simplejwt`
+
+
+New token pair endpoint: `/api/v1/token/`
+
+Response:
+```json
+{
+    "refresh": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0b2tlbl90eXBlIjoicmVmcmVzaCIsImV4cCI6MTYxMjI3MTcwNSwianRpIjoiZDU4YTgzYzFkYzFkNDI5MTljMGQ0NzcxNzljNzUxYTQiLCJ1c2VyX2lkIjo4fQ.yln80W5lONSyHwwqF4qBBHteqLuRfdLLWuaQANr_vxc",
+    "access": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0b2tlbl90eXBlIjoiYWNjZXNzIiwiZXhwIjoxNjEyMTg4OTA1LCJqdGkiOiIzNGIxMzM3NmU4MWI0OWY5YjU3ZmUxM2M5NThmZWZkYiIsInVzZXJfaWQiOjh9.aRDCUvKj7LCvixjPLC9ghy0h7rfRwR6Lo3A7HX4kSHE"
+}
+```
+Refresh expired token endpoint: `/api/v1/token/refresh/`
+
+
+### Users
+
+Endpoint url: `/api/v1/users/`
+
+Authenticated users cannot create new users
+User are inactive by default
+
+To create user:
+```json
+{
+    "email": "test_user23@mail.com",
+    "full_name": "Mr Test User",
+    "password": "wqertewqr32qrewqr",
+    "provider": "TWITTER"
+}
+```
+
+
+### Companies
+
+Endpoint url: `/api/v1/companies/`
+
+### Products
+
+Endpoint url: `/api/v1/products/`
+
+
+### History
+
+Endpoint url: `/api/v1/history/`:
+
+Historical records about product importation
+
+
+### Stats
+Endpoint url: `/api/v1/stats/`
+
+logs about user interaction with products links
+
+
+### Geo location
+
+Location ednpoints:
+
+- `/api/v1/countries/`
+- `/api/v1/regions/`
+- `/api/v1/provinces/`
+- `/api/v1/cities/`
+
+
+## Load Data
+
+
+### COOP and Managing User Data Load
+
+For massive load of data from COOPs and the managing user.
+
+CSV headers: `email,cif,nombre-coop,nombre-corto,url,es-tienda`
+
+Only admin users have access to endoint
+
+### Product Data Load
+
+Endpoint: `/api/v1/load_products/`
+
+For massive load of product data.
+
+CSV headers: `id,nombre-producto,descripcion,imagen,url,precio,gastos-envio,cond-envio,descuento,stock,tags,categoria,identificadores`
+
+Only admin users have access to endoint
diff --git a/back_latienda/permissions.py b/back_latienda/permissions.py
index 095d56e..60f46e8 100644
--- a/back_latienda/permissions.py
+++ b/back_latienda/permissions.py
@@ -52,3 +52,15 @@ class CustomUserPermissions(permissions.BasePermission):
 
         # for everything else
         return False
+
+
+class YourOwnUserPermissions(permissions.BasePermission):
+
+    def has_object_permission(self, request, view, obj):
+        # user can interact with own instance of CustomUser
+        if obj.email == request.user.email:
+            return True
+        elif request.user.is_staff is True:
+            return True
+        else:
+            return False
diff --git a/back_latienda/settings/base.py b/back_latienda/settings/base.py
index ff94f1e..3eaa173 100644
--- a/back_latienda/settings/base.py
+++ b/back_latienda/settings/base.py
@@ -33,18 +33,22 @@ SECRET_KEY = 'td*#7t-(1e9^(g0cod*hs**dp(%zvg@=$cug_-dtzcj#i2mrz@'
 # Application definition
 
 INSTALLED_APPS = [
+    'suit',
+
     'django.contrib.admin',
     'django.contrib.auth',
     'django.contrib.contenttypes',
     'django.contrib.sessions',
     'django.contrib.messages',
     'django.contrib.staticfiles',
+    'django.contrib.gis',
 
     # 3rd party
     'rest_framework',
     'django_filters',
     'corsheaders',
     'taggit_serializer',
+    'tagulous',
 
     # local apps
     'core',
diff --git a/back_latienda/urls.py b/back_latienda/urls.py
index 5767a16..5541f26 100644
--- a/back_latienda/urls.py
+++ b/back_latienda/urls.py
@@ -20,6 +20,8 @@ from django.conf import settings
 
 from rest_framework_simplejwt.views import TokenObtainPairView, TokenRefreshView, TokenVerifyView
 
+from core import views as core_views
+from products import views as product_views
 from .routers import router
 
 
@@ -28,5 +30,9 @@ urlpatterns = [
     path('api/v1/token/', TokenObtainPairView.as_view(), name='token_obtain_pair'),
     path('api/v1/token/refresh/', TokenRefreshView.as_view(), name='token_refresh'),
     path('api/v1/token/verify/', TokenVerifyView.as_view(), name='token_verify'),
+    path('api/v1/user/change_password/<int:pk>/', core_views.ChangeUserPasswordView.as_view(), name="change-password"),
+    path('api/v1/user/update/<int:pk>/', core_views.UpdateUserView.as_view(), name="update-user"),
+    path('api/v1/load_coops/', core_views.load_coop_managers, name='coop-loader'),
+    path('api/v1/load_products/', product_views.load_coop_products, name='product-loader'),
     path('api/v1/', include(router.urls)),
 ] + static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)
diff --git a/companies/factories.py b/companies/factories.py
index 4fd8e80..01880cc 100644
--- a/companies/factories.py
+++ b/companies/factories.py
@@ -11,9 +11,9 @@ class CompanyFactory(DjangoModelFactory):
     cif = FuzzyText(prefix='CIF_', length=10)
     company_name = FuzzyText(prefix='COMPANY_NAME_', length=10)
     short_name = FuzzyText(prefix='SHORT_NAME_', length=10)
-    web_link = FuzzyText(prefix='http://WEB_LINK_', suffix='.test', length=10)
+    web_link = FuzzyText(prefix='http://WEB-LINK-', suffix='.test', length=10)
     shop = FuzzyChoice(choices=(True, False))
-    shop_link = FuzzyText(prefix='http://SHOP_LINK_', suffix='.test', length=10)
+    shop_link = FuzzyText(prefix='http://SHOP-LINK-', suffix='.test', length=10)
     platform = FuzzyChoice(choices=[x[1] for x in Company.PLATFORMS])
     email = FuzzyText(prefix='EMAIL_', suffix='@test.com', length=10)
     logo = None
@@ -24,10 +24,10 @@ class CompanyFactory(DjangoModelFactory):
     mobile = '+34666555333'
     other_phone = '+34666555222'
     description = FuzzyText(prefix='DESCRIPTION_', length=250)
-    shop_rss_feed = FuzzyText(prefix='http://SHOP_RSS_FEED_', suffix='.test', length=10)
+    shop_rss_feed = FuzzyText(prefix='http://SHOP-RSS-FEED-', suffix='.test', length=10)
     sale_terms = FuzzyText(prefix='SALES_TERMS', length=250)
     shipping_cost = FuzzyDecimal(low=1.00)
-    # tags = models.ManyToMany(Tag, null=True)
+    tags = ['cool', 'hip', 'tech/blockchain']
     sync = FuzzyChoice(choices=(True, False))
 
     class Meta:
diff --git a/companies/models.py b/companies/models.py
index efb67c0..3fb2ab7 100644
--- a/companies/models.py
+++ b/companies/models.py
@@ -1,6 +1,8 @@
 # from django.db import models
 from django.contrib.gis.db import models
 
+from tagulous.models import TagField
+
 # Create your models here.
 
 class Company(models.Model):
@@ -34,10 +36,19 @@ class Company(models.Model):
     shop_rss_feed = models.URLField('RSS tienda online', null=True, blank=True)
     sale_terms = models.TextField('Condiciones de venta', null=True, blank=True)
     shipping_cost = models.DecimalField('Gastos de envío', max_digits=10, decimal_places=2, null=True, blank=True)
-    # tags = models.ManyToMany(Tag, null=True)
+    tags = TagField(force_lowercase=True,max_count=5, tree=True)
     sync = models.BooleanField('Sincronizar tienda', default=False, null=True, blank=True)
+    is_validated = models.BooleanField('Validado', default=False, null=True, blank=True)
+    is_active = models.BooleanField('Activado', default=False, null=True, blank=True)
 
     # internal
     created = models.DateTimeField('date of creation', auto_now_add=True)
     updated = models.DateTimeField('date last update', auto_now=True)
-    creator = models.ForeignKey('core.CustomUser', on_delete=models.DO_NOTHING, null=True, related_name='company')
\ No newline at end of file
+    creator = models.ForeignKey('core.CustomUser', on_delete=models.DO_NOTHING, null=True, related_name='creator')
+
+    def __str__(self):
+        return self.company_name
+
+    class Meta:
+        verbose_name = "Compañía"
+        verbose_name_plural = "Compañías"
diff --git a/companies/serializers.py b/companies/serializers.py
index f3254d0..9ff7fa8 100644
--- a/companies/serializers.py
+++ b/companies/serializers.py
@@ -1,8 +1,12 @@
 from rest_framework import serializers
 from companies.models import Company
 
+from utils.tag_serializers import TagListSerializerField, TaggitSerializer
 
-class CompanySerializer(serializers.ModelSerializer):
-      class Meta:
-          model = Company
-          exclude = ['created', 'updated', 'creator']
+class CompanySerializer(TaggitSerializer, serializers.ModelSerializer):
+
+    tags = TagListSerializerField(required=False)
+
+    class Meta:
+        model = Company
+        exclude = ['created', 'updated', 'creator']
diff --git a/companies/tests.py b/companies/tests.py
index 9a4a264..41750b0 100644
--- a/companies/tests.py
+++ b/companies/tests.py
@@ -27,7 +27,7 @@ class CompanyViewSetTest(APITestCase):
         self.model = Company
         # create user
         self.password = ''.join(random.choices(string.ascii_uppercase, k = 10))
-        self.user = CustomUserFactory(password=self.password)
+        self.user = CustomUserFactory(email="test@mail.com", password=self.password, is_active=True)
 
     # user not authenticated
     def test_not_logged_user_cannot_create_instance(self):
diff --git a/core/admin.py b/core/admin.py
index 8c38f3f..e6daebe 100644
--- a/core/admin.py
+++ b/core/admin.py
@@ -1,3 +1,6 @@
 from django.contrib import admin
 
+from . import models
 # Register your models here.
+
+admin.site.register(models.CustomUser)
diff --git a/core/factories.py b/core/factories.py
index b5506e2..6422f08 100644
--- a/core/factories.py
+++ b/core/factories.py
@@ -5,12 +5,13 @@ from factory import LazyAttribute, SubFactory
 from factory.fuzzy import FuzzyText, FuzzyChoice, FuzzyDateTime, FuzzyDate, FuzzyDecimal
 from factory.django import DjangoModelFactory
 
+ROLES = ('SHOP_USER', 'COOP_MANAGER')
 
 class CustomUserFactory(DjangoModelFactory):
 
     email = FuzzyText(length=6, suffix="@mail.com")
     full_name = FuzzyText(length=15, prefix="TestName_")
-    role = FuzzyText(length=15, prefix="TestPosition_")
+    role = FuzzyChoice(ROLES)
     notify = FuzzyChoice(choices=(True, False))
     provider = FuzzyText(length=15, prefix="TestProvider_")
     email_verified = True
diff --git a/core/management/commands/addgeo.py b/core/management/commands/addgeo.py
index 6d47e05..4f9f92b 100644
--- a/core/management/commands/addgeo.py
+++ b/core/management/commands/addgeo.py
@@ -26,12 +26,12 @@ class Command(BaseCommand):
         # create country for spain
         country = Country.objects.create(name='España')
 
-        locations_file = 'locations.json'
+        locations_file = 'datasets/locations.json'
         locations = json.loads(open(locations_file).read())
 
         # REGIONS
 
-        geo_file='gadm36_ESP.json'    # geo boundary data for regions
+        geo_file='datasets/gadm36_ESP.json'    # geo boundary data for regions
         geo_data = json.loads(open(geo_file).read())
 
         logging.info("Starting Region creation")
diff --git a/core/management/commands/addtestdata.py b/core/management/commands/addtestdata.py
new file mode 100644
index 0000000..25d93b8
--- /dev/null
+++ b/core/management/commands/addtestdata.py
@@ -0,0 +1,70 @@
+import logging
+import json
+
+import requests
+
+from django.core.management.base import BaseCommand
+from django.contrib.gis.geos import GEOSGeometry, MultiPolygon
+
+from faker import Faker
+
+from companies.factories import CompanyFactory
+from products.factories import ProductFactory
+
+
+logging.basicConfig(
+    filename='logs/addtestdata.log',
+    filemode='w',
+    format='%(levelname)s:%(message)s',
+    level=logging.INFO,
+    )
+
+class Command(BaseCommand):
+
+    logo_url = "https://picsum.photos/200/300"
+
+    def handle(self, *args, **kwargs):
+        print("Creating fake data to populate database")
+
+
+        # start faker
+        fake = Faker()
+        Faker.seed(0)
+
+        # companies created
+        new_companies = []
+        logging.info("Creating fake companies")
+        print("Creating fake companies")
+        for i in range(10):
+            name = f"{fake.company()} {fake.company_suffix()}"
+            company = CompanyFactory(company_name=name)
+            new_companies.append(company)
+            logging.debug(f"New Company {company.company_name} created")
+            print(".", end = '')
+        print('')
+
+        logging.info("Creating fake products")
+        print("Creating fake products")
+        # create and assign products to companies
+        for company in new_companies:
+            logging.info(f"Products for {company.company_name}")
+            for i in range(100):
+                name = fake.last_name_nonbinary()
+                description = fake.paragraph(nb_sentences=5)
+                # TODO: apply tags from tag list
+
+                """
+                # TODO: add dynamic image to product
+                response = requests.get(self.logo_url)
+                if response.status_code == 200:
+                    response.raw.decode_content = True
+                    image = response.raw
+                else:
+                    image= None
+                """
+                product = ProductFactory(name=name, description=description,)
+                logging.debug(f"New Product {product.name} created")
+                print(".", end = '')
+            print('')
+
+        print("Dataset creation finished")
\ No newline at end of file
diff --git a/core/models.py b/core/models.py
index e5f9b61..6f4da0b 100644
--- a/core/models.py
+++ b/core/models.py
@@ -2,6 +2,7 @@ from django.db import models
 from django.contrib.auth.base_user import AbstractBaseUser, BaseUserManager
 from django.contrib.auth.models import PermissionsMixin
 
+from companies.models import Company
 
 # Create your models here.
 class UserManager(BaseUserManager):
@@ -36,13 +37,23 @@ class UserManager(BaseUserManager):
 
 class CustomUser(AbstractBaseUser, PermissionsMixin):
 
+    SHOP_USER = 'SHOP_USER'
+    COOP_MANAGER = 'COOP_MANAGER'
+    SITE_ADMIN = 'SITE_ADMIN'
+
+    ROLES = (
+        (SHOP_USER, 'Shop User'),
+        (COOP_MANAGER, 'Coop Manager'),
+        (SITE_ADMIN, 'Site Admin'),
+    )
+
     email = models.EmailField('Dirección de email', unique=True)
     full_name = models.CharField('Nombre completo', max_length=100, blank=True)
-    role = models.CharField('Rol', max_length=100, blank=True, null=True)
+    role = models.CharField('Rol', choices=ROLES, default=SHOP_USER, max_length=100, blank=True, null=True)
     notify = models.BooleanField('Notificar', default=False, null=True)
     provider = models.CharField('Proveedor', max_length=1000, blank=True, null=True) # red social de registro
     email_verified = models.BooleanField('Email verificado', default=False, null=True)
-    company = None # models.ForeignKey(Empresa, null=True, on_delete=models.DO_NOTHING)
+    company = models.ForeignKey(Company, null=True, on_delete=models.DO_NOTHING, related_name='custom_user')
 
     is_active = models.BooleanField('Activo', default=True)
     is_staff = models.BooleanField('Empleado',default=False )
diff --git a/core/serializers.py b/core/serializers.py
index 83b7f60..c60a2ab 100644
--- a/core/serializers.py
+++ b/core/serializers.py
@@ -10,8 +10,73 @@ class CustomUserSerializer(serializers.ModelSerializer):
         fields = ('email', 'full_name', 'role', 'is_active')
 
 
+class CustomUserReadSerializer(serializers.ModelSerializer):
+
+    class Meta:
+        model = models.CustomUser
+        fields = ('id', 'email', 'full_name', 'role', 'is_active', 'provider', 'notify')
+
+
+class CustomUserWriteSerializer(serializers.ModelSerializer):
+
+    class Meta:
+        model = models.CustomUser
+        fields = ('email', 'full_name', 'role', 'password', 'provider')
+
 class CreatorSerializer(serializers.ModelSerializer):
 
     class Meta:
         model = models.CustomUser
         fields = ('email',)
+
+
+class ChangePasswordSerializer(serializers.ModelSerializer):
+    password = serializers.CharField(write_only=True, required=True)
+    password2 = serializers.CharField(write_only=True, required=True)
+    old_password = serializers.CharField(write_only=True, required=True)
+
+    class Meta:
+        model = models.CustomUser
+        fields = ('old_password', 'password', 'password2')
+
+    def validate(self, attrs):
+        if attrs['password'] != attrs['password2']:
+            raise serializers.ValidationError({"password": "Password fields didn't match."})
+
+        return attrs
+
+    def validate_old_password(self, value):
+        user = self.context['request'].user
+        if not user.check_password(value):
+            raise serializers.ValidationError({"old_password": "Old password is not correct"})
+        return value
+
+    def update(self, instance, validated_data):
+
+        instance.set_password(validated_data['password'])
+        instance.save()
+
+        return instance
+
+
+class UpdateUserSerializer(serializers.ModelSerializer):
+    email = serializers.EmailField(required=True)
+
+    class Meta:
+        model = models.CustomUser
+        fields = ('full_name', 'email')
+
+    def validate_email(self, value):
+        user = self.context['request'].user
+        if models.CustomUser.objects.exclude(pk=user.pk).filter(email=value).exists():
+            raise serializers.ValidationError({"email": "This email is already in use."})
+        return value
+
+    def update(self, instance, validated_data):
+        for key, value in validated_data.items():
+            instance.__dict__[key] = value
+
+        instance.save()
+
+        return instance
+
diff --git a/core/tests.py b/core/tests.py
index 6765222..9ce297c 100644
--- a/core/tests.py
+++ b/core/tests.py
@@ -1,6 +1,9 @@
 import random
 import string
 import json
+import hashlib
+import base64
+import csv
 
 from django.test import TestCase
 
@@ -9,6 +12,8 @@ from rest_framework import status
 
 from core.utils import get_tokens_for_user
 
+from companies.models import Company
+
 from . import models
 from . import factories
 # Create your tests here.
@@ -33,15 +38,14 @@ class CustomUserViewSetTest(APITestCase):
         self.user = self.factory(email=self.reg_email, password=self.password, is_active=True)
 
     # anon user
-    def test_anon_user_can_create_inactive_instance(self):
+    def test_anon_user_can_create_active_instance(self):
         """Not logged-in user can create new instance of User but it's inactive
             TODO: should create inactive user
         """
         data = {
             'email': 'test@email.com',
             'full_name': 'TEST NAME',
-            'password1': 'VENTILADORES1234499.89',
-            'password2': 'VENTILADORES1234499.89',
+            'password': 'VENTILADORES1234499.89',
         }
 
         # Query endpoint
@@ -51,7 +55,7 @@ class CustomUserViewSetTest(APITestCase):
         self.assertEqual(response.status_code, status.HTTP_201_CREATED)
         # assert instance is inactive
         info = json.loads(response.content)
-        self.assertFalse(info['is_active'])
+        self.assertTrue(info['is_active'])
 
     def test_anon_user_cannot_modify_existing_instance(self):
         """Not logged-in user cannot modify existing instance
@@ -163,8 +167,7 @@ class CustomUserViewSetTest(APITestCase):
         data = {
             'email': 'test@email.com',
             'full_name': 'TEST NAME',
-            'password1': 'VENTILADORES1234499.89',
-            'password2': 'VENTILADORES1234499.89',
+            'password': 'VENTILADORES1234499.89',
         }
 
         # Authenticate user
@@ -193,7 +196,8 @@ class CustomUserViewSetTest(APITestCase):
         # Define request data
         data = {
             'email': 'test_alt@email.com',
-            'full_name': 'TEST NAME ALT'
+            'full_name': 'TEST NAME ALT',
+            'notify': True,
         }
 
         # Authenticate user
@@ -233,3 +237,226 @@ class CustomUserViewSetTest(APITestCase):
         self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT)
         # Assert instance doesn't exists anymore on db
         self.assertFalse(self.model.objects.filter(id=instance.pk).exists())
+
+
+class ChangeUserPasswordViewTest(APITestCase):
+
+    def setUp(self):
+        """Tests setup
+        """
+        self.endpoint = '/api/v1/user/update/'
+        self.factory = factories.CustomUserFactory
+        self.model = models.CustomUser
+        # create regular user
+        self.reg_email = f"user@mail.com"
+        self.password = ''.join(random.choices(string.ascii_uppercase, k = 10))
+        self.user = self.factory(email=self.reg_email, is_active=True)
+        self.user.set_password(self.password)
+        self.user.save()
+
+    def test_fail_different_passwords(self):
+        # Create instance
+        data = {
+            "old_password": self.password,
+            "password": "!!!",
+            "password2": "SUPERSECRETNEWPASSWORD",
+        }
+
+        # Authenticate
+        token = get_tokens_for_user(self.user)
+        self.client.credentials(HTTP_AUTHORIZATION=f"Bearer {token['access']}")
+
+        # Query endpoint
+        url = f'/api/v1/user/change_password/{self.user.pk}/'
+        response = self.client.put(url, data=data, format='json')
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+
+    def test_fail_wrong_old_password(self):
+        # Create instance
+        data = {
+            "old_password": 'WRONG!!!!',
+            "password": 'SUPERSECRETNEWPASSWORD',
+            "password2": "SUPERSECRETNEWPASSWORD",
+        }
+
+        # Authenticate
+        token = get_tokens_for_user(self.user)
+        self.client.credentials(HTTP_AUTHORIZATION=f"Bearer {token['access']}")
+
+        # Query endpoint
+        url = f'/api/v1/user/change_password/{self.user.pk}/'
+        response = self.client.put(url, data=data, format='json')
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+
+
+    def test_auth_user_can_modify_own_password(self):
+        """authenticated user can modify own password
+        """
+        data = {
+            "old_password": self.password,
+            "password": "SUPERSECRETNEWPASSWORD",
+            "password2": "SUPERSECRETNEWPASSWORD",
+        }
+
+        # Authenticate
+        token = get_tokens_for_user(self.user)
+        self.client.credentials(HTTP_AUTHORIZATION=f"Bearer {token['access']}")
+
+        # Query endpoint
+        url = f'/api/v1/user/change_password/{self.user.pk}/'
+        response = self.client.put(url, data=data, format='json')
+        # Assert forbidden code
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+        # assert new password hash properly updated
+        # assert fields exist, and data matches
+        updated_user = self.model.objects.get(pk=self.user.id)
+        stored_value = updated_user.__dict__['password']
+        hash_type, iteration, salt, stored_password_hash = stored_value.split('$')
+        new_password_hash = hashlib.pbkdf2_hmac(
+                hash_name='sha256',
+                password=data['password'].encode(),
+                salt=salt.encode(),
+                iterations=int(iteration),
+                )
+        self.assertEqual(stored_password_hash, base64.b64encode(new_password_hash).decode())
+
+
+class UpdateUserViewTest(APITestCase):
+
+    def setUp(self):
+        """Tests setup
+        """
+        self.endpoint = '/api/v1/user/change_password/'
+        self.factory = factories.CustomUserFactory
+        self.model = models.CustomUser
+        # create regular user
+        self.reg_email = f"user@mail.com"
+        self.password = ''.join(random.choices(string.ascii_uppercase, k = 10))
+        self.user = self.factory(email=self.reg_email, is_active=True)
+        self.user.set_password(self.password)
+        self.user.save()
+
+    def test_auth_user_can_modify_own_instance(self):
+        """Regular user can modify own instance
+        """
+        # Create instance
+        data = {
+            "email": "new_email@mail.com",
+            "full_name": "New Full Name",
+            'provider': 'PROVIDER',
+            'notify': True,
+        }
+
+        # Authenticate
+        token = get_tokens_for_user(self.user)
+        self.client.credentials(HTTP_AUTHORIZATION=f"Bearer {token['access']}")
+
+        # Query endpoint
+        url = f'/api/v1/user/update/{self.user.pk}/'
+        response = self.client.put(url, data=data, format='json')
+        # Assert forbidden code
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+    def test_auth_user_cannot_modify_random_instance(self):
+        """Regular user can modify own instance
+        """
+        # Create instance
+        instance = self.factory()
+        data = {
+            "email": "new_email@mail.com",
+            "full_name": "New Full Name",
+            'provider': 'PROVIDER',
+        }
+
+        # Authenticate
+        token = get_tokens_for_user(self.user)
+        self.client.credentials(HTTP_AUTHORIZATION=f"Bearer {token['access']}")
+
+        # Query endpoint
+        url = f'/api/v1/user/update/{instance.pk}/'
+        response = self.client.put(url, data=data, format='json')
+        # Assert forbidden code
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+
+class LoadCoopManagerTestCase(APITestCase):
+
+    def setUp(self):
+        """Tests setup
+        """
+        self.endpoint = '/api/v1/load_coops/'
+        self.user_factory = factories.CustomUserFactory
+        self.user_model = models.CustomUser
+        self.company_model = Company
+        # create admin user
+        self.admin_email = f"admin_user@mail.com"
+        self.password = ''.join(random.choices(string.ascii_uppercase, k = 10))
+        self.admin_user = self.user_factory(email=self.admin_email, password=self.password, is_staff=True, is_active=True)
+        # create regular user
+        self.reg_email = f"user@mail.com"
+        self.user = self.user_factory(email=self.reg_email, is_active=True)
+        self.user.set_password(self.password)
+        self.user.save()
+        # test CSV file path
+        self.csv_path = 'datasets/test_coop.csv'
+
+    def test_admin_can_load_csv(self):
+        # count existing instances
+        company_count = self.company_model.objects.count()
+        user_count = self.user_model.objects.count()
+
+        # read csv file
+        files = {'csv_file': open(self.csv_path,'rt')}
+
+        # Authenticate
+        token = get_tokens_for_user(self.admin_user)
+        self.client.credentials(HTTP_AUTHORIZATION=f"Bearer {token['access']}")
+
+        # send in request
+        response = self.client.post(self.endpoint, files)
+
+        # check re sponse
+        self.assertEqual(response.status_code, 200)
+        # check for object creation
+        self.assertEquals(company_count + 5, self.company_model.objects.count())
+        self.assertEquals(user_count + 5, self.user_model.objects.count())
+
+    def test_auth_user_cannot_load_csv(self):
+        company_count = self.company_model.objects.count()
+        user_count = self.user_model.objects.count()
+
+        # read csv file
+        files = {'csv_file': open(self.csv_path,'r')}
+
+        # Authenticate
+        token = get_tokens_for_user(self.user)
+        self.client.credentials(HTTP_AUTHORIZATION=f"Bearer {token['access']}")
+
+        # send in request
+        response = self.client.post(self.endpoint, files)
+
+        # check response
+        self.assertEqual(response.status_code, 403)
+        # check for object creation
+        self.assertEqual(company_count, self.company_model.objects.count())
+        self.assertEqual(user_count, self.user_model.objects.count())
+
+    def test_anon_user_cannot_load_csv(self):
+        company_count = self.company_model.objects.count()
+        user_count = self.user_model.objects.count()
+
+        # read csv file
+        files = {'csv_file': open(self.csv_path,'r')}
+
+        # send in request
+        response = self.client.post(self.endpoint, files)
+
+        # check response
+        self.assertEqual(response.status_code, 401)
+        # check for object creation
+        self.assertEqual(company_count, self.company_model.objects.count())
+        self.assertEqual(user_count, self.user_model.objects.count())
+
diff --git a/core/views.py b/core/views.py
index 3588a04..6c99566 100644
--- a/core/views.py
+++ b/core/views.py
@@ -1,21 +1,132 @@
+import csv
+import logging
+import json
+import io
+
 from django.shortcuts import render
 from django.http import HttpResponse
+from django.contrib.auth import get_user_model
 
 from rest_framework import status
 from rest_framework import viewsets
 from rest_framework.response import Response
 from rest_framework.permissions import IsAdminUser
+from rest_framework.generics import UpdateAPIView
+from rest_framework.decorators import api_view, permission_classes
+
+from companies.models import Company
 
 from . import models
 from . import serializers
 
-from back_latienda.permissions import CustomUserPermissions
+from back_latienda.permissions import CustomUserPermissions, YourOwnUserPermissions
+
+
+User = get_user_model()
+
 # Create your views here.
 
+logging.basicConfig(
+    filename='logs/csv-load.log',
+    filemode='w',
+    format='%(levelname)s:%(message)s',
+    level=logging.INFO,
+    )
+
+
 class CustomUserViewSet(viewsets.ModelViewSet):
 
     model = models.CustomUser
-    serializer_class = serializers.CustomUserSerializer
+    # serializer_class = serializers.CustomUserSerializer
+    serializer_class = serializers.CustomUserReadSerializer
+    write_serializer_class =serializers.CustomUserWriteSerializer
     model_name = 'custom_user'
     queryset = models.CustomUser.objects.all()
     permission_classes = [CustomUserPermissions,]
+
+    def create(self, request):
+        """
+        Create Instance
+        """
+        try:
+            serializer = self.write_serializer_class(
+                data=request.data,
+            )
+            if serializer.is_valid():
+                # save model instance data
+                password = serializer.validated_data.pop('password')
+                instance = self.model(**serializer.validated_data)
+                instance.set_password(password)
+                instance.save()
+
+                return Response(self.serializer_class(
+                    instance, many=False, context={'request': request}).data,
+                                status=status.HTTP_201_CREATED)
+            else:
+                return Response(
+                    serializer.errors, status=status.HTTP_406_NOT_ACCEPTABLE)
+        except Exception as e:
+            return Response(str(e), status=status.HTTP_500_INTERNAL_SERVER_ERROR)
+
+
+class ChangeUserPasswordView(UpdateAPIView):
+
+    model = models.CustomUser
+    queryset = model.objects.all()
+    permission_classes = (YourOwnUserPermissions,)
+    serializer_class = serializers.ChangePasswordSerializer
+
+
+class UpdateUserView(UpdateAPIView):
+
+    model = models.CustomUser
+    queryset = model.objects.all()
+    permission_classes = (YourOwnUserPermissions,)
+    serializer_class = serializers.UpdateUserSerializer
+
+
+@api_view(['POST',])
+@permission_classes([IsAdminUser,])
+def load_coop_managers(request):
+    """Read CSV file being received
+    Parse it to create users and related companies
+    """
+    try:
+        csv_file = request.FILES['csv_file']
+        if csv_file.name.endswith('.csv') is not True:
+            logging.error(f"File {csv_file.name} is not a CSV file")
+            return Response({"errors":{"details": "File is not CSV type"}})
+
+        logging.info(f"Reading contents of  {csv_file.name}")
+        decoded_file = csv_file.read().decode('utf-8').splitlines()
+        csv_reader =  csv.DictReader(decoded_file, delimiter=',')
+        coop_counter = 0
+        user_counter = 0
+        for row in csv_reader:
+            if '' in (row['cif'], row['nombre-coop'], row['email']):
+                logging.error(f"Required data missing: {row}")
+                continue
+            try:
+                coop_data = {
+                    'cif': row['cif'].strip(),
+                    'company_name': row['nombre-coop'].strip(),
+                    'short_name': row['nombre-corto'].strip(),
+                    'shop': bool(row['es-tienda'].strip()),
+                    'shop_link': row['url'].strip(),
+                }
+                # import ipdb; ipdb.set_trace()
+                coop = Company.objects.create(**coop_data)
+                logging.info(f"Created Coop: {coop_data}")
+                coop_counter += 1
+
+                coop_user = User.objects.create_user(email=row['email'], company=coop, role='COOP_MANAGER')
+                logging.info(f"Created User: {coop_user}")
+                # TODO: send confirmation email
+                user_counter += 1
+            except Exception as e:
+                logging.error(f"Could not parse {row}")
+
+        return Response()
+    except Exception as e:
+        return Response({"errors": {"details": str(type(e))}})
+
diff --git a/gadm36_ESP.json b/datasets/gadm36_ESP.json
similarity index 100%
rename from gadm36_ESP.json
rename to datasets/gadm36_ESP.json
diff --git a/locations.json b/datasets/locations.json
similarity index 100%
rename from locations.json
rename to datasets/locations.json
diff --git a/datasets/test_coop.csv b/datasets/test_coop.csv
new file mode 100644
index 0000000..6080b1e
--- /dev/null
+++ b/datasets/test_coop.csv
@@ -0,0 +1,9 @@
+email,cif,nombre-coop,nombre-corto,url,es-tienda
+, 1223432214L, FEWQ4FEWQ COOP, fc, tienda1.com, True
+dsfds@mail.com,, FEW2QFEWQ COOP, fc, tienda2.com, True
+ghjhg@mail.com, 122343214L,, fc, tienda3.com, True
+xcv@mail.com, 12343214L, FEWQ2FEWQ COOP,, tienda4.com, True
+cvc@mail.com, 1879783214L, 2FEWQFEWQ COOP, fc,, True
+bvbc@mail.com, 5653214L, FEW2QFEWQ COOP, fc, tienda6.com,
+kjk@mail.com, 54326543H, FE2WQF2EWQ COOP, fc, tienda7.com, True
+yuyu@mail.com, 12343214L, F2EWQFEWQ COOP, fc, tienda8.com, True
\ No newline at end of file
diff --git a/datasets/test_products.csv b/datasets/test_products.csv
new file mode 100644
index 0000000..68499ce
--- /dev/null
+++ b/datasets/test_products.csv
@@ -0,0 +1,10 @@
+id,nombre-producto,descripcion,imagen,url,precio,gastos-envio,cond-envio,descuento,stock,tags,categoria,identificadores
+,,mi-descripcion,,coop.com,10.00,5.01,"condiciones de envio, una cosa, y la otra",4.05,1000,"color/rojo, talla/xxl", limpio, "alto, forma/redondo"
+,mi-nombre,,,coop.com,10.00,5.01,"condiciones de envio, una cosa, y la otra",4.05,1000,"color/rojo, talla/xxl", limpio, "alto, forma/redondo"
+,mi-nombre,mi-descripcion,,coop.com,,5.01,"condiciones de envio, una cosa, y la otra",4.05,1000,"color/rojo, talla/xxl", limpio, "alto, forma/redondo"
+,mi-nombre,mi-descripcion,,coop.com,10.00,5.01,"condiciones de envio, una cosa, y la otra",4.05,1000,"color/rojo, talla/xxl", limpio, "alto, forma/redondo"
+,mi-nombre,mi-descripcion,,coop.com,10.00,5.01,"condiciones de envio, una cosa, y la otra",4.05,1000,"color/rojo, talla/xxl", limpio, "alto, forma/redondo"
+,mi-nombre,mi-descripcion,,coop.com,10.00,5.01,"condiciones de envio, una cosa, y la otra",4.05,1000,"color/rojo, talla/xxl", limpio, "alto, forma/redondo"
+,mi-nombre,mi-descripcion,,coop.com,10.00,5.01,"condiciones de envio, una cosa, y la otra",4.05,1000,"color/rojo, talla/xxl", limpio, "alto, forma/redondo"
+,mi-nombre,mi-descripcion,,coop.com,10.00,5.01,"condiciones de envio, una cosa, y la otra",4.05,1000,"color/rojo, talla/xxl", limpio, "alto, forma/redondo"
+,mi-nombre,mi-descripcion,,coop.com,10.00,5.01,"condiciones de envio, una cosa, y la otra",4.05,1000,"color/rojo, talla/xxl"
\ No newline at end of file
diff --git a/geo/tests.py b/geo/tests.py
index b267a05..e15ab7a 100644
--- a/geo/tests.py
+++ b/geo/tests.py
@@ -135,7 +135,7 @@ class CountryViewSetTest(APITestCase):
         self.model = models.Country
         # create user
         self.password = ''.join(random.choices(string.ascii_uppercase, k = 10))
-        self.user = CustomUserFactory(password=self.password)
+        self.user = CustomUserFactory(email="test@mail.com", password=self.password, is_active=True)
 
     def test_anon_user_cannot_create_country(self):
         """Not logged-in user cannot create new country
@@ -263,7 +263,7 @@ class RegionViewSetTest(APITestCase):
         self.model = models.Region
         # create user
         self.password = ''.join(random.choices(string.ascii_uppercase, k = 10))
-        self.user = CustomUserFactory(password=self.password)
+        self.user = CustomUserFactory(email="test@mail.com", password=self.password, is_active=True)
 
     def test_not_logged_user_cannot_create_instance(self):
         """Not logged-in user cannot create new region
@@ -397,7 +397,7 @@ class ProvinceViewSetTest(APITestCase):
         self.model = models.Province
         # create user
         self.password = ''.join(random.choices(string.ascii_uppercase, k = 10))
-        self.user = CustomUserFactory(password=self.password)
+        self.user = CustomUserFactory(email="test@mail.com", password=self.password, is_active=True)
 
     def test_not_logged_user_cannot_create_instance(self):
         """Not logged-in user cannot create new instance
@@ -531,7 +531,7 @@ class CityViewSetTest(APITestCase):
         self.model = models.City
         # create user
         self.password = ''.join(random.choices(string.ascii_uppercase, k = 10))
-        self.user = CustomUserFactory(password=self.password)
+        self.user = CustomUserFactory(email="test@mail.com", password=self.password, is_active=True)
 
     def test_not_logged_user_cannot_create_city(self):
         """Not logged-in user cannot create new city
diff --git a/products/factories.py b/products/factories.py
index efe243f..77ebf13 100644
--- a/products/factories.py
+++ b/products/factories.py
@@ -16,8 +16,7 @@ class ProductFactory(DjangoModelFactory):
     sku = FuzzyText(prefix='SKU_', length=10)
     name = FuzzyText(prefix='NAME_', length=10)
     description = FuzzyText(prefix='DECRIPTION', length=100)
-    image = None
-    url = FuzzyText(prefix='http://WEB_LINK_', suffix='.test', length=10)
+    url = FuzzyText(prefix='http://WEB-LINK-', suffix='.test', length=10)
     price = FuzzyDecimal(low=1.00)
     shipping_cost = FuzzyDecimal(low=1.00)
     shipping_terms = FuzzyText(prefix='SHIPPING_TERMS', length=100)
@@ -26,9 +25,9 @@ class ProductFactory(DjangoModelFactory):
     update_date = FuzzyDateTime(start_dt=timezone.now())
     discount = FuzzyDecimal(low=0.00, high=100.00)
     stock = FuzzyInteger(low=0)
-    # tags = models.ManyToMany(Tag, null=True, blank=True )
-    # category = models.ForeignKey(Tag, null=true) # main tag category
-    # attributes = models.ManyToMany(Tag, null=True, blank=True )
+    tags = ['test-tag']
+    category = 'top-category' # main tag category
+    attributes = ['programming/python', 'testing']
     identifiers = FuzzyText(prefix='IDENTIFIERS_', length=100)
 
     class Meta:
diff --git a/products/models.py b/products/models.py
index 8afd717..7ef0b98 100644
--- a/products/models.py
+++ b/products/models.py
@@ -32,9 +32,9 @@ class Product(models.Model):
     update_date = models.DateTimeField('Fecha de actualización de producto', null=True, blank=True)
     discount = models.DecimalField('Descuento', max_digits=5, decimal_places=2, null=True, blank=True)
     stock = models.PositiveIntegerField('Stock', null=True)
-    tags = TagField( )
-    category = SingleTagField() # main tag category
-    attributes = TagField()
+    tags = TagField(force_lowercase=True,max_count=5, tree=True)
+    category = SingleTagField(null=True) # main tag category
+    attributes = TagField(force_lowercase=True,max_count=5, tree=True)
     identifiers = models.TextField('Identificador único de producto', null=True, blank=True)
 
     # internal
@@ -43,3 +43,9 @@ class Product(models.Model):
     creator = models.ForeignKey('core.CustomUser', on_delete=models.DO_NOTHING, null=True, related_name='product')
     # history = models.FoiregnKey('history.History', on_delete=models.DO_NOTHING, null=True)
 
+    def __str__(self):
+        return f"{self.name} / {self.sku}"
+
+    class Meta:
+        verbose_name = "Producto"
+        verbose_name_plural = "Productos"
diff --git a/products/serializers.py b/products/serializers.py
index d39b689..e7d2fcf 100644
--- a/products/serializers.py
+++ b/products/serializers.py
@@ -1,16 +1,15 @@
 from rest_framework import serializers
 
-from taggit_serializer.serializers import TagListSerializerField, TaggitSerializer
 from products.models import Product
 
-from utils.tag_serializers import SingleTagSerializerField
+from utils.tag_serializers import TagListSerializerField, TaggitSerializer, SingleTagSerializerField
 
 
 class ProductSerializer(TaggitSerializer, serializers.ModelSerializer):
 
-    tags = TagListSerializerField( )
-    category = SingleTagSerializerField() # main tag category
-    attributes = TagListSerializerField()
+    tags = TagListSerializerField(required=False)
+    category = SingleTagSerializerField(required=False) # main tag category
+    attributes = TagListSerializerField(required=False)
 
     class Meta:
         model = Product
diff --git a/products/tests.py b/products/tests.py
index c8f964e..85940ae 100644
--- a/products/tests.py
+++ b/products/tests.py
@@ -8,6 +8,7 @@ from django.utils import timezone
 from rest_framework.test import APITestCase
 from rest_framework import status
 
+from companies.factories import CompanyFactory
 from products.factories import ProductFactory
 from products.models import Product
 
@@ -28,7 +29,7 @@ class ProductViewSetTest(APITestCase):
         self.model = Product
         # create user
         self.password = ''.join(random.choices(string.ascii_uppercase, k = 10))
-        self.user = CustomUserFactory(password=self.password)
+        self.user = CustomUserFactory(email="test@mail.com", password=self.password, is_active=True)
 
     # anon user
     def test_anon_user_cannot_create_instance(self):
@@ -101,12 +102,12 @@ class ProductViewSetTest(APITestCase):
         """Regular logged-in user can create new instance
         """
         # Define request data
+        company = CompanyFactory()
         data = {
-            'company': None,
+            'company': company.id,
             'sku': 'qwerewq',
             'name': 'qwerewq',
             'description': 'qwerewq',
-            'image': None,
             'url': 'http://qwerewq.com',
             'price': '12.21',
             'shipping_cost': '21.12',
@@ -116,9 +117,9 @@ class ProductViewSetTest(APITestCase):
             'update_date': datetime.datetime.now().isoformat()+'Z',
             'discount': '0.05',
             'stock': 22,
-            # tags = models.ManyToMany(Tag, null=True, blank=True )
-            # category = models.ForeignKey(Tag, null=true) # main tag category
-            # attributes = models.ManyToMany(Tag, null=True, blank=True )
+            'tags': ['tag1, tag2'],
+            'category': 'Mr',
+            'attributes': ['color/red', 'size/xxl'],
             'identifiers': '34rf34f43c43',
         }
 
@@ -128,7 +129,6 @@ class ProductViewSetTest(APITestCase):
 
         # Query endpoint
         response = self.client.post(self.endpoint, data=data, format='json')
-
         # Assert endpoint returns created status
         self.assertEqual(response.status_code, status.HTTP_201_CREATED)
 
@@ -145,8 +145,9 @@ class ProductViewSetTest(APITestCase):
         instance.save()
 
         # Define request data
+        company = CompanyFactory()
         data = {
-            'company': None,
+            'company': company.id,
             'sku': 'qwerewq',
             'name': 'qwerewq',
             'description': 'qwerewq',
@@ -160,9 +161,9 @@ class ProductViewSetTest(APITestCase):
             'update_date': datetime.datetime.now().isoformat()+'Z',
             'discount': '0.05',
             'stock': 22,
-            # tags = models.ManyToMany(Tag, null=True, blank=True )
-            # category = models.ForeignKey(Tag, null=true) # main tag category
-            # attributes = models.ManyToMany(Tag, null=True, blank=True )
+            'tags': ['tag1x, tag2x'],
+            'category': 'MayorTagCategory2',
+            'attributes': ['color/blue', 'size/m'],
             'identifiers': '34rf34f43c43',
         }
 
@@ -173,7 +174,6 @@ class ProductViewSetTest(APITestCase):
         # Query endpoint
         url = self.endpoint + f'{instance.pk}/'
         response = self.client.put(url, data, format='json')
-
         # Assert endpoint returns OK code
         self.assertEqual(response.status_code, status.HTTP_200_OK)
 
@@ -187,13 +187,36 @@ class ProductViewSetTest(APITestCase):
         # Create instances
         instance = self.factory()
 
+        # Define request data
+        company = CompanyFactory()
+        data = {
+            'company': company.id,
+            'sku': 'qwerewq',
+            'name': 'qwerewq',
+            'description': 'qwerewq',
+            'url': 'http://qwerewq.com',
+            'price': '12.21',
+            'shipping_cost': '21.12',
+            'shipping_terms': 'qwerewq',
+            'source': 'SYNCHRONIZED',
+            'sourcing_date': datetime.datetime.now().isoformat()+'Z',
+            'update_date': datetime.datetime.now().isoformat()+'Z',
+            'discount': '0.05',
+            'stock': 22,
+            'tags': ['tag1, tag2'],
+            'category': 'Mr',
+            'attributes': ['color/red', 'size/xxl'],
+            'identifiers': '34rf34f43c43',
+        }
+
         # Authenticate user
         token = get_tokens_for_user(self.user)
         self.client.credentials(HTTP_AUTHORIZATION=f"Bearer {token['access']}")
 
         # Query endpoint
         url = self.endpoint + f'{instance.pk}/'
-        response = self.client.put(url, data={}, format='json')
+        response = self.client.put(url, data=data, format='json')
+
 
         # Assert endpoint returns OK code
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
@@ -236,3 +259,78 @@ class ProductViewSetTest(APITestCase):
         self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT)
         # Assert instance doesn't exists anymore on db
         self.assertFalse(self.model.objects.filter(id=instance.pk).exists())
+
+
+class LoadCoopProductsTestCase(APITestCase):
+
+    def setUp(self):
+        """Tests setup
+        """
+        self.endpoint = '/api/v1/load_products/'
+        self.model = Product
+        self.factory = ProductFactory
+        # create admin user
+        self.admin_email = f"admin_user@mail.com"
+        self.password = ''.join(random.choices(string.ascii_uppercase, k = 10))
+        self.admin_user = CustomUserFactory(email=self.admin_email, password=self.password, is_staff=True, is_active=True)
+        # create regular user
+        self.reg_email = f"user@mail.com"
+        self.user = CustomUserFactory(email=self.reg_email, is_active=True)
+        self.user.set_password(self.password)
+        self.user.save()
+        # test CSV file path
+        self.csv_path = 'datasets/test_products.csv'
+
+    def test_admin_can_load_csv(self):
+        # delete existing instances
+        self.model.objects.all().delete()
+
+        # read csv file
+        files = {'csv_file': open(self.csv_path,'rt')}
+
+        # Authenticate
+        token = get_tokens_for_user(self.admin_user)
+        self.client.credentials(HTTP_AUTHORIZATION=f"Bearer {token['access']}")
+
+        # send in request
+        response = self.client.post(self.endpoint, files)
+
+        # check re sponse
+        self.assertEqual(response.status_code, 200)
+        # check for object creation
+        self.assertEquals(5, self.model.objects.count())
+
+    def test_auth_user_cannot_load_csv(self):
+        # delete existing instances
+        self.model.objects.all().delete()
+
+        # read csv file
+        files = {'csv_file': open(self.csv_path,'r')}
+
+        # Authenticate
+        token = get_tokens_for_user(self.user)
+        self.client.credentials(HTTP_AUTHORIZATION=f"Bearer {token['access']}")
+
+        # send in request
+        response = self.client.post(self.endpoint, files)
+
+        # check response
+        self.assertEqual(response.status_code, 403)
+        # check for object creation
+        self.assertEqual(0, self.model.objects.count())
+
+    def test_anon_user_cannot_load_csv(self):
+        # delete existing instances
+        self.model.objects.all().delete()
+
+        # read csv file
+        files = {'csv_file': open(self.csv_path,'r')}
+
+        # send in request
+        response = self.client.post(self.endpoint, files)
+
+        # check response
+        self.assertEqual(response.status_code, 401)
+        # check for object creation
+        self.assertEqual(0, self.model.objects.count())
+
diff --git a/products/views.py b/products/views.py
index ba342cb..d4af09b 100644
--- a/products/views.py
+++ b/products/views.py
@@ -1,16 +1,102 @@
+import logging
+import csv
+
 from django.shortcuts import render
+from django.conf import settings
 
 # Create your views here.
 from rest_framework import viewsets
-from rest_framework.permissions import IsAuthenticatedOrReadOnly
+from rest_framework.response import Response
+from rest_framework.permissions import IsAuthenticatedOrReadOnly, IsAdminUser
+from rest_framework.decorators import api_view, permission_classes
+
+import requests
 
 from products.models import Product
 from products.serializers import ProductSerializer
+from companies.models import Company
 
 from back_latienda.permissions import IsCreator
 
 
+logging.basicConfig(
+    filename='logs/product-load.log',
+    filemode='w',
+    format='%(levelname)s:%(message)s',
+    level=logging.INFO,
+    )
+
+
 class ProductViewSet(viewsets.ModelViewSet):
       queryset = Product.objects.all()
       serializer_class = ProductSerializer
       permission_classes = [IsAuthenticatedOrReadOnly, IsCreator]
+
+
+@api_view(['POST',])
+@permission_classes([IsAdminUser,])
+def load_coop_products(request):
+      """Read CSV file being received
+      Parse it to create products for related Company
+      """
+      try:
+            csv_file = request.FILES['csv_file']
+            if csv_file.name.endswith('.csv') is not True:
+                  logging.error(f"File {csv_file.name} is not a CSV file")
+                  return Response({"errors":{"details": "File is not CSV type"}})
+
+            logging.info(f"Reading contents of  {csv_file.name}")
+            decoded_file = csv_file.read().decode('utf-8').splitlines()
+            csv_reader =  csv.DictReader(decoded_file, delimiter=',')
+            counter = 0
+
+            for row in csv_reader:
+                  if '' in (row['nombre-producto'], row['descripcion'], row['precio'], row['categoria']):
+                        logging.error(f"Required data missing: {row}")
+                        continue
+                  try:
+                        # download image references in csv
+                        if row['imagen'].strip() != '':
+                              image_url = row['imagen'].strip()
+                              response = requests.get(image_url, stream=True)
+                              if response.status_code == 200:
+                                    path = f"{setting.BASE_DIR}media/{row['nombre-producto'].strip()}.{image.url.split('/')[-1]}"
+                                    logging.info(f"Saving product image to: {path}")
+                                    new_image = open(path, 'wb')
+                                    for chunk in response:
+                                          new_image.write(chunk)
+                                    new_image.close()
+                              else:
+                                    logging.warning(f"Image URL did not work: {image_url}")
+                                    new_image = None
+                        else:
+                              new_image = None
+                        # assemble instance data
+
+                        product_data = {
+                              'id': None if row['id'].strip()=='' else row['id'].strip(),
+                              'company': Company.objects.filter(creator=request.user).first(),
+                              'name': row['nombre-producto'].strip(),
+                              'description': row['descripcion'].strip(),
+                              'image': new_image,
+                              'url': row['url'].strip(),
+                              'price': row['precio'].strip(),
+                              'shipping_cost': row['gastos-envio'].strip(),
+                              'shipping_terms': row['cond-envio'].strip(),
+                              'discount': row['descuento'].strip(),
+                              'stock': row['stock'].strip(),
+                              'tags': row['tags'].strip(),
+                              'category': row['categoria'].strip(),
+                              'identifiers': row['identificadores'].strip(),
+                        }
+
+                        Product.objects.create(**product_data)
+                        logging.info(f"Created Product: {product_data}")
+                        counter += 1
+                  except Exception as e:
+                        logging.error(f"Could not parse {row}")
+            return Response()
+      except Exception as e:
+            return Response({"errors": {"details": str(type(e))}})
+
+
diff --git a/requirements.txt b/requirements.txt
index d772164..b13037e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,11 +1,12 @@
 Django==2.2.17
+psycopg2-binary==2.8.6
 djangorestframework==3.12.2
-djangorestframework-simplejwt==4.5.0
-PyJWT==v1.7.1
+djangorestframework-simplejwt==4.6.0
 factory-boy==3.1.0
 django-dotenv==1.4.2
 django-filter==2.4.0
 -e git://github.com/darklow/django-suit/@v2#egg=django-suit
 django-cors-headers==3.5.0
 django-taggit-serializer==0.1.7
-django-tagulous==1.1.0
\ No newline at end of file
+django-tagulous==1.1.0
+Pillow==8.1.0
diff --git a/utils/tag_serializers.py b/utils/tag_serializers.py
index b5893a6..9f74c72 100644
--- a/utils/tag_serializers.py
+++ b/utils/tag_serializers.py
@@ -1,6 +1,35 @@
+# -*- coding: utf-8 -*-
+import json
+
+# Third party
+import six
+from django.utils.translation import ugettext_lazy as _
 from rest_framework import serializers
 
 
+class TagList(list):
+    def __init__(self, *args, **kwargs):
+        pretty_print = kwargs.pop("pretty_print", True)
+        list.__init__(self, *args, **kwargs)
+        self.pretty_print = pretty_print
+
+    def __add__(self, rhs):
+        return TagList(list.__add__(self, rhs))
+
+    def __getitem__(self, item):
+        result = list.__getitem__(self, item)
+        try:
+            return TagList(result)
+        except TypeError:
+            return result
+
+    def __str__(self):
+        if self.pretty_print:
+            return json.dumps(
+                self, sort_keys=True, indent=4, separators=(',', ': '))
+        else:
+            return json.dumps(self)
+
 
 class SingleTag(str):
 
@@ -8,13 +37,15 @@ class SingleTag(str):
         pass
 
     def __str__(self):
-        return self
+        return json.dumps(self)
 
 
 class SingleTagSerializerField(serializers.Field):
     child = serializers.CharField()
     default_error_messages = {
-        'not_a_str': 'Expected a string but got type "{input_type}".',
+        'invalid_json': _('Invalid json str. A tag list submitted in string'
+                          ' form must be valid json.'),
+        'not_a_str': _('Expected a string but got type "{input_type}".')
     }
     order_by = None
 
@@ -22,7 +53,7 @@ class SingleTagSerializerField(serializers.Field):
         super(SingleTagSerializerField, self).__init__(**kwargs)
 
     def to_internal_value(self, value):
-        if isinstance(value, str):
+        if isinstance(value, six.string_types):
             if not value:
                 value = ""
 
@@ -37,3 +68,93 @@ class SingleTagSerializerField(serializers.Field):
                 value = value.name
             value = SingleTag(value)
         return value
+
+
+class TagListSerializerField(serializers.Field):
+    child = serializers.CharField()
+    default_error_messages = {
+        'not_a_list': _(
+            'Expected a list of items but got type "{input_type}".'),
+        'invalid_json': _('Invalid json list. A tag list submitted in string'
+                          ' form must be valid json.'),
+        'not_a_str': _('All list items must be of string type.')
+    }
+    order_by = None
+
+    def __init__(self, **kwargs):
+        pretty_print = kwargs.pop("pretty_print", True)
+
+        style = kwargs.pop("style", {})
+        kwargs["style"] = {'base_template': 'textarea.html'}
+        kwargs["style"].update(style)
+
+        super(TagListSerializerField, self).__init__(**kwargs)
+
+        self.pretty_print = pretty_print
+
+    def to_internal_value(self, value):
+        if isinstance(value, six.string_types):
+            if not value:
+                value = "[]"
+            try:
+                value = json.loads(value)
+            except ValueError:
+                self.fail('invalid_json')
+
+        if not isinstance(value, list):
+            self.fail('not_a_list', input_type=type(value).__name__)
+
+        for s in value:
+            if not isinstance(s, six.string_types):
+                self.fail('not_a_str')
+
+            self.child.run_validation(s)
+
+        return value
+
+    def to_representation(self, value):
+        if not isinstance(value, TagList):
+            if not isinstance(value, list):
+                if self.order_by:
+                    tags = value.all().order_by(*self.order_by)
+                else:
+                    tags = value.all()
+                value = [tag.name for tag in tags]
+            value = TagList(value, pretty_print=self.pretty_print)
+
+        return value
+
+
+class TaggitSerializer(serializers.Serializer):
+    def create(self, validated_data):
+        to_be_tagged, validated_data = self._pop_tags(validated_data)
+
+        tag_object = super(TaggitSerializer, self).create(validated_data)
+
+        return self._save_tags(tag_object, to_be_tagged)
+
+    def update(self, instance, validated_data):
+        to_be_tagged, validated_data = self._pop_tags(validated_data)
+
+        tag_object = super(TaggitSerializer, self).update(
+            instance, validated_data)
+
+        return self._save_tags(tag_object, to_be_tagged)
+
+    def _save_tags(self, tag_object, tags):
+        for key in tags.keys():
+            tag_values = tags.get(key)
+            getattr(tag_object, key).set(*tag_values)
+
+        return tag_object
+
+    def _pop_tags(self, validated_data):
+        to_be_tagged = {}
+
+        for key in self.fields.keys():
+            field = self.fields[key]
+            if isinstance(field, TagListSerializerField):
+                if key in validated_data:
+                    to_be_tagged[key] = validated_data.pop(key)
+
+        return (to_be_tagged, validated_data)