PRIVACY NOTICE

This English translation is provided for convenience. In the event of any discrepancy, the Spanish version shall prevail.

I. IDENTITY AND ADDRESS OF THE DATA CONTROLLER

Casa Umbela S.A. de C.V. (hereinafter "Umbela" or "the Controller"), with its address at Lázaro Cárdenas 26, Centro, CP 45380, Amatitán, Jalisco, Mexico, is responsible for the processing of your personal data in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and other applicable regulations.

To exercise your ARCO rights or for any inquiry related to this Notice, you may contact us at administracion@umbela.mx.

II. PERSONAL DATA WE COLLECT

For the purposes described in this Notice, we collect the following categories of personal data:

• Identification data: full name, date of birth (for age verification).
• Contact data: email address, phone number, postal address.
• Transaction data: purchase history, waitlisted products, shipping information.
• Browsing data: IP address, browser type, pages visited, visit duration (through cookies and similar technologies).

Umbela does not collect sensitive personal data within the meaning of the LFPDPPP. We do not store credit or debit card data on our servers.

III. PURPOSES OF PROCESSING

Primary purposes (necessary for the legal relationship):

• Processing and managing purchase orders and shipments.
• Creating and managing user accounts.
• Managing waitlists for upcoming products.
• Responding to inquiries and contact requests.
• Complying with legal and tax obligations.
• Verifying that the user is of legal age in accordance with the regulations applicable to the sale of alcoholic beverages.

Secondary purposes (you may object):

• Sending Umbela marketing communications, news and promotions.
• Building statistical profiles of consumption preferences.
• Improving the browsing experience on the website.

If you do not want your data to be used for secondary purposes, you may say so at any time by writing to administracion@umbela.mx.

IV. DATA TRANSFERS

Umbela may transfer your personal data without requiring your consent in the following cases provided for by the LFPDPPP:

• Courier and parcel companies for order delivery.
• The authorized payment processor (Getnet, by Santander) — under its own privacy policy.
• Competent authorities when required by law.
• Technology service providers acting as data processors under strict confidentiality obligations.

Umbela does not sell, lease or assign your personal data to third parties for those third parties' own commercial purposes.

V. ARCO RIGHTS

You have the right to:

• Access: know what personal data we hold about you and how we use it.
• Rectification: request the correction of inaccurate or incomplete data.
• Cancellation: request the deletion of your data when it is no longer needed for the purposes for which it was collected.
• Objection: object to the processing of your data for specific purposes.

To exercise your ARCO rights, send a request to administracion@umbela.mx including: (i) your full name and official ID, (ii) a clear description of the right you wish to exercise, and (iii) any document that helps locate your data. We will respond within a maximum of 20 business days.

VI. USE OF COOKIES

This website uses its own and third-party cookies to improve the browsing experience, analyze site usage and, with your consent, display personalized content. Essential cookies are used because they are strictly necessary for the site to work; non-essential (analytics) cookies are only activated with your express consent through our cookie notice, where you can also reject them or change your decision at any time.

Types of cookies used:

• Essential: necessary for the basic operation of the site (shopping cart, age verification).
• Analytics: help us understand how visitors use the site (Google Analytics — with anonymized IP).
• Preference: remember your choices such as language and settings.

VII. SECURITY MEASURES

Umbela implements technical, administrative and physical measures to protect your personal data against damage, loss, alteration, destruction or unauthorized use, including encryption in transit (HTTPS/TLS), system access controls and security incident response procedures.

VIII. CHANGES TO THIS PRIVACY NOTICE

We reserve the right to update this Notice at any time. Changes will be announced on our website at least 15 days in advance. We recommend reviewing it periodically. The date of the last update appears at the top of this document.

IX. COMPETENT AUTHORITY

If you believe your right to personal data protection has been violated, you may contact Mexico's National Institute for Transparency, Access to Information and Personal Data Protection (INAI) at www.inai.org.mx.

← BACK TO HOME