This Privacy Notice is issued under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and the INAI guidelines on privacy notices.
1. Identity and address of the controller
The controller of your personal data is Néstor Castro, an individual with business activity, operating the brand THE AROIDS through the site thearoids.com. To exercise ARCO rights or request our full registered address, write to contacto@thearoids.com.
2. Personal data we collect
To process your order and operate your account we collect: full name, email, shipping address (street, number, neighborhood, postal code, city, state, country), phone number (optional for shipping coordination), and order history. We do not collect sensitive data as defined by article 3 section VI of LFPDPPP. Card data is collected directly by our payment processor Stripe; we never store card numbers.
3. Primary processing purposes
We process your data for purposes necessary to the relationship with us: (a) processing and tracking your order; (b) coordinating made-to-order production with our manufacturer; (c) coordinating shipment with the carrier; (d) handling payments and invoicing; (e) responding to inquiries and complaints; (f) managing your customer account; (g) complying with tax, accounting and legal obligations.
4. Secondary purposes
Unless you object, we may also use your data to: (a) send you communications about new releases, editorial content and promotions; (b) perform statistical analysis to improve the store. You can opt out of these secondary purposes at any time by writing to contacto@thearoids.com with the subject "Object to secondary purposes". Doing so will not affect the purchase relationship.
5. Transfers and third parties
To operate the store we transfer strictly necessary data to the following processors, several of them located outside Mexico (United States and European Union): Stripe, Inc. (payment processing), Printful, Inc. (on-demand printing and fulfillment, requires name and shipping address), Vercel Inc. and Laravel Cloud (hosting), Resend (transactional email). These transfers do not require your consent as they are necessary to perform the contractual relationship (article 37 section V LFPDPPP). We do not sell, rent or share your data with third parties for marketing.
6. Cookies and tracking technologies
We use strictly necessary cookies to maintain your session, cart and language preference. We also use analytics cookies to understand site navigation. You can configure your browser to reject cookies; some features (cart, login) require cookies to work.
7. ARCO rights and consent revocation
You have the right to Access, Rectify, Cancel or Object to the processing of your data (ARCO rights), and to revoke any consent you have given us. To exercise them email contacto@thearoids.com indicating: (1) your name and contact email, (2) copy of official ID, (3) clear and precise description of the data, (4) any element that facilitates locating the data. We will respond within 20 business days under article 32 LFPDPPP.
8. Data retention
We keep your data for as long as you have an active account and, after closing or your last order, for up to 5 years to comply with tax and accounting obligations (Mexican Federal Fiscal Code). After that period it will be blocked and then cancelled.
9. Minors
Our site is not directed to minors under 18 and we do not knowingly collect data from minors. If you are a parent or guardian and believe your child provided us personal data, write to contacto@thearoids.com for deletion.
10. Changes to this Privacy Notice
Any change will be published on this page with the updated date. We recommend reviewing it periodically.
11. Authority and contact
If you believe your right to data protection has been violated, you may contact the Mexican National Institute for Transparency, Access to Information and Personal Data Protection (INAI) at home.inai.org.mx. For any matter related to this notice, write to contacto@thearoids.com.