Data Controller
Shimco (the "Controller") is responsible for the processing of the personal data of its customers and visitors (the "Data Subject"), in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on March 20, 2025 (the "Law"), its Regulations, and other applicable provisions.
Contact: contacto@shimco.mx
This Privacy Notice describes how Shimco collects, uses, transfers, and protects the personal data of the Data Subject when they visit the online store, make a purchase, or communicate with Shimco (the "Services"). The store operates on Shopify's technology infrastructure.
By using the Services, the Data Subject acknowledges that this Notice was made available to them. If they do not express their objection, they are understood to consent to the processing of their data in accordance with this Notice, except in cases where the Law requires express consent.
Personal Data Collected
To fulfill the purposes of this Notice, Shimco collects the following categories of personal data:
-
Identification and contact: full name, postal address, billing address, shipping address, phone number, and email address.
-
Financial and asset-related: credit or debit card numbers, payment account information, transaction details, payment method, and payment confirmations.
-
Account: username, encrypted passwords, and configuration preferences.
-
Transactions: items viewed, added to the cart or wish list, purchases, returns, exchanges, and cancellations.
-
Electronic and browsing: IP address, browser type, unique device identifiers, cookies, and analytics tracking technologies.
Financial data. Its processing requires the express consent of the Data Subject, which is given when the transaction is processed.
Sensitive data. Shimco does not request or process sensitive personal data as defined by the Law, such as racial or ethnic origin, health status, genetic information, religious, philosophical, or moral beliefs, political opinions, or sexual preference.
Purposes of Processing
Primary purposes. These are necessary for the legal relationship between the Data Subject and Shimco, and therefore do not require consent:
- Process, manage, ship, and deliver the Data Subject's purchases and orders.
- Process payments, invoice, and validate transactions to prevent fraud.
- Manage cancellations, exchanges, and returns through Shimco's customer service channels.
- Provide customer service and resolve questions, complaints, or clarifications.
- Maintain platform security, authenticate the Data Subject's account, and prevent unlawful or malicious activity.
Secondary purposes. These are not necessary for the legal relationship and require the consent of the Data Subject:
- Send commercial communications, promotions, newsletters, and product offers from Shimco via email or text message.
- Display personalized advertising and product suggestions based on the Data Subject's browsing habits.
The Data Subject may deny or withdraw their consent for secondary purposes at any time by writing to contacto@shimco.mx. This refusal does not affect their purchases or the service they receive.
If Shimco intends to process the data for a purpose other than those described here, it will request the Data Subject's consent again.
Transfers of Personal Data
The Data Subject's personal data may be shared within and outside Mexico with the following recipients:
| Recipient |
Purpose |
Consent of the Data Subject |
| Shopify Inc. and its affiliates |
Operating the online store, cloud storage, and payment gateways |
Not required (Article 36, sections IV and VII of the Law) |
| Shipping and logistics companies |
Managing the shipment, delivery, exchanges, and returns of products |
Not required (Article 36, section VII of the Law) |
| Competent authorities |
Complying with legal provisions, court orders, or defending Shimco's rights |
Not required (Article 36, sections I, V, and VI of the Law) |
| Third parties for personalized advertising |
Displaying advertising based on the Data Subject's browsing habits |
Required |
Third parties that receive the data assume the same obligations as Shimco and must process it in accordance with this Notice.
Acceptance clause. The Data Subject may refuse transfers that require their consent by writing to contacto@shimco.mx. If they do not express their refusal, they will be understood to accept them.
ARCO Rights and Revocation of Consent
The Data Subject, or their legal representative, may at any time exercise their rights of Access, Rectification, Cancellation, and Objection (ARCO rights), as well as revoke the consent they have granted.
-
Access: to know what personal data Shimco holds and the conditions of its processing.
-
Rectification: to request correction of inaccurate, incomplete, or outdated data.
-
Cancellation: to request that the data be deleted from Shimco's files, records, and systems. Cancellation results in a blocking period, after which the data is erased.
-
Objection: to object, for a legitimate reason, to the processing of their data, including automated processing without human intervention that significantly affects their interests, rights, or freedoms.
How to submit a request. The Data Subject must send a written request to contacto@shimco.mx that includes:
- The name of the Data Subject and an address or email for receiving notifications.
- A document proving their identity or, where applicable, the identity and authority of their representative.
- A clear and precise description of the personal data on which they wish to exercise the right, unless the request concerns the right of access.
- A description of the right they wish to exercise or what they are requesting.
- Any other element or document that helps locate the data.
For rectification requests, the Data Subject must also indicate the changes to be made and provide the documentation supporting them.
Deadlines. Shimco will communicate its decision within a maximum of 20 business days from receipt of the request. If the request is granted, it will be carried out within 15 business days after the response. Each deadline may be extended once, for an equal period, when the case justifies it.
Response and cost. Shimco will respond through the same channel in which it received the request and, if it denies the request in whole or in part, will state the reason. Exercising ARCO rights is free of charge; only reproduction, copying, or shipping costs may be charged.
Revocation of consent. The Data Subject may revoke their consent at any time, without retroactive effect, through the same procedure. Revocation does not apply to data necessary to fulfill obligations arising from the legal relationship with Shimco or from a legal provision.
Options to Limit the Use or Disclosure of Data
In addition to ARCO rights, the Data Subject may limit the use or disclosure of their data through these means:
- Request by email to contacto@shimco.mx that Shimco stop sending them commercial communications or using their data for personalized advertising.
- Disable cookies through their browser settings.
Cookies and Tracking Technologies
The store uses cookies, web beacons, and other technologies that allow the monitoring of the Data Subject's behavior as an internet user, in order to provide a better service and browsing experience.
The Data Subject may disable cookies through their browser settings. Doing so may limit certain functions of the online store.
Information Security
Shimco maintains administrative, technical, and physical security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing.
If a security breach occurs that significantly affects the Data Subject's economic or moral rights, Shimco will inform them immediately so they can take appropriate action.
No data transmission over the internet is completely secure. Shimco recommends that the Data Subject not send financial information through channels other than Shopify's payment platform.
Competent Authority
The authority for the protection of personal data held by private parties is the Anticorruption and Good Government Secretariat, which replaced the INAI.
If the Data Subject does not receive a response to their ARCO request or is dissatisfied with it, they may file a data protection request with the Secretariat. The deadline is 15 business days from Shimco's response or from the expiration of the response deadline.
Changes to the Privacy Notice and Contact
This Notice may be modified due to new legal requirements, changes in Shimco's products or services, or changes in its privacy practices. Shimco will communicate any changes by publishing the updated text in this section of the website, with the date of the last update.
For questions or comments about this Notice, the Data Subject may write to contacto@shimco.mx.
