This privacy notice explains what personal data we collect on www.dermacol.mx, what we use it for, who we share it with and how you can exercise your rights, in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties.
Who is responsible for your data
The party responsible for processing your personal data is Katerina Belska, an individual registered for business activity who trades under the name Works & Cosmetics Mexico, the exclusive distributor of Dermacol in Mexico, RFC (Mexican tax ID) BEKA891125SG9, with her address at Av. Priv. Retorno 8, Col. Bosques de las Palmas, C.P. 52787, Huixquilucan, State of Mexico. For anything concerning your data, write to us at info@dermacol.mx or on WhatsApp at +52 55 4436 3801.
What data we collect
- Customer account: first name, last name, e-mail address, phone number and password (stored encrypted, nobody can read it) and, if you tick the box, your consent to receive offers.
- Orders: e-mail address, name, shipping and billing address, phone number, the products, the amount, the payment method, any note you leave us and the IP address from which you placed the order. You can also buy without creating an account.
- Invoice (CFDI): if you request one, your tax details: RFC, name or company name, tax regime, postal code and CFDI use.
- Payments: your card or account details are collected directly by Mercado Pago or PayPal; we only receive the payment confirmation and its transaction number. If you pay by bank transfer, we see the deposit in our bank account.
- Contact form: name, e-mail address, order number (optional) and your message, which reaches us by e-mail.
- Cart and wishlist: the products you add, also when you have no account.
- Technical data: the IP address, the browser and the pages you visit are kept in the server logs; we also record sign-in and form submission attempts to protect the site against abuse.
We do not collect sensitive personal data.
What we use it for
Necessary purposes for your relationship with us:
- creating and managing your account;
- processing, charging, shipping and tracking your orders, and sending you the e-mails about your account and orders (confirmation, payment, shipping);
- issuing invoices and meeting our tax and legal obligations;
- handling your messages, returns, enquiries and complaints;
- protecting the site and our customers against fraud and abuse.
Additional purposes, which are not necessary for your purchase and which we carry out only with your consent:
- sending you offers, news and promotions by e-mail, if you ticked the box when you registered;
- measuring visits to the site with Matomo, if you accept it in the cookie settings (explained below).
You can refuse the additional purposes or withdraw your consent at any time: untick the offers box in My account, change your choice under “Cookie settings” at the bottom of the page or write to us at info@dermacol.mx. Refusing does not affect your purchases.
Who we share your data with
We do not sell your data or hand it to anyone for their own advertising purposes. We share it only as far as necessary with:
- courier companies (Estafeta): name, address and phone number, to deliver your order;
- Mercado Pago and PayPal: the order details needed to charge it; each processes your payment data under its own privacy notice;
- the authorised certification provider (PAC) and the SAT (Mexican tax authority): your tax details, to issue and certify the invoice;
- authorities, when a law or a court order requires it.
These transfers are necessary to fulfil your purchase or a legal obligation, so they do not require your consent. In addition, we use service providers who process the data only on our behalf and on our instructions: hosting of the website and its database (servers in the United States), e-mail delivery, and the developer who runs the site and the Matomo statistics server (in the European Union).
Visitor statistics
We measure visits with Matomo, a statistics tool installed on our own server in the European Union, not at Google or any advertising network. Matomo starts only if you accept it in the “Analytics” category of the cookie settings. It records which pages you view, where you came from and what you do in the shop (for example searching, adding to the cart, placing an order or writing to us on WhatsApp). The IP address is shortened before it is stored, so it cannot identify your connection, and we share the data with no one.
We do not use Google Analytics, Facebook pixels or any other advertising or cross-site tracking tools.
Cookies
Cookies are small files the site stores in your browser. We use these:
- “cookie_consent” (essential): remembers your choice in the cookie settings for one year.
- “flexi_session” (essential): keeps your session while you browse, for example when you sign in or place an order, and carries a security code that protects the forms against use from other sites. It is deleted when you close the browser.
- “cart_token” and “wishlist_token” (essential): remember your cart and your wishlist even when you have no account.
- “_pk_…” (analytics, only with your consent): used by Matomo to recognise the same visit. If you withdraw your consent, the site deletes them.
Essential cookies cannot be switched off because the shop would not work without them. You can change or withdraw your consent at any time under “Cookie settings” at the bottom of every page, and you can also delete or block cookies in your browser.
How long we keep your data
- your account details, for as long as you have the account; an account whose e-mail address is not confirmed is deleted after 7 days;
- orders and invoices, for the period required by tax and commercial law (in Mexico, at least 5 years);
- a cart without an account, 30 days; a registered customer's cart and the wishlist, 180 days without activity;
- copies of the e-mails the site sends, 90 days; records of sign-in and form submission attempts, 30 days; database backups are overwritten every 14 days;
- contact form messages, in our mailbox while we handle your enquiry.
Your rights (ARCO)
You have the right to access your data, to rectify it if it is inaccurate or incomplete, to cancel it and to object to its processing for specific purposes. You can also revoke your consent and limit the use or disclosure of your data, for example to stop receiving offers.
To exercise any of these rights, send an e-mail to info@dermacol.mx with:
- your name and an e-mail address for our reply;
- a copy of your official ID or, if you act on behalf of someone else, the document proving that you represent them;
- a clear description of the data and of the right you want to exercise;
- anything that helps us find the data, for example your order number.
We will reply within 20 business days at most and, if your request is granted, carry it out within the following 15 business days. The procedure is free of charge. If you believe your right to the protection of personal data has been violated, you can turn to the data protection authority (Secretaría Anticorrupción y Buen Gobierno).
Changes to this notice
If we change this privacy notice, we will publish the new version on this page with its date. Last updated: 27 October 2026.