Privacy notice

Comprehensive privacy notice

[RAZÓN SOCIAL], with its registered address at [DOMICILIO FISCAL], which operates the Karmel Rugs brand, is the data controller responsible for processing your personal data. This notice is issued under the Federal Law on the Protection of Personal Data Held by Private Parties published in the Official Gazette of the Federation on March 20, 2025, and other applicable provisions.

1. Personal data we process

Our site has no registration forms and no user accounts. We process only the following data:

• WhatsApp contact: your profile name, your phone number and the content of the messages and photos you send us for a quote.
• Service order: name, phone, pickup and delivery address, a description of the piece and photos of the piece taken on arrival, during the process and at delivery.
• Invoicing: if you request an invoice, the tax data required by law, such as name or company name, RFC, tax regime, postal code and email address.
• Order tracking: the tracking code and the last four digits of your phone number that you enter on the tracking page. We use them only to verify that the request matches your order.
• Browsing data: only if you accept it, technical information about your visit, such as pages viewed, device type, approximate location and traffic source, obtained through Google Analytics 4 and Google Ads conversion tags.

We ask that photos show only the piece.

2. Sensitive personal data

We do not request or process sensitive personal data, such as data on racial or ethnic origin, health, genetic information, religious, philosophical or moral beliefs, political opinions or sexual orientation. Please do not share it in your messages. If we receive it without having asked for it, we will delete it.

3. Purposes of processing

Primary purposes, necessary to provide the service:

• Answering your enquiries and preparing your quote.
• Scheduling the pickup and delivery of your piece.
• Recording the service order, documenting the condition of the piece on arrival and carrying out the washing, restoration or contracted service.
• Allowing you to check the progress of your order with your tracking code.
• Charging for the service, issuing invoices and meeting tax and legal obligations.
• Handling questions, complaints and claims.

Secondary purposes, which are not necessary for the service:

• Sending you care reminders for your pieces and seasonal notices by WhatsApp.
• Asking for your opinion on the service you received.
• Measuring site usage and the effectiveness of our ads, only if you accept analytics and advertising cookies.
• Showing photos of the piece, without any data that identifies you, as examples of our work, only with your express authorization.

If you do not want us to process your data for secondary purposes, you can tell us at any time by writing to [EMAIL DE PRIVACIDAD] or by sending the word BAJA on WhatsApp. Your refusal will not affect the service you contract.

4. Data sharing with providers and transfers

To provide the service we share data with providers who process it on our behalf, following our instructions and bound by confidentiality obligations:

• Payment providers, to process payments. Karmel Rugs does not store full card numbers.
• Logistics providers, for pickup and delivery. They receive only name, phone and address.
• Web hosting and cloud storage services, where the site, orders and photos are stored.
• WhatsApp, a Meta Platforms service, as our channel of communication with you.
• Google, for web analytics and ad measurement, only with your consent.

Some of these providers may store information on servers located outside Mexico. We may also transfer data without your consent where the law allows it, for example to competent authorities that issue a duly grounded request, or when necessary to defend a right in legal proceedings. We do not sell or rent your personal data.

5. ARCO rights

You have the right of:

• Access: to know what data we hold and how we use it.
• Rectification: to ask us to correct it if it is inaccurate or incomplete.
• Cancellation: to request its deletion when it is no longer needed.
• Opposition: to object to its use for specific purposes.

To exercise them, send a request to [EMAIL DE PRIVACIDAD] including:

• Your name and a means to send you our reply.
• A copy of an official ID or, where applicable, of the document proving legal representation.
• A clear description of the right you wish to exercise and the data involved.
• Any information that helps us locate your data, such as your tracking code.

We will reply within a maximum of twenty business days from receipt of your request. If it is granted, we will carry it out within the following fifteen business days. These periods may be extended once for an equal period when justified. Exercising these rights is free of charge. Only justified shipping or document reproduction costs may be charged.

6. Revoking consent

You may revoke the consent you have given us at any time, through the same channel and with the same requirements as an ARCO request. Revocation has no retroactive effect. If it affects data needed for an order in progress, we will explain whether the service can be completed. To withdraw your cookie consent, use the Cookie preferences link at the bottom of every page.

7. Limiting use or disclosure

You can limit the use of your data by writing to [EMAIL DE PRIVACIDAD], or by sending BAJA on WhatsApp to stop receiving messages not related to an active order. We keep an internal exclusion list to respect your decision. You can also reject non essential cookies on our site and set your browser to block them.

8. Data retention

• Quote conversations that do not become an order: up to twelve months.
• Service orders and photos of the piece: during the service and up to twenty four months after delivery, to handle any questions.
• Tax and accounting information: the period required by tax law, generally five years.
• Analytics data: fourteen months, according to the Google Analytics 4 settings.

Once these periods end, the data is securely deleted or anonymized.

9. Security measures

We apply administrative, technical and physical measures to protect your data against damage, loss, alteration, destruction, and unauthorized use, access or processing. These include an encrypted connection across the whole site, order access limited to authorized staff, strong passwords and two factor authentication on our tools, regular backups and confidentiality commitments with our team and providers.

The tracking page shows only the order status and the photos of the piece. It never shows your address or your full phone number, and it limits lookup attempts to prevent abuse. If a security breach significantly affects your rights, we will inform you without delay.

10. Cookies and similar technologies

Google Analytics 4 and Google Ads conversion tags are activated only after you accept them, through Google Consent Mode version 2. Before you decide, no analytics or advertising cookies are set. See our Cookie policy for details.

11. Minors

Our services are intended for adults. We do not knowingly collect data from minors.

12. Changes to this notice

We may update this notice. We will always publish the current version on this page with its update date. If a change requires new consent, we will ask for it by WhatsApp or through the contact channel we have on file.

13. Competent authority

If you believe your right to personal data protection has been violated, you may go to the supervisory authority designated by current law, at present the Secretaría Anticorrupción y Buen Gobierno.

Last updated: November 5, 2026.