Reference translation. This English version is provided for convenience only. The Spanish version is the one that governs for any legal purpose, and it is the version that prevails in the event of any discrepancy between the two texts.

Comprehensive Privacy Notice

Last updated: 20 July 2026

This Privacy Notice is issued in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette of the Federation on 20 March 2025 and in force as of 21 March 2025, as well as its Regulations and other applicable provisions in the United Mexican States.

1. Identity and address of the data controller

abani (hereinafter “abani”, “we” or “the Controller”), with its address at Dalias 6133, Bugambilias, Puebla de Zaragoza, Puebla, Mexico, is responsible for the processing of your personal data, for the use given to it and for its protection.

For any matter related to this Privacy Notice or to the exercise of your rights, you may contact us at [email protected].

The website to which this Notice applies: https://abani.mx (hereinafter, the “Site”).

2. Personal data we process

For the purposes described in this Notice, we process the following categories of personal data:

Identification and contact data: full name and email address.
Delivery data: shipping address (street, number, neighborhood, postal code, municipality or borough, state and, where applicable, landmarks and a contact telephone number for delivery).
Transactional data: purchase history (products purchased, dates, amounts and the status of your orders).

We do not process sensitive personal data (data revealing racial or ethnic origin, health status, genetic information, religious, philosophical or moral beliefs, union membership, political opinions or sexual preference).

Banking and payment data. abani does not collect, store or have access to full card numbers or banking credentials belonging to data subjects. Payment processing is carried out directly through our provider Stripe, Inc., who captures and processes that information in accordance with its own privacy notice or policy and with the security standards of the payment industry (PCI DSS). We may only receive limited information from Stripe about the outcome of the transaction (for example: payment confirmation, the last four digits or the card brand) for control and invoicing purposes.

3. Purposes of processing

In accordance with the LFPDPPP, we distinguish between necessary purposes (indispensable to our legal relationship with you) and voluntary purposes (which require your consent and which you may refuse without that affecting your purchase).

3.1 Necessary purposes (primary)

These purposes are indispensable in order to provide you with the service. Without this data we cannot complete your purchase:

Create and administer your user account on the Site.
Process, confirm and follow up on your orders and payments.
Manage the shipping and delivery of products to the address provided.
Issue receipts and, where applicable, invoices.
Handle clarifications, exchanges, returns, warranties and customer service requests.
Comply with legal, tax and contractual obligations.

3.2 Voluntary purposes (secondary)

These purposes are not necessary for your purchase, but they help us improve your experience:

Send you commercial communications, promotions, news and newsletters about our products.
Conduct satisfaction surveys and market research.
Build purchase profiles for statistical purposes and to improve what we offer.

If you do not want us to process your data for the voluntary purposes, you may say so at any time by writing to [email protected] with the subject line “Limitación de finalidades”, or by using the unsubscribe link included in our communications.

4. Service providers (data processors)

In order to operate the Site and fulfil the purposes described above, we rely on third-party providers who process personal data on behalf of and under the instructions of abani, in their capacity as processors:

Stripe, Inc.: payment processing.
Supabase, Inc.: hosting of the user and purchase database (authentication, accounts and orders).

These providers may store and process information on servers located outside Mexican territory (for example, in the United States of America). In their capacity as processors, they are obliged to maintain the confidentiality and security of your data and to process it solely for the purposes contracted by abani. These transmissions to processors do not require your consent under applicable law.

5. Data transfers

abani does not sell, assign or trade your personal data with third parties for their own purposes.

We may only disclose your data to third parties in the circumstances permitted by article 36 of the LFPDPPP without your consent, among them: when required by a competent authority by means of a court order, ruling or duly grounded and reasoned mandate; when a legal or tax provision requires it; or when it is necessary in order to fulfil obligations arising from our legal relationship with you.

Other than in those circumstances, we do not transfer your data. Should we in future intend to make any transfer that requires your consent, we will inform you beforehand so that you can accept or refuse it.

6. Means to limit the use or disclosure of your data

You may limit the use or disclosure of your personal data by sending a request to [email protected]. You may also register with the Public Registry to Avoid Advertising of the Federal Consumer Protection Agency (PROFECO) in order not to receive advertising from us.

As a data subject, you have the right to Access your personal data, Rectify it when it is inaccurate or incomplete, Cancel it when you consider that it is not required for the stated purposes, and Object to its processing for specific purposes (ARCO rights). You may also withdraw at any time the consent you have given us.

How to exercise them

Send your request to [email protected], including:

Your full name and a means of communicating our response to you.
A document evidencing your identity (or, where applicable, legal representation).
A clear and precise description of the data and of the right you wish to exercise.
Any element or document that makes it easier to locate your data.

Time limits and cost

We will respond to your request within a maximum of 20 business days; if it is upheld, we will give effect to it within the following 15 business days.
Exercising ARCO rights is free of charge. You will only need to cover, where applicable, justified shipping expenses or the cost of reproducing copies.
Withdrawing consent or cancelling data may mean that we can no longer provide you with certain services (for example, processing new orders), or it may not be total in those cases where the law obliges us to retain certain information.

8. Data retention

We retain your personal data for as long as our legal relationship with you lasts and, afterwards, for the periods required by applicable legal, tax and contractual obligations. Data relating to the breach of contractual obligations will be deleted once a period of 72 months has elapsed, counted from the date on which the breach occurs, in accordance with article 10 of the LFPDPPP. Once the corresponding periods have concluded, your data will be securely deleted or blocked.

9. Use of cookies and tracking technologies

The Site uses only essential cookies to remember your session and the contents of your cart. We currently do not use third-party analytics or marketing tools (such as Google Analytics or Meta Pixel). You can disable cookies from your browser settings, bearing in mind that some functions of the Site may stop working correctly.

10. Security measures

We implement reasonable administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction or unauthorized access, use or processing, in the terms of the LFPDPPP and its Regulations.

11. Changes to the Privacy Notice

We reserve the right to modify or update this Privacy Notice at any time in order to address legislative changes, internal policies or new processing practices. Any modification will be available at https://abani.mx/privacypolicy. We recommend that you review it periodically. Where there are substantial changes, we will notify you at the email address we have on record.

12. Data protection authority

If you consider that your right to the protection of personal data has been infringed, or that there has been a violation of the LFPDPPP in the processing of your data, you may turn to the Secretaría Anticorrupción y Buen Gobierno, through the Directorate General of Personal Data in the Private Sector, the authority that as of 21 March 2025 assumed the functions previously corresponding to INAI in this area.

By providing your personal data through the Site and by making a purchase, you state that you have read, understood and accepted the terms of this Privacy Notice, and you give your consent to the processing of your data in accordance with the necessary purposes described here.

This document constitutes abani’s Comprehensive Privacy Notice. A simplified and/or short notice may be made available to you at the points of data collection, referring you to this document for full consultation. The Spanish version of this document is the one that governs.