Privacy notice

1. Data controller

Miguel Ángel Muñoz García, an individual doing business under the trade name "Hephaestus MX" ("Hephaestus"), with an address for notices at C. Cabo San Lucas, Centro, 23450 Cabo San Lucas, B.C.S., Mexico, is responsible for processing your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and other applicable rules.

Contact: [email protected] · +52 (624) 319 3309.

2. Personal data we process

• Identification and contact: name, email and phone number.
• Delivery address, when you choose home delivery.
• Account data: email and password (stored encrypted; we never know it).
• Order information: products, amounts, delivery method, and payment and delivery status.
• Fabrication requests: descriptions, measurements, photos, design files and messages you send us.
• Tax data, only if you request an invoice: RFC, name or company name, tax regime, tax postal code and CFDI use.
• Technical data: IP address and session data needed for the site's security and operation.

We do not collect or store card data: payments are processed directly by Stripe. We do not request sensitive personal data; please do not include it in files or messages.

3. Purposes

We use your data for the following purposes, which are necessary for your relationship with us:

• Creating and managing your account.
• Processing, charging, fabricating, delivering or preparing your orders for pickup.
• Receiving, assessing and quoting the parts you send us, and following up on them.
• Contacting you about orders, requests, deliveries and inquiries.
• Handling warranties, returns, cancellations and complaints.
• Issuing tax invoices when you request them.
• Protecting the site's security and preventing fraud.
• Complying with legal obligations and requests from competent authorities.

We do not use your data for secondary purposes such as marketing, advertising or sales prospecting. If we ever want to, we will ask for your consent first.

4. Consent

By providing your data, creating an account or placing an order after reading this notice, you consent to its processing for the purposes above.

5. Processors and transfers

We rely on providers that process data on our behalf and under our instructions, some with servers outside Mexico:

• Stripe: payment processing (it also processes your payment data under its own privacy notice).
• Railway: hosting for the site and database.
• Cloudflare: content delivery network and security.

We only share your data with third parties when needed to fulfil your order, such as the courier that delivers it, or when required by a competent authority under the law. We do not sell or rent your personal data.

6. ARCO rights

You may access, rectify or cancel your data, or object to its processing (ARCO rights). To do so, email [email protected] with the subject "ARCO rights", including:

• Your name and an email or address where we can reply.
• A document proving your identity or, where applicable, the legal representation of the requester.
• A clear description of the data and the right you wish to exercise.
• Anything that helps locate your data; for rectification, the changes and supporting documents.

We will reply within the deadlines set by the LFPDPPP (up to 20 days to communicate our decision and, if applicable, up to 15 more days to carry it out). Exercising these rights is free; only justified shipping or copying costs may apply.

If you have an account, you can also update your profile data directly in "My account".

7. Withdrawing consent and limiting use

You can withdraw your consent or ask us to limit the use or disclosure of your data by writing to [email protected], following the procedure above. Some legal obligations prevent us from deleting certain data immediately, and withdrawal may mean we cannot continue with orders or requests in progress.

You can also register with PROFECO's Public Registry to Avoid Advertising (REPEP).

8. Cookies and local storage

We only use strictly necessary technologies: a session cookie when you sign in and your browser's local storage to keep your cart. We do not use analytics, advertising or third-party tracking cookies. When you pay, Stripe uses its own cookies on its checkout page.

9. Retention and security

We keep your data while your account is active and for as long as needed for the purposes above and to meet legal obligations, such as tax obligations. It is then blocked and deleted.

We apply administrative, technical and physical safeguards: encrypted connections (HTTPS), encrypted passwords, restricted access to information and providers with security standards.

10. Changes to this notice

Any change to this notice will be published at hephaestusmx.com/en/privacy/ with its update date.

11. Authority

If you believe your right to personal data protection has been violated, you may contact the Secretaría Anticorrupción y Buen Gobierno, the competent Mexican authority.

This English version is provided for convenience; the Spanish version prevails.