Privacy policy

Last updated: September 6, 2026

Sobrados World operates this store and website, including the related information, content, features, tools, products, and services that make up our international online store (the “Services”). Sobrados World is powered by Shopify, which enables us to provide the Services. This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information when you visit or use the Services, make a purchase or other transaction, or communicate with us.

If this Privacy Policy conflicts with our Terms of Service regarding the collection, processing, or disclosure of personal information, this Privacy Policy controls. Please read it carefully.

Controller and Scope

Sobrados World is responsible for the international online store operated from Mexico. While the Mexican company is being incorporated, its legal name, registered address, and tax details will be added when they are formally available. For purposes of applicable data protection laws, Sobrados World is the controller of your personal information except where Shopify or another provider acts as an independent controller for its own processing.

Personal Information We Collect or Process

“Personal information” means information that identifies or can reasonably be linked to you or another person. It does not include anonymous or de-identified information. Depending on how you interact with the Services, where you live, and applicable law, we may collect or process:

  • Contact information, such as your name, billing and shipping addresses, phone number, and email address.
  • Account information, such as your username, password, security questions, preferences, and settings.
  • Order and transaction information, including products you view, add to your cart or wishlist, purchase, return, exchange, or cancel; order history; delivery and tracking details; and Gift Card recipient details when supplied by the purchaser.
  • Payment and fraud-prevention information, such as payment method, payment confirmation, transaction details, and fraud signals. Payment providers process complete payment-card data; Sobrados World does not store complete card numbers.
  • Communications and submitted content, including customer-support requests, reviews, survey responses, promotion entries, and wholesale applications.
  • Device, usage, and technical information, including device and browser information, network connection, IP address, identifiers, interactions with the Services, cookies, pixels, and similar technologies.
  • Inferences, such as preferences or interests derived from the information above, where permitted by law.

Shipping and Customs Identification

To process and deliver orders, we may collect the recipient’s identification number, RFC or tax identification number, or passport number when required for shipping, customs clearance, carrier requirements, or applicable law. We use this information only to fulfill and deliver the order, complete customs formalities, and comply with applicable legal obligations. We may share it only with carriers, logistics providers, customs authorities, and service providers involved in fulfilling the order. We retain it only for as long as necessary for these purposes or as required by law.

Sources of Personal Information

We may collect personal information directly from you; automatically through the Services, your device, cookies, pixels, and similar technologies; from Shopify and other service providers that process information on our behalf or enable the Services; and from partners or other third parties as permitted by law.

How We Use Personal Information

  • Provide and improve the Services: process payments and orders; manage accounts, Gift Cards, wholesale applications, shipping, tracking, returns, exchanges, and refunds; remember preferences; enable reviews; and tailor the shopping experience.
  • Communicate with you: provide customer support and send transactional, account, order, delivery, service, or policy notices.
  • Marketing and advertising: send promotional communications where permitted and show or measure advertising, including advertising based on activity on the Services or other websites, subject to applicable consent and opt-out rights.
  • Security and fraud prevention: authenticate accounts, secure the Services, and detect, investigate, or act on suspected fraudulent, illegal, unsafe, or malicious activity.
  • Legal and operational purposes: comply with law and valid legal process, enforce our terms and policies, resolve disputes, and protect our rights and those of customers or others.

Cookies and Consent

We use essential cookies and similar technologies needed to operate the Services. Where required, non-essential cookies and technologies used for analytics, personalization, or advertising are controlled through Shopify Customer Privacy choices. You can use the cookie banner or available privacy controls to accept, decline, or manage preferences where those options apply. Withdrawing consent does not affect processing that occurred lawfully before withdrawal.

Legal Bases and Automated Processing

Where applicable law requires a legal basis, we process personal information as necessary to perform a contract with you, comply with legal obligations, pursue legitimate interests that are not overridden by your rights, or based on consent. We do not make decisions based solely on automated processing that produce legal or similarly significant effects unless this is disclosed and permitted by applicable law.

How We Disclose Personal Information

For the purposes described above, we may disclose personal information to Shopify; payment and fraud-prevention providers; carriers, logistics providers, and customs authorities; fulfillment, cloud, IT, customer-support, security, analytics, and communication providers; review providers such as Judge.me; and advertising or marketing partners such as Meta where permitted by your choices and applicable law. We may also disclose information when you direct or consent to it, to affiliates, in connection with a business transaction, or to comply with legal obligations and protect rights or safety.

We do not sell or rent personal information for money. Certain advertising-related disclosures may be considered a “sale,” “sharing,” or targeted advertising under some laws; applicable opt-out rights are described below.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services to provide and improve them. Information submitted through the Services is transmitted to Shopify and may be shared with service providers in countries other than where you reside. We also use Shopify features that may combine information from interactions with our store, other merchants, and Shopify. For processing performed for Shopify’s own purposes, Shopify is responsible for that processing and for responding to applicable rights requests. Learn more in the Shopify Consumer Privacy Policy or use the Shopify Privacy Portal.

Data Sharing Opt-Out and Global Privacy Control

Depending on where you live, you may have the right to opt out of the sale or sharing of personal information or processing for targeted advertising. You can exercise that right through Your Privacy Choices. If you visit the Services with a Global Privacy Control (GPC) opt-out signal enabled, depending on your location we will automatically treat it as an opt-out request for that device and browser. If Shopify can associate the device with a Shopify account, the opt-out may also apply to that account. Learn more at Global Privacy Control. Other than GPC, we do not recognize other “Do Not Track” signals sent by a browser or device.

Third-Party Websites and Social Platforms

The Services may link to websites, apps, or social platforms operated by third parties. Their privacy and security practices are governed by their own notices. Information you post in public or semi-public areas, including social networks or reviews, may be visible and used by others. A link does not by itself mean that we endorse or control the third party.

Children’s Data

The Services are not intended for children, and we do not knowingly collect personal information from anyone under the age of majority in their jurisdiction. A parent or guardian may request deletion through the Contact page. As of the effective date of this Privacy Policy, we do not have actual knowledge that we sell or share, as defined by applicable law, personal information of individuals under 16.

Security and Retention

We use reasonable safeguards, but no security measure or transmission method is completely secure. Do not send sensitive or confidential information through unsecured channels. We retain personal information only as long as reasonably necessary to provide the Services, maintain accounts, complete transactions, meet legal or accounting obligations, resolve disputes, enforce agreements, and protect legitimate interests. Retention periods vary by the type of information and applicable requirements.

International Transfers

We may transfer, store, and process personal information outside the country where you live. When information is transferred outside the European Economic Area or the United Kingdom, we rely on recognized mechanisms such as adequacy decisions, the European Commission’s Standard Contractual Clauses, or equivalent UK safeguards, as applicable.

Your Rights and Choices

Depending on where you live, you may have rights to access or know about personal information; correct it; delete it; receive a portable copy; object to or restrict certain processing; withdraw consent; and opt out of sale, sharing, or targeted advertising. In Mexico, these may include the rights of Access, Rectification, Cancellation, and Opposition (ARCO), as well as the rights to revoke consent and limit the use or disclosure of personal information. Rights are not absolute and may be subject to legal exceptions.

You may unsubscribe from promotional messages using the unsubscribe option in those messages. We may still send non-promotional communications about your account, orders, or the Services.

Privacy Requests and Verification

Submit a request through our Contact page. Use “PRIVACY REQUEST” in the subject or first line and include your name, the email address or order associated with the request, the right you wish to exercise, and enough detail for us to understand it. We may need to verify your identity and authority before responding. An authorized agent may act where permitted by law, subject to proof of authorization. We will not discriminate against you for exercising a privacy right and will respond within the period required by applicable law.

For personal information processed by Shopify for its own purposes, visit the Shopify Privacy Portal.

Complaints

If you have a complaint about our handling of personal information, contact us through the Contact page. Depending on where you live, you may also appeal a decision or complain to your local data protection authority. People in the EEA can find supervisory authorities through the European Data Protection Board.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our practices or for operational, legal, or regulatory reasons. We will post the revised policy on this website, update the “Last updated” date, and provide any notice required by law.

Contact

For questions about this Privacy Policy, our privacy practices, or your rights, use our Contact page. This is the public customer-support and privacy-request channel for Sobrados World.