Comprehensive Privacy Policy

Last Updated: March 01, 2026

I. Identity and Address of the Data Controller

Joyería Avalon (hereinafter, "the Controller"), with registered address for the purposes of this Privacy Policy in Mexico City, Mexico, is the entity responsible for processing the personal data provided by the Data Subject through this website or any enabled communication channel.

• Contact Email: contacto@avalon-jewelry.com
• Phone: +52 55 6353 0671
• Official Channel: @avalon.joyeros

II. Personal Data Collected

For the purposes specified in this Privacy Policy, the Controller may collect and process the following categories of personal data:

• Identification and Contact Data: Full name, email address, phone number, shipping address, and, if applicable, billing address.
• Transactional Data: Purchased products, order history, amounts, payment method used, and transaction status.
• Technical and Navigation Data: IP address, browser type, site preferences, essential cookies, and, subject to consent, optional analytical cookies.

Sensitive Financial Data: The Controller explicitly declares that it does not store complete bank card details or sensitive financial information on its infrastructure. Payment processing is conducted exclusively by Stripe, Inc., a platform certified under the PCI-DSS Level 1 standard. For Stripe's privacy practices, please refer to stripe.com/privacy.

III. Purposes of Data Processing

The collected personal data will be processed for the following purposes:

A) Primary Purposes (Necessary for the legal relationship)

• To process, manage, and follow up on orders, shipments, billing, and post-sale customer support.
• To address requests, inquiries, complaints, and clarifications from the Data Subject.
• To comply with applicable legal, tax, and regulatory obligations under Mexican law.
• To verify the identity of the Data Subject when necessary for the execution of the commercial transaction.

B) Secondary Purposes (Require consent)

• To perform statistical analysis and browsing behavior reports to improve our services.
• To send commercial communications, promotions, or customized editorial content.

If the Data Subject does not wish their data to be processed for secondary purposes, they may express this at any time using the mechanisms described in Section V of this Privacy Policy.

IV. Personal Data Transfers

The Controller may transfer personal data, without requiring additional consent from the Data Subject, under the circumstances set forth in Article 37 of the LFPDPPP, including those transfers necessary for the fulfillment of the contractual relationship (payment processor Stripe, Inc., logistics and shipping services, technological infrastructure).

Every processor or third-party recipient is obligated to observe the same confidentiality and security measures as those adopted by the Controller. No transfers will be made to third parties for purposes other than those specified herein without the prior consent of the Data Subject.

V. ARCO Rights and Revocation of Consent

The Data Subject has the right to Access their personal data, Rectify it if inaccurate or incomplete, Cancel it if they consider it is no longer required for any of the specified purposes, or Oppose its processing for specific purposes (ARCO Rights), as well as to revoke their consent for data processing for secondary purposes.

To exercise any of these rights, the Data Subject must submit a written request to the email address contacto@avalon-jewelry.com, including:

1. Full name of the Data Subject and contact details to receive the response.
2. Clear and precise description of the right they wish to exercise and the personal data in question.
3. Any document or information that facilitates locating the personal data (order number, email address used, approximate date of the transaction).

The Controller will respond to the request within twenty (20) business days following receipt of the complete application, in compliance with Article 32 of the LFPDPPP.

VI. Use of Cookies and Tracking Technologies

This website uses cookies and local storage technologies. Essential cookies are necessary for the technical operation of the site and do not require consent. Optional cookies (analytics and experience enhancement) will only be activated with the express consent of the Data Subject.

The Data Subject may manage their cookie preferences at any time from this section:

For more information about the technologies used, please consult our Cookies Policy.

VII. Security Measures

The Controller has implemented and maintains administrative, technical, and physical security measures that protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, in compliance with the LFPDPPP and its Regulations.

VIII. Modifications to the Privacy Policy

The Controller reserves the right to make modifications or updates to this Privacy Policy at any time, resulting from legislative reforms, internal policies, new service needs, or other causes. The current version will always be available for consultation at this same web address.

IX. Competent Authority

If the Data Subject believes that their right to personal data protection has been violated by any conduct of the Controller, they may file a complaint or claim before the National Institute for Transparency, Access to Information and Personal Data Protection (INAI). For more information, please visit www.inai.org.mx.