Tejiendo México S.A.S. de C.V., hereinafter “Dulce de Lana” and / or “Company”, with the following tax residence, Avenida Nuevo León 202, Piso 10, Col. Hipódromo, Del. Cuauhtémoc, C.P. 06100, Mexico City, issues this Privacy Notice so that the data subject, hereinafter referred to as “Data Subject”, is aware of the treatment that the Company gives to personal data.

Dulce de Lana is very concerned about privacy and keeping the personal information that its Users share with the Company safe. The personal data of the Data Subject is protected and safeguarded to avoid damage, destruction, theft, loss, alteration, or unauthorized treatment, in compliance with the provisions of articles 8, 15, 16, 33, 36, and other articles related of the Federal Law for the Protection of Personal Data in the Possession of Private Entities.

Dulce de Lana can be contacted by sending an email to contacto@dulcedelana.com.

 

Purpose of the Privacy Notice

This Privacy Notice exists to inform the Data Subject of the processing of their data, as well as to provide precise information on the exercise of rights of access, rectification, cancellation, and opposition (hereinafter “ARCO Rights ”), which are described below:

1. Right to access personal data held by Dulce de Lana, with the exception of cases mentioned in the law.
2. Right to rectify personal data when inaccurate or incomplete.
3. Right at all times to cancel personal data. Dulce de Lana may deny the cancellation of the data in the terms established by law.
4. Right at all times and for legitimate reasons to oppose the processing of data.

It is important to inform you that the Federal Law for the Protection of Personal Data in the Possession of Private Entities protects your personal information from unauthorized and non-consensual use. This document will inform of the data collected from the Data Subject, how said data is used, possible transfers to third parties, the purposes of data processing, ARCO rights, as well as the revocation of consent, which the Data Subject can enforce with the aim of having full control and decision over their personal information. For this reason, we recommend that you read the following information carefully:

 

This Privacy Notice is applicable to the data of Data Subject obtained directly, indirectly, or personally by Dulce de Lana, through the purchase and sale of products, contracts, letters, requests for information, as well as the different forms contained on the Company’s Website www.dulcedelana.com (hereinafter “Website”) or any other means specified for such purposes, which refer to this Privacy Notice.

 

Personal information

Personal Data is provided through the creation of an Account or User Registration, and/or by sending a contact request through the contact form on the Customer Service page. The Company collects information on personal identity that is voluntarily transferred by the Data Subject, or in response to explicit requirements by the Company.

 

Information should be true and complete. The user will take full responsibility at all times for the data provided and Dulce de Lana will under no circumstances be responsible for the veracity of said data.

 

The information requested is: Name, Address, Date of Birth, Gender, Transactions, Email Account, Telephone Number (s), Tax Data for Invoice Preparation, Bank Card Number, and Bank Identifiers.

Dulce de Lana does not request sensitive personal data on the Website that it administers.

 

Cookies

The User of the Company’s Website knows and accepts that the Company may use a tracking system through the use of cookies (“Cookies”).

 

Cookies are data files that are stored on the hard drive of a user’s computer equipment or electronic communications device when browsing an Internet site, which allows the exchange of status information between said site and the user’s browser. The status information may reveal means of session identification, authentication, or user preferences, as well as any data stored by the browser regarding the Internet site.

 

Cookies are used to know the interests, behavior, and demographics of those who visit the Website and thus better understand their needs and interests and provide them with a better service or provide related information. We also offer certain functionalities that are only available through the use of Cookies.

 

We will also use the information obtained through Cookies to analyze the pages browsed by the visitor or User, the searches carried out, improve our commercial and promotional initiatives, display advertisements, promotions, or banners of interest, perfect the content and articles on offer, personalize said content, presentation, and services.

 

Cookies are also used so in order to reduce the need for the User to enter their password so frequently during a browsing session, also to count and corroborate registrations, the User’s activity, and other concepts and commercial agreements, always with the objective of installing the Cookies for the benefit of the User. The data will not be used for purposes unrelated to the Company.

 

 

The existence, installation, and permanence of Cookies on the User’s or visitor’s computer depends on their sole will and can be eliminated from their computer whenever they wish. To know how to remove Cookies from the system, the User must review the Help section of their browser. Cookies or other similar systems installed by third parties can be found on certain pages of our Website. The Company does not control the use of Cookies by third parties.

 

If you would like more information about cookies, go to http://www.allaboutcookies.org.

 

 

Protection

 

The security and confidentiality of the data that Users provide when contracting a service or buying a product online will be protected by a secure server under the Secure Socket Layer (SSL) protocol which encrypts the data to safeguard privacy.

 

To verify that you are in a protected environment, make sure an “S” appears in the navigation bar “httpS”: //.

 

However, despite the availability of ever more secure tools, the protection of data sent over the Internet cannot be guaranteed 100%; so once received, every effort will be made to safeguard the information.

 

 

Databases

 

The Company’s database, on which the information collected is stored, will save and protect the Information provided by the Data Subject, even if they are modified, updated, or even canceled for any reason; the foregoing is for the purpose of maintaining a record of the Data Subject and protecting their legal interests. The conservation of information indicated in this paragraph may be erased or eliminated in its entirety through the exercise of ARCO Rights.

To unsubscribe from our newsletters, please click on the following link found within our emails: “Unsubscribe from this list”.

 

Purposes of the Processing of Personal Data

 

Personal Information is collected and stored for the purposes of:

• Identification and authentication of the identity of the User of the Website
• Operation, management, shipping of goods, returns, billing, charging, administration, provision of our services
• Delivery of notifications, requirements, letters or newsletters or attention to requests related to the services provided
• Help complete a transaction or order that has been initiated on the website
• Analyze the behavior and demographics of Users
• Improve our commercial and promotional initiatives (marketing)
• Send information or messages about new products and/or services, information about our business partners as well as any other information
• Show advertising or promotions of interest to our Users
• Transfer of information from the Data Subject in the applicable cases in accordance with the section “Transfer of Information with Third Parties” of this Privacy Notice
• Prevention or reporting of unlawful acts to the relevant authorities
• To comply with the exercise of ARCO Rights as well as revoke the consent of the Data Subject

 

The aforementioned enables the Company to provide an efficient service to the User.

 

The purposes are necessary for the fulfillment of the obligations and the relationship with the Data Subject, that is, that the Company provides an efficient service to the User, this being the main obligation and the cause of the legal relationship between the Company and the User.

 

The collection of information allows the Company to offer services and functionalities that are suited to the User’s needs. It also allows the Company to send the User via different means and routes (including conventional mail or email, SMS, MSM, electronic notifications) offers of products and services that may be of interest to the User, in addition to complying with its obligations via these means.

 

The Company reserves the right to request any additional proof and/or data in order to corroborate the personal data of each User, as well as to temporarily or permanently suspend those Users whose data could not be confirmed.

 

The User acknowledges that the account or User Registration is personal, unique, and non-transferable, and it is prohibited for the same User to register or have more than one account. In the event that the Company detects different accounts that contain matching or related data, it may cancel, suspend or disable them. The User will be responsible for all the operations carried out in their account since access to it is restricted to the entry and use of the personal password, which is known exclusively to the User. In the event of the account being suspended, the Company will store the User’s personal data, so that the User and the Company will continue to be subject to the provisions of this Privacy Notice.

 

In the event that the User’s information at the time of registration is wrong or incomplete, rendering the verification and identification of the User impossible, the Company will have the right to immediately suspend the provision of the Services through the Website, without the need for prior notice. The User is responsible at all times for the losses and damages hereby suffered.

 

 

Confidentiality

The data of the Data Subject will be provided by the Company only in the manner established in this Privacy Notice. The Company will do everything in its power to protect the privacy of the information. It may happen that by virtue of court orders or legal regulations, the Company is compelled to disclose information to the authorities or third parties under certain circumstances. In the case of third parties intercepting or accessing certain information or data transmissions, the Company will not be responsible for the information that is disclosed. In these cases, the Company will notify the Data Subject about the situation.

 

We do not assume the obligation to keep confidential information that the Data Subject provides through newsletters and online chats, as well as the information obtained through cookies or information that has not been directly delivered to the Company.

 

It should be clarified that the Data Subject’s information will NOT be sold, given away, facilitated, or rented to any third party. If the user does not want their data to be shared, they can decide NOT to use a specific service or NOT to participate in some promotions or contests.

 

The Company will take all possible measures to maintain the confidentiality and security described above, but it will not be liable for damages or losses that may arise from the violation of these measures by third parties that use public networks or the Internet, altering the system’s security to obtain access to the information of the Data Subject.

 

Security breaches occurring in any phase of data processing that significantly affect the economic or moral rights of the Data Subject will be immediately communicated by the Company to the Data Subject in order for the latter to take the corresponding measures to defend their rights.

 

Transfer of Information to Third Parties

 

The Data Subject expressly authorizes the Company to keep in its registry the information provided by the Data Subject. The Data Subject also authorizes the Company to provide a constant flow of information on the aforementioned registry to (i) authorities that request it as allowed by legislation in force and ( ii) to its strategic, commercial or technical associates in order to offer better conditions for Promotions and/or User content. In addition, the User expressly allows the Company to collect information to monitor traffic, with the intention of identifying user groups and profiles, as well as for advertising targeting purposes.

 

Data Transfers are for lawful purposes and in accordance with the provisions of the Law for the Protection of Personal Data in Possession of Private Entities.

 

The Company declares that it will not transfer any type of information of the Data Subject to national or foreign Third Parties. Should it do so, the Owner will be informed via the publishing a new Privacy Notice. The foregoing is in accordance with the provisions of article 36 of the Regulation of the Law for the Protection of Personal Data in Possession of Private Entities.

 

Transfer in special circumstances

If there is a sale, merger, consolidation, change in corporate control, substantial asset transfer, reorganization or liquidation of the Company, then we may transfer, or assign the information collected on this Website to one or more relevant parties, in addition to being obligated to issue a new Privacy Notice updated to the internal changes suffered.

 

Data submission

 

The Company declares that it can transfer personal data of the Data Subject to the Data Processor, within or outside the national territory in terms of the provisions of the law or the Regulations.

The Data Processor may be an individual or a company, public or private, outside the organization of the Company, who alone or jointly with others, processes personal data on behalf of the Company, as a result of the existence of a legal relationship that links the Data Processor to the Company and which defines the scope of its action for the provision of a service.

 

This submission of data is to fulfill the purposes specified in the processing of data, which are directly related to the fulfillment of the purpose and contractual or extra-contractual relationships with the Company.

The data processing in this submission is subject to the following terms agreed to between the Company and the Data Processor:

1. Process only personal data in accordance with the instructions of the Company;
2. Refrain from processing personal data for purposes other than those instructed by the Company;
3. Implement security measures in accordance with the Law, the Regulations and other applicable provisions;
4. Maintain confidentiality regarding the personal data processed;
5. Delete the personal data processed once the legal relationship with the Company has been fulfilled or on instructions from the Company, as long as there is no legal provision that requires the conservation of personal data;
6. Refrain from transferring personal data.

The exercise of the Data Subject’s ARCO rights or any other right indicated in the law or regulation, will be in accordance with this Privacy Notice.

 

 

 

Limit of use or disclosure of Personal Data

In order for the User to exercise their right to limit the use or disclosure of Personal Data, albeit with the intention of continuing to use the services provided by the Company, the User must express this in writing to the following email info@dulcedelana.com. Said writing must contain the following:

• The name of the owner and email via which they may receive the response.
• Directed to the Company.
• Customer registration or account with the Company to prove identity or the relationship they have with the Company.
• A clear and precise description of the data whose use or disclosure they wish to limit.

Dulce de Lana will have a period of 20 (twenty) business days to answer and, where appropriate, execute the limitation of use. In said response, it will give the resolution and the possibility of carrying out what is requested in the Brief, notwithstanding the possibility of exercising its other rights.

 

  

ARCO Rights (Access, Rectification, Cancellation, and Opposition)

The Data Subject has the right, by himself or through a Representative, to request the Company, at any time, for access, rectification, cancellation or opposition, regarding the personal data that is stored in the Company’s Database.

The legal framework applicable to this request is found in Chapter IV of the Federal Law for the Protection of Personal Information in Possession of Private Entities (articles 28 to 35), by Chapter VII Sections I to V of the Regulations of the Federal Law on Protection of Personal Data ( Articles 92 to 111), and by the Guidelines of the Twenty-fifth, Twenty-eighth, Twenty-Ninth and Thirty-fifth Privacy Notice.

The Request must be in writing with the following requirements:

• The name of the owner and address or other means via which to communicate the response to your request.
• The documents that prove the identity (copy of the voting card for example) or, where appropriate, the legal representation of the Data Subject. Identification must be official.
• A clear and precise description of the personal data with respect to which one seeks to exercise any of the rights of access, rectification, cancellation or opposition.
• Where appropriate, the modifications to be made and provide the documentation that supports the request.
• Any other element that facilitates the location of personal data.
• The letter must be addressed to the Company.

 

 

 

The Request will be sent to the Committee or the Data Processor via email at contacto@dulcedelana.com, and it will be sent internally to the person who receives and answers such requests.

 

The Company will notify the Data Subject of the decision adopted via email to the email address from which the request originates, within a period of 20 (twenty) business days from the date the request for access, rectification, cancellation or opposition was received. The request will be considered as received the moment it enters our server.

Once the reply has been sent within the indicated period, the Company will have 15 (fifteen) business days to execute the Access, Rectification, Cancellation or Opposition of the personal data according to the request or similar rights.

 

Dulce de Lana asks the User to update their data each time they undergo any modification, as this will allow the Company to provide an efficient and personalized service.

 

When the data is no longer necessary for the fulfillment of the purposes set forth in this privacy notice and the applicable legal provisions, they must be canceled, blocked and deleted by operation of law.

 

Procedures for blocking and deleting personal data

 

Once the data has been canceled, the Company will keep the Data Subject’s personal data for one more month, for purposes of clarification and preparation for deletion. Once this period has expired, the Company will permanently delete the Data Subject’s personal data, hereby eliminating any opportunity to locate or contact the Data Subject who will be eliminated from the database along with  any file related to the Data Subject. Should the Data Subject have further interaction with the Company, they must initiate the new relationship as if the previous relationship had never existed.

 

The foregoing, observing that which is indicated in the Privacy Policies for the purpose of conserving information by operation of law or relevant authority.

 

The personal data that have fulfilled their purposes, but which cannot be canceled or deleted by operation of law or contract, will be blocked from the purposes to which they were submitted, until they can be deleted. During this period, personal data may not be processed.

 

Privacy of minors

Dulce de Lana does not intentionally collect information from minors. It is therefore recommended that parents and guardians carry out the activities of purchasing products or registering on the Website themselves.

 

Consent

The User declares that by using the page, proportioning their Personal Data, or the direct realization of contractual or extra-contractual origin with Dulce de Lana, they have already read this notice and consented to what is stipulated therein. The User consents to this Privacy Notice, in accordance with the Federal Law for the Protection of Personal Information in Possession of Private Entities.

 

Revocation of consent

Consent may be revoked at any time without subsequent consequences. To revoke consent, the User must send a Request in writing with the following requirements:

• The name of the Data Subject and address or other means via which to communicate the response to the request.
• The documents that prove the identity (copy of the voting card for example) or, where appropriate, the legal representation of the Data Subject. Identification must be official.
• A clear and precise description of the conection that the User has with the Company.
• Provide the documentation that supports the User’s request.
• The letter must be addressed to the Company.
• To verify that the relationship with the Company has ended.

 

The Company will issue a response in which it will confirm the revocation of consent, or where appropriate, it will indicate the reasoning depending on the specific case. The company has 15 (fifteen) days to issue this response. The time limit (15 days) will be counted from the moment the mail enters Dulce de Lana’s server.

 

Any request subsequent to the one mentioned in the previous paragraph will have the same effect as an initial request, the User and the Company being bound by the same terms indicated above.

 

The Request will be considered ivalid in the event of the omission of the above.

 

Modifications to the Privacy Notice

 

The Company, as well as the Data Subject, acknowledge that this Privacy Notice is of unlimited validity. However, the Company will endeavor to keep this Notice updated.

 

Dulce de Lana reserves the right to make modifications to these Privacy Policies at any time and adapt them to new legislation, jurisprudence, internal policies, new requirements for the provision or offering of our services or products, as well as market practices. It is the responsibility of the User to periodically read the terms and conditions of this Privacy Notice to be aware of said modifications, which when introduced on the Website will automatically take effect.

 

Amendments to the Privacy Notice will be made known to the User through a notice on the Home Page of the Company’s Website.

 

Liability exclusion

The Website may contain links, hyperlinks or hypertext “links”, banners, buttons and / or Internet search tools whcih, when used by Users, lead to other portals or Internet sites that could be owned by third parties. Dulce de Lana does not control said sites nor is it responsible for the Privacy Notices that they display, the personal data that Users provide through these portals or Internet sites other than the Website, which must be verified in the Notice of Privacy on every site accessed.

 

In addition, the Company may provide social media functions on the Website that allow the User to share information from the Website on their social networks and to interact with Dulce de Lana on various social media sites. The use of these functions may imply that information about the Data Subject is collected or shared, which will depend on each specific function. We recommend that Users review the settings and privacy policies of the social media sites with which those sites interact.

 

Final provisions

This document is an integral part of the Terms and Conditions of Use of the Dulce de Lana Website, which constitutes a legal agreement between the User and the Company. If the User uses the services of the Dulce de Lana Site, it means that they have read, understood and agreed to the terms set forth above.

 

If you agree to have read this Privacy Notice and do not express your opposition for your personal data to be processed or transferred, it will be understood that you have given your consent to do so.

This Privacy Notice will be governed and interpreted in accordance with the laws of Mexico.

 

If the User considers that their rights regarding the protection of personal data have been violated, they have the right to go to the corresponding authority to defend the exercise of said rights. The authority is the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI), whose website is: www.inai.org.mx.