Privacy policy

01

Who is responsible for your data

The party responsible for processing your personal data is me, Diego Caballero, photographer, operating the online store dcaballero.com out of Guadalajara, Jalisco, Mexico.

For anything to do with your personal data, including exercising your ARCO rights, the contact channel is soporte@dcaballero.com.

02

What data I collect

I only ask for what I need to sell you a piece and get it to you:

• Identification and contact: first and last name, email address and, if you give it, phone number.
• Address: your shipping address and, where applicable, your billing address.
• Account: email and password, stored encrypted — I cannot see it.
• Orders: what you bought, when, for how much, and the shipping status.
• Payment: the transaction reference and, when the processor returns them, the card brand and last four digits. I never receive or store the full number or the security code.
• Messages: what you write in the contact form or in the Trade program form.
• Technical data: IP address, browser type and session data, used to make the store work, to limit abuse of the tools and for security.
• Images: the photo of your space you upload to the Virtual Preview, if you choose to use it.

I do not collect sensitive personal data. I do not ask for health data, ethnic or racial origin, religious beliefs, political affiliation or sexual preference, and I ask that you not include them in your messages.

03

What I use your data for (primary purposes)

These purposes are necessary for the sale itself. Without them I cannot sell you anything:

• Process and confirm your order, charge it and issue the corresponding receipt.
• Produce the piece and arrange its delivery to your address, including assigning the edition number where it applies.
• Send you transactional email: order confirmation, tracking number and notices about your purchase.
• Create and manage your account, if you choose to have one.
• Answer your messages and Trade program applications.
• Generate the Virtual Preview when you upload a photo.
• Prevent fraud and abuse, and meet tax, accounting and legal obligations.

04

Secondary purposes and how to opt out

With your consent I might use your email to tell you about new work, editions about to close, or exhibitions. This purpose is not necessary for your purchase.

You can opt out right now by writing to soporte@dcaballero.com with the subject “No communications”, or later through the unsubscribe link included in any such email. Opting out does not affect your purchase or the service you get.

You can also ask me to add you to my internal exclusion list.

05

Who I share your data with

I do not sell your data and I do not trade it with anyone for commercial purposes.

To run the store I rely on providers who process data on my behalf and under my instructions. With each of them I share only what is strictly needed:

• Stripe — processes payments. It receives your card details directly; they never pass through my servers.
• Mailgun — sends transactional email and delivers your contact form messages to me.
• DigitalOcean — hosts the site and the store.
• Google — the address autocomplete at checkout uses Google Places, which receives the text you type in that field. Google Analytics also receives aggregate browsing data: which pages you view, where you arrived from and what you buy.
• Meta — the pixel receives the same browsing and purchase events, and lets me show you ads for the store on Facebook and Instagram.
• Replicate — generates the Virtual Preview. It receives the photo you upload and the artwork image.
• OpenAI — suggests a piece from the description you write in the visualizer. It receives that text, not your photo.
• The print partner and the carrier — receive your name, address and phone number, without which there is no delivery.

These transfers do not require your consent because they are necessary to perform the sales contract, under article 37 of the law. Some of these providers operate outside Mexico: by buying, you accept that your data is processed on their servers.

Beyond that, I would only hand over your data to a competent authority that legally requires it.

06

The photo you upload to the Virtual Preview

It is the most personal thing you can hand me, so I treat it separately: the photo of your space travels to Replicate to generate the preview and is not saved in my database or my catalog. The resulting image sits at a temporary provider address you can download from. I do not publish it, do not use it in marketing, and do not link it to your account.

07

Your ARCO rights

Mexican law grants you four rights over your data, and you can exercise them at any time and free of charge:

• Access — know what data of yours I hold and what I use it for.
• Rectification — correct it if it is wrong or incomplete.
• Cancellation — ask me to delete it when it is no longer needed.
• Objection — ask me to stop using it for a specific purpose.

You can also revoke at any time the consent you gave me, and limit the use or disclosure of your data.

To exercise them, email soporte@dcaballero.com with: your name and a way to reply to you; a copy of official photo identification, or the document accrediting your representative; which right you want to exercise and over what data; and anything that helps locate your information, such as the order number.

I will communicate my decision within a maximum of 20 business days and, where it applies, act on it within the following 15 business days.

There are cases where I cannot delete everything: order and billing records have to be kept for as long as tax law requires. If that is your case, I explain it in my reply.

08

How long I keep your data

• Orders, payments and billing: for the duration of the relationship and afterwards for the period Mexican tax and accounting obligations require.
• Account: for as long as you keep it open. If you close it, I delete or block the data I am not required to keep.
• Contact messages: for a reasonable period to handle and follow up on them.
• Virtual Preview photo: I do not keep it on my servers.

09

Cookies and browser storage

Needed for the store to work:

• A cookie holding the country and currency you chose, so you see the right prices.
• Browser local storage holding your cart and your session, so they survive moving between pages.

For measurement and advertising, none of which is needed to buy: Google Analytics (the «_ga» and «_ga_*» cookies) measures in aggregate which works get viewed and what sells; the Meta pixel (the «_fbp» cookie) measures the same events and lets me show ads to people who have already visited the store.

You can block the measurement ones in your browser or with an extension and the store still works. Block the first two and the cart and checkout will stop working properly.

10

Security

The site runs over an encrypted connection, passwords are stored encrypted, and card data never touches my servers. Access to the information is limited to me and the providers listed above. Even so, no system is infallible: if a breach significantly affecting your data occurred, I would tell you.

11

Minors

The store is not directed at anyone under 18 and I do not knowingly collect data from minors. If you believe a minor has given me their data, write to me and I will delete it.

12

Changes to this notice

I may update this notice when the way I handle your data changes, when my providers change, or when the law requires it. The current version is always published on this page with its date. If the change is material and you have an account, I will also tell you by email.

13

If you think I got it wrong

Write to me first: almost everything gets sorted directly. If you are not satisfied, you can file a complaint with the competent personal data protection authority in Mexico.