Privacy Notice
Document under legal review — [Razón social] must validate it before launch.
Last updated: May 20, 2026
This Privacy Notice is issued in compliance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and the applicable Guidelines. It describes how we collect, use, protect, and share your personal data when you buy from Bruja Sana or request commercial information.
1. Data controller
The controller responsible for processing your personal data is [Razón social], with Federal Taxpayer Registry [RFC] and registered tax address at [Domicilio fiscal] (hereinafter “Bruja Sana,” “we”).
For any matter relating to your personal data, including the exercise of your ARCO rights, you can contact us at [correo de contacto para derechos ARCO].
2. Personal data we collect
We collect the data you provide directly when placing an order or making a commercial inquiry:
- Identification and contact data: first name, last name, email address, and phone number.
- Shipping data: street, number, neighborhood, city or municipality, state, and postal code.
- Order data: the chosen pack and flavor selection.
- Payment data: the charge is processed through Openpay. Your card data is captured and tokenized directly with Openpay and is never stored or transmitted by Bruja Sana's servers (PCI-DSS compliance is handled by the processor).
3. Purposes of processing
We process your personal data for the following primary purposes, which are necessary for the commercial relationship:
- Process and confirm your order and its corresponding charge.
- Coordinate and follow up on shipping and delivery.
- Issue receipts and handle clarifications, returns, or claims.
- Respond to your wholesale or commercial information requests.
4. Secondary purposes
Secondarily, and only if you do not object, we may use your email to send you news, promotions, or satisfaction surveys. You can object to these purposes at any time, without affecting the provision of the service, by writing to us at [correo de contacto para derechos ARCO].
5. Transfers and processors
We do not sell your personal data. We share it only with the third parties strictly necessary to fulfill the purposes above, in their capacity as processors or service providers:
- Openpay, S.A. de C.V. — card payment processing and 3D Secure authentication.
- Envia.com — shipping rate quoting and logistics management with the carriers.
- Supabase — hosting of the database where the order is stored.
- Brevo (Sendinblue) — delivery of the transactional confirmation emails.
6. ARCO rights
You have the right to Access your personal data, Rectify it when inaccurate, Cancel it when you believe it is no longer required for the stated purposes, and Object to its processing for specific purposes.
To exercise any of these rights, send your request to [correo de contacto para derechos ARCO] stating your name, the data the request concerns, and the right you wish to exercise. We will handle your request within the timeframes set by the LFPDPPP. You can also reach us through the form in the Business section or via WhatsApp.
7. Data retention
We retain your data for as long as necessary to fulfill the purposes described and the applicable legal, tax, and accounting obligations. When it is no longer needed, we delete or block it in accordance with the regulations.
8. Cookies and analytics
Our site may use cookies and analytics tools to improve your browsing experience and understand how the store is used. You can disable cookies in your browser settings; some features may be affected.
9. Changes to this notice
This Privacy Notice may be updated to reflect legal changes or changes in our practices. The current version, with its update date, will always be available on this page.