Privacy notice

1. Data controller

Under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its regulations, Candy Art, a handmade workshop in Mérida, Yucatán, is responsible for the use, processing and protection of the personal data you provide when interacting with this website.

For requests, clarification or questions about personal-data protection, contact WhatsApp +52 999 279 0907.

2. Personal data collected

To answer inquiries, prepare quotes and follow the requests configured on this site, the following categories are collected:

• Contact and identification: full name and mobile number associated with WhatsApp.
• Order details: requested item type (piñata, headpiece, bow or another creation), design specifications (theme, shape, size, flowers, colors, notes or ideas), quantity, proposed event date and collection or delivery preference.
• Technical and security data: connection IP address and a temporary random request token (x-intento), used automatically and temporarily by the server to prevent malicious overload, duplicate submissions and attacks.

3. Sensitive and financial data

The controller does not collect or process sensitive personal data such as ethnic origin, health, religious or political beliefs, personal preferences or biometrics.

The website does not request, process or store credit or debit card numbers, bank accounts or financial credentials. Transactions, deposits and final payments are arranged and verified directly with each customer on WhatsApp or at the workshop using authorized payment methods.

4. Purposes of processing

Personal data is used for these primary and necessary purposes:

• Generate a unique tracking reference in the format CA-MMDD-XXXXX for a design or quote request.
• Allow online progress checks through “Check my request” using the reference.
• Communicate on WhatsApp to discuss materials and proportions, confirm the workshop’s availability and provide the final quote.
• Coordinate collection of the finished item at the workshop or through the arrangement agreed with the customer.

Secondary purposes: the workshop does not make telemarketing calls or send mass commercial spam emails. You may ask at any time on WhatsApp not to receive seasonal reminders or after-sale follow-up messages.

Message retention: when you open WhatsApp from this site, the prepared text and request-origin data are stored in the panel to follow your inquiry. Unattended WhatsApp messages are automatically removed from the database after 90 days. This does not change messages you or the workshop keep within WhatsApp, which follow that platform’s settings and policies.

5. Data transfers

Personal data is not sold, rented or transferred to third-party businesses for commercial or advertising purposes. Data is transmitted or stored only in the following operational cases:

• Technology infrastructure: cloud servers and databases (Vercel Inc. and Supabase Inc.) act as technical processors under confidentiality and data-security agreements.
• Instant messaging: WhatsApp communication uses the Meta Platforms, Inc. platform under its applicable messaging privacy policies.
• Legal exceptions: those expressly described in Article 37 of the LFPDPPP, including duly founded requests from competent judicial or administrative authorities.

6. ARCO rights and withdrawal of consent

You may access the personal data held about you, correct inaccurate or incomplete data, request its cancellation when it is no longer needed for the stated purposes, object to processing for specific purposes, and withdraw previously given consent.

Send a written request through WhatsApp +52 999 279 0907 with:

1. The data subject’s full name and a contact phone number or email.
2. A copy or photo of valid official identification to establish identity.
3. A clear description of the data and the right requested, plus a request reference if available.

The existing notice states that the controller will respond within twenty (20) business days of formal receipt.

7. Browser storage and metrics

The public Candy Art site does not use advertising tracking cookies or third-party cross-site browsing profiles. Browser mechanisms such as localStorage and sessionStorage serve operational purposes: temporarily keeping a design draft while you browse, remembering scroll position and preventing duplicate requests.

The server also records general events such as viewing an item or opening WhatsApp; these event contents do not include names or phone numbers. Google Analytics and Google Tag Manager load only if you accept optional analytics. You may reject analytics or change your choice using “Cookie preferences” in the footer. See the Cookie and storage policy for technical data, providers and opt-out options.

8. Changes to the notice

This notice may be modified, updated or supplemented to reflect legislative or judicial changes or changes in workshop and digital-service processes. Substantial changes will be published on this website with the last-update date.