Política de privacidad

Last updated: September 14, 2026

Data Controller

The controller responsible for the processing of personal data is EHCUOBM LLC, operating under the trade name Herbaluma.

Business address: 8206 Louisiana Blvd NE, Ste A #9696, Albuquerque, New Mexico 87113, United States.

Privacy email: support@herbaluma.com.

For any request related to personal data, the data subject may contact the Privacy Department of EHCUOBM LLC using the email address indicated above.

⸻

This Privacy Policy (hereinafter, the “Policy”) comprehensively governs the collection, use, processing, retention, protection and, where applicable, disclosure of personal data obtained through this e-commerce website (hereinafter, the “Site”), as well as through the services, features, tools, content and products offered through it (collectively, the “Services”).

The Store uses the technological infrastructure provided by Shopify to manage and operate the Site and to provide the Services offered to users. The purpose of this Policy is to clearly and transparently explain how we process the personal information of individuals who visit the Site, make purchases, use the Services or otherwise communicate with Herbaluma.

Access to the Site allows users to review this Policy and understand how their personal data will be processed. Use of the Site or completion of a purchase will not, by itself, constitute consent for processing activities that legally require an explicit manifestation of consent, such as certain marketing-related processing activities or the processing of sensitive personal data.

⸻

Scope of Application

This Policy applies to all processing of personal data carried out in connection with the operation of the Site and the Services offered by Herbaluma.

The Policy governs the processing of personal information obtained during browsing, use of the Services, placement of orders, communications with Herbaluma and any other interaction the user may have with the Site.

Herbaluma markets and ships its products exclusively within the United Mexican States. Accordingly, the processing of customers’ personal data is governed by the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations and other applicable Mexican legislation.

Where applicable law grants additional rights or establishes additional obligations regarding personal data protection, such rights and obligations will apply to the extent legally required.

⸻

Personal Information We Collect

For purposes of this Policy, personal information means any information that directly or indirectly identifies or can identify an individual. Properly anonymized data or information that can no longer reasonably identify an individual will not be considered personal information.

Depending on how the user interacts with the Site, we may collect and process the following categories of information:

Identification and contact information

We may collect information necessary to identify the user and manage the commercial relationship, including, among other things:

• First and last name.

• Billing address.

• Shipping address.

• Email address.

• Telephone number when necessary for proper order management or delivery.

This information is used primarily to manage purchases, coordinate shipments, provide customer service and maintain communications necessary in connection with the Services.

Payment-related information

Payments made through the Site are processed through Shopify Payments or other payment gateways integrated into the Shopify platform.

Herbaluma does not store full bank card numbers, security codes, financial credentials or other sensitive payment information. Such data is processed directly by the relevant specialized payment service providers in accordance with their own privacy policies and security measures.

Order and transaction information

We may collect information relating to commercial activity carried out through the Site, including:

• Products purchased.

• Order history.

• Purchase confirmations.

• Order status.

• Information necessary to manage exchanges, returns, refunds or issues relating to purchases.

Communications with Herbaluma

When the user contacts us through any available channel, we may process the information contained in those communications, including inquiries, requests, complaints, reviews or any other information voluntarily provided by the user.

Technical and browsing information

While using the Site, we may automatically collect certain technical information relating to the device and browsing activity, including:

• IP address.

• Browser type and version.

• Device used.

• Operating system.

• Browsing data.

• Pages visited.

• Date and time of access.

• Technical information necessary to ensure the operation, performance and security of the Site.

Collecting this information allows us to maintain proper operation of the Services, detect technical issues, strengthen platform security and improve the overall browsing experience.

⸻

Cookies and Tracking Technologies

The Site uses first-party and third-party cookies, as well as measurement, analytics and advertising technologies, which may include Meta Pixel (Facebook and Instagram), Google Analytics and TikTok Pixel.

These technologies may allow us to measure Site performance, analyze browsing activity, attribute conversions, prevent fraud, generate statistics and, where there is a valid legal basis or where consent is required, display or measure advertising related to the user’s interactions with the Site.

Non-essential analytics or advertising technologies will be used in accordance with the user’s preferences and the requirements of applicable law. Users may manage their preferences through the mechanisms made available on the Site, in addition to the settings available in their browser and on the relevant platforms.

Herbaluma seeks to limit information shared with advertising platforms to the data and events necessary for authorized measurement, attribution and advertising purposes. We do not intentionally transmit to Meta, Google, TikTok or other advertising platforms information provided in customer service communications that reveals health status, medical conditions, treatments, allergies or other sensitive personal data.

Disabling certain cookies or technologies may affect some Site functionality or the accuracy of advertising measurement.

Sensitive Personal Data

Herbaluma does not routinely request sensitive personal data in order to complete a purchase and does not intend to use such data for advertising, audience creation, commercial profiling or advertising personalization.

However, due to the nature of some products sold, a user may voluntarily disclose information relating to health, allergies, treatments or other personal circumstances when contacting customer service. In such cases, Herbaluma will limit the processing of such information to what is strictly necessary to address the relevant request and will apply the consent requirements and safeguards required by applicable law.

Where the processing of sensitive personal data requires express written consent under the LFPDPPP, such consent will be requested through an appropriate mechanism before carrying out the relevant processing.

Herbaluma will not intentionally use sensitive personal data for advertising purposes or include such information in audiences intended for advertising platforms.

⸻

Sources of Information

Personal information may be obtained from the following sources:

Information provided directly by the user

We collect information that the user provides when they:

• Make a purchase.

• Create a customer account.

• Complete forms available on the Site.

• Contact Herbaluma.

• Request assistance.

• Post reviews or ratings where such functionality is available.

• Use any of the Services offered.

Information collected automatically

Certain information is obtained automatically during browsing through technologies integrated into the Shopify platform and other tools necessary for the technical operation of the Site, protection against misuse and improvement of the Services.

Information obtained from third parties

We may also receive information provided by third parties whose involvement is necessary to provide the Services, including technology providers, payment processors, logistics operators and other service providers whose participation is necessary for proper management of the Store’s activities.

⸻

How We Use Personal Information

Depending on how the user interacts with the Site or Services, we may process personal information for the following purposes:

Provision of the Services

We use personal information necessary to provide the Services offered through the Site, including:

• Managing and processing orders placed by the user.

• Confirming purchases and payments.

• Coordinating preparation and delivery of products.

• Managing exchanges, returns, refunds and order-related issues.

• Facilitating necessary communications during the purchase process.

• Allowing reviews or ratings to be posted where such functionality is available.

Processing this information is necessary to properly perform the commercial relationship established between the user and Herbaluma.

Customer Service and Communications

We may use personal information provided by the user to respond to inquiries, resolve issues, manage complaints, provide assistance relating to purchased products and maintain communications necessary for the commercial relationship.

We may also send communications relating to orders, contracted services or information relevant to the proper provision of the Services.

Marketing and Commercial Communications

Where there is a valid legal basis or where the user has provided consent when required, we may use certain personal information to send marketing communications, promotions, news or information about products offered by Herbaluma.

Such communications may be tailored based on the user’s interactions with the Site, including products viewed, products added to cart or previous purchases.

The user may withdraw consent or change communication preferences at any time through the mechanisms available in those communications or by contacting Herbaluma through the available channels.

Security, Fraud Prevention and Site Protection

We may use personal information to ensure Site security, prevent fraudulent or improper activity and protect the rights of both Herbaluma and its users.

These purposes may include:

• Verifying transactions carried out through the Site.

• Detecting suspicious or fraudulent activity.

• Investigating potential misuse of the Services.

• Protecting the integrity, security and operation of the platform.

• Taking necessary measures in response to unlawful activity or conduct contrary to the Site’s terms of use.

Compliance with Legal Obligations

We may process personal information where necessary to comply with applicable legal, tax, administrative or regulatory obligations and to respond to valid requests issued by competent authorities.

We may also use personal information where necessary to defend our rights, legitimate interests or legal position in administrative, judicial or extrajudicial proceedings.

Herbaluma does not sell, rent or trade users’ personal information as an independent asset.

Primary or Necessary Purposes

Personal data will be processed mainly to process orders, manage payments, prepare and deliver products, respond to inquiries, process returns, prevent fraud, comply with legal obligations and maintain Site security.

These purposes are necessary to maintain the commercial relationship with the customer.

Secondary Purposes

Where legally permitted and, where applicable, with the data subject’s consent, we may process certain data to send promotions, personalize communications, measure advertising campaigns, attribute conversions, create or use advertising audiences permitted by the relevant platforms and display advertising related to the user’s interactions with the Site.

These activities may involve advertising and measurement providers such as Meta, Google or TikTok, always within the limits established in this Policy, applicable law and the terms of use of those platforms.

The user may object to these purposes or request that their data no longer be used for marketing communications or advertising purposes where applicable by writing to support@herbaluma.com, using the unsubscribe link included in marketing emails or through the preference mechanisms enabled on the Site.

Refusal of secondary purposes will not prevent the user from making a purchase or receiving the primary Services.

⸻

Consent

By providing personal data through the Site, the data subject consents to its processing for the primary purposes described in this Policy.

Processing for secondary purposes, including marketing communications and personalized advertising, requires the data subject’s consent where legally required. Such consent may be provided through the mechanisms enabled on the Site and may be revoked at any time in accordance with the relevant section below.

Herbaluma may process personal data without the data subject’s consent in the cases provided for in Article 9 of the LFPDPPP, including compliance with obligations arising from a legal relationship between the data subject and the controller, compliance with applicable legal obligations and situations of urgency or emergency provided for under applicable law.

⸻

Disclosure of Personal Information to Third Parties

We may disclose personal information to third parties only where necessary to provide the Services, comply with legal obligations, perform the contractual relationship with the user or protect our rights.

Third parties that may receive personal information include:

Shopify

We use Shopify as the technology platform to operate and manage our online store.

Shopify may process certain personal information necessary to provide the technical infrastructure of the Site, enable e-commerce functionality, ensure platform security and provide features necessary for the Services.

Payment Providers

Data necessary to process transactions made through the Site may be processed by external providers specializing in payment services, including Shopify Payments or other available payment gateways.

These providers process information in accordance with their own privacy policies and security measures.

Logistics Providers and Operational Partners

We may disclose information necessary to prepare and deliver orders to logistics providers, carriers and partners responsible for certain operational stages related to the management of purchased products.

The information shared will be limited to what is strictly necessary for the relevant purpose.

Technology and Marketing Providers

We may use external services for Site operation, technical analysis, customer service, security, measurement, attribution and management of communications or advertising. These providers may include Meta Platforms, Google, TikTok and other services integrated with Shopify.

Where these tools are used for measurement or advertising, they may receive technical information or Site-event information, such as technical identifiers, pages viewed, products viewed, products added to cart or purchase events, to the extent permitted by applicable law and the user’s preferences.

Herbaluma does not intentionally provide advertising platforms with full card numbers, security codes or information communicated to customer service that reveals sensitive personal data.

Providers processing information on behalf of Herbaluma must do so only for the relevant purposes and in accordance with applicable contractual and legal obligations.

Not every disclosure of information to a provider constitutes a transfer requiring additional consent. Where a transfer falls within the cases permitted without consent under Article 36 of the LFPDPPP, it may be carried out in accordance with that provision. Where a transfer requires the data subject’s consent, Herbaluma will request such consent before carrying it out.

Herbaluma does not sell, rent or trade personal data as an independent asset.

⸻

Relationship with Shopify

The Services are hosted and operated using the technology platform provided by Shopify.

Information submitted by the user through the Site may be processed by Shopify and by providers acting on its behalf to enable the technical operation of the platform, manage commercial operations, ensure the security of the digital environment and provide functionality necessary for the proper provision of the Services.

Due to the international nature of the technological services used, certain personal information may be stored or processed on servers located in countries other than the user’s country of residence.

Where Shopify processes personal information for its own purposes in accordance with its responsibilities as a technology service provider, such processing will be carried out in accordance with its own applicable policies and terms.

For more information about Shopify’s processing of personal data, the user may consult Shopify’s Privacy Policy available through its platform.

⸻

International Data Transfers

Due to the digital nature of e-commerce and the use of international technology and operational providers, certain personal information may be transferred, stored or processed in countries other than the user’s country of residence.

Such transfers may occur where necessary to:

• Properly provide the Services.

• Manage payments and commercial operations.

• Coordinate preparation and delivery of orders.

• Use technology providers necessary for Site operation.

• Comply with applicable legal obligations.

Where necessary, such transfers will be carried out in accordance with this Privacy Policy, the LFPDPPP and applicable legal safeguards. Where the data subject’s consent is legally required for an international transfer, Herbaluma will request such consent before carrying it out; where one of the exceptions set out in Article 36 of the LFPDPPP applies, the transfer may be carried out without additional consent.

Disclosure of personal information to third parties located in other countries will be limited to data that is appropriate and necessary for the relevant purpose.

⸻

Data Security and Retention

We adopt reasonable technical, organizational and administrative measures designed to protect personal information against loss, misuse, unauthorized access, improper disclosure, alteration or destruction.

Such measures include internal security procedures, access controls and the use of technology providers that apply measures designed to protect the information processed through their platforms.

However, no electronic transmission, storage or processing system can guarantee absolute security. Herbaluma will maintain reasonable and proportionate measures designed to reduce the risks of unauthorized access, use, alteration, loss or disclosure.

Users must also take reasonable measures to protect their own devices, accounts and access credentials.

With respect to data retention, we retain personal data only for as long as necessary to fulfill the purposes described in this Policy, including:

• Managing and fulfilling orders.

• Providing the Services.

• Customer service.

• Compliance with legal, tax or administrative obligations.

• Fraud prevention and detection.

• Resolution of potential disputes.

• Defense of our rights and legitimate interests.

Data relating to contractual breaches, fraud, chargebacks, returns or disputes may be retained for the period permitted by applicable law where necessary to document transactions, exercise or defend rights or comply with legal obligations.

Once personal data is no longer necessary for those purposes and applicable statutory retention periods have expired, the data will be deleted, anonymized or blocked in accordance with applicable law.

⸻

Minors’ Data

The Site and Services offered by Herbaluma are not directed to minors under applicable law.

We do not knowingly collect personal information from minors who do not have the legal capacity necessary to make purchases or use the Services.

Orders through the Site are intended exclusively for individuals with sufficient legal capacity to enter into sales contracts.

If a parent or legal representative believes that a minor has provided personal information to Herbaluma without the required authorization, they may contact us to request review of that information and, where appropriate, its deletion.

If we become aware that personal information of a minor has been collected without valid authorization, we will take reasonable steps to delete such information as soon as reasonably possible.

⸻

ARCO Rights

Under the LFPDPPP, the data subject has the right to Access their personal data, Rectify it where it is inaccurate or incomplete, Cancel it where they believe it is no longer necessary for the stated purposes, and Object to its processing for specific purposes (ARCO rights).

The data subject may also revoke previously granted consent and limit the use or disclosure of their personal data.

Procedure for Exercising ARCO Rights

Requests must be sent to support@herbaluma.com and include:

Full name of the data subject and a means for communicating the response.

A document proving identity or, where applicable, legal representation.

A clear and precise description of the personal data in relation to which the data subject seeks to exercise any ARCO right.

Any other information or document that facilitates locating the personal data.

For rectification requests, the data subject must indicate the requested changes and provide documentation supporting the request.

Herbaluma will communicate its response within a maximum of twenty (20) business days from receipt of the request. If the request is granted, it will be implemented within the following fifteen (15) business days. These periods may be extended once for an equal period where the circumstances of the case justify doing so.

Herbaluma may deny access, rectification, cancellation or objection in the cases provided for in Article 33 of the LFPDPPP, informing the data subject of the reason for the denial.

Revocation of Consent and Limitation of Use

The data subject may revoke consent previously granted for the processing of personal data at any time and may request limitation of the use or disclosure of such data by writing to support@herbaluma.com.

Revocation will not have retroactive effect and will not apply where processing remains necessary to comply with legal obligations or maintain an existing legal relationship.

Management of Marketing Communications

The data subject may stop receiving marketing communications through the unsubscribe link included in such communications or by writing to support@herbaluma.com.

Opting out of marketing communications will not affect communications necessary in connection with orders, contractual obligations or legal requirements.

⸻

Complaints

If the user believes that the processing of their personal information does not comply with applicable law, they may contact Herbaluma so that the matter can be reviewed and any issue can be addressed appropriately.

This does not limit the data subject’s right to approach the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) or any other authority competent in matters of personal data protection under applicable law.

⸻

Third-Party Websites and Links

The Site may contain links or connections to websites, platforms or services operated by third parties that are not under Herbaluma’s control.

The inclusion of such links does not imply approval, recommendation, association or endorsement of the content, products, services or privacy practices of those third parties.

We recommend that users review the privacy policies, terms and conditions and security measures applicable before providing personal information on external platforms.

Herbaluma will not be responsible for personal data processing carried out by independent third parties or for the privacy practices, security, availability or content of such external websites.

⸻

Customer Service

For any inquiries, customers may contact Herbaluma by email at support@herbaluma.com.

Our customer service hours are Monday through Friday, on business days, from 9:00 a.m. to 5:00 p.m., Mexico City time.

Inquiries received outside these hours will be handled as soon as possible during the next available customer service period.

⸻

Changes to this Policy

We may update this Privacy Policy to reflect changes in our practices, services, internal procedures or for operational, legal or regulatory reasons.

The version in force will be the one published on the Site at any given time. We will update the “Last updated” date whenever changes are made and will notify users of such changes where required by applicable law.

⸻

Acceptance

By providing personal data through forms available on the Site or during the checkout process, the data subject confirms that they have read and understood this Privacy Policy and consents to the processing of their personal data for the primary purposes described herein.

Processing for secondary purposes, including marketing communications and personalized advertising, requires a separate manifestation of consent from the data subject where legally required. Such consent may be provided through checkboxes or other mechanisms made available for that purpose and may be revoked at any time in accordance with the Consent Revocation section.

Mere browsing of the Site does not, by itself, constitute consent to processing for secondary purposes where applicable law requires an affirmative indication from the data subject. Non-essential advertising or measurement technologies will be managed in accordance with the preference mechanisms made available on the Site and applicable legal requirements.

⸻

Contact

If the user has any questions, concerns or wishes to exercise their rights or make any request relating to this Privacy Policy or the processing of personal data, they may contact the Data Controller at the following email address:

Email: support@herbaluma.com