Privacy Notice for Browsing and Purchasing

This Policy clearly explains how we collect, use, share, and protect the personal data of visitors and purchasers of our online store, which offers professional plans and services marketed through an e-commerce platform.

A. Who processes your data?

Responsible: KOMBOA CREATIVE S.A. DE C.V.

Address: Avenida Insurgentes Sur, No. 933, Int. 102, 1st Floor, Colonia Nápoles, Benito Juárez Mayor's Office, C.P. 03810, CDMX.

Privacy and Support Email: comunidad@palmcreating.com

B. What data do we collect?

• Account and purchase: name, surname, email, telephone, billing address and (if applicable) tax address, RFC/Tax ID, payment method (token or reference), order history.
• Support and communication: messages, tickets, surveys, reviews.
• Navigation/Analytics: IP, cookies and site identifiers, URLs visited, traffic source, device and browser.
• Marketing and preference: newsletter subscription, measurement/remarketing cookies when you consent.

C. Purposes of the treatment

1. 1) process orders and payments; 2) invoice; 3) provide contracted services; 4) provide support; 5) manage warranties and returns in accordance with applicable policy; 6) prevent fraud; and secure the platform.
2. 1) sending promotional communications and recommendations; 2) conducting usage analysis and improving experience; 3) targeting and behavioral advertising when consent is given.

D. Legal basis and consent

We process data in accordance with the LFPDPPP, its regulations, and applicable guidelines. The processing basis is:

a) compliance with the contractual relationship of sale/services;

b) consent of the data subject (e.g., marketing, non-essential cookies);

c) legitimate interest in security and fraud prevention.

You may withdraw your consent at any time without retroactive effect.

E. Payments and third parties

We use third-party payment processors and services (e.g., payment gateways, cloud hosting, analytics, messaging). These third parties process data as processors or independent controllers, as appropriate. We do not store full card numbers; we only receive payment confirmations.

F. Transfers

We may transfer data to authorities, technology providers, logistics/operational partners, and professional advisors, strictly for the purposes described. We implement data protection clauses with recipients and do not market your information.

G. Cookies

We use technical (operational), preference, analytical, and, with your consent, advertising/remarketing cookies. You can manage them from the banner and your browser settings. Blocking non-essential cookies does not affect purchasing, but may limit personalization.

H. Conservation

• Order and billing data: for the applicable fiscal/contractual periods (according to the Federal Tax Code)
• Inactive accounts: 24 months from the last activity; after that, we block and delete them.
• Marketing: until you withdraw your consent or 24 months pass without interaction.

I. Security and Breach Notices

We implement reasonable security measures (encryption, access controls, event logging, backups). If we detect a breach with a significant impact, we will notify you promptly and provide mitigation measures.

J. Rights of holders and available mechanisms

You have the right to know what personal data we have about you (Access), request correction of your data if it is inaccurate or incomplete (Rectification), request that it be deleted from our databases if you consider that it is not being used in accordance with the applicable principles (Cancellation), and to object to processing for specific purposes (Objection).

To exercise any of these rights, please send a message to comunidad@palmcreating.com with the subject line “Exercise of Personal Data Rights”. The body of the message must include:

1. Name and contact information.
2. Description of the request.
3. Documents proving identity.

You will be notified of the decision within a maximum of 20 business days. If appropriate, it will be implemented within the following 15 business days.

If you wish to revoke your consent to the use of your data for non-essential purposes, simply use the unsubscribe link included in each communication or send a notification to the email address provided.

K. Modifications to this Privacy Notice

Any changes to this Privacy Notice will be made known to the data subjects by posting them on the website. If the changes are substantial, they will be notified via the available contact method five business days in advance.

Last Updated: 01-Sep-2025