Privacy Notice

At Nexa Labs we respect your privacy. This notice explains what personal data we collect, why, who we share it with, how long we keep it and how you can exercise your rights, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.

1. Who is responsible for your data

Nexa Labs is responsible for processing your personal data. For anything related to this notice you can write to contacto@nexalabs.mx, which is also the designated channel for ARCO requests and for withdrawing consent.

2. Data we collect

We collect the information you give us directly:

• Contact details: name, email address, phone number.
• Shipping details: delivery address.
• Order details: products, quantities, purchase history.
• Payment details: handled directly by our payment gateway — we do not store full card numbers on our servers.
• An email address you give us voluntarily to receive news (subscription form).
• Billing details, only if you request a tax receipt: RFC, legal name, tax regime, CFDI use and tax address.

Technical browsing data (IP address, browser type, pages visited) is also recorded automatically by the normal operation of our servers and those of our hosting provider.

We do not collect sensitive personal data. We do not ask for health information, and you should not provide any: the products we sell are research compounds and require no medical history whatsoever. See our research use notice.

3. Why we process it

Purposes necessary for the purchase itself:

• Processing, shipping and tracking your order.
• Contacting you about the status of your purchase.
• Issuing tax receipts when you request them.
• Answering questions and providing support.
• Meeting legal obligations and preventing fraud.

Additional purposes, which you can decline without affecting your purchase:

• Sending you news and offers, only if you subscribed voluntarily.
• Letting you know when a sold-out product is back in stock.

We do not sell or rent your personal information to anyone.

4. Cookies and similar technologies

We use cookies and browser local storage to make the site work: keeping you signed in, holding your cart between visits and remembering basic interface preferences. These are necessary — without them you could not check out.

You can block or delete cookies from your browser settings. If you do, the cart and sign-in will stop working properly.

5. Sharing with third parties

To operate we need to share certain data with providers acting on our behalf. Each one receives only what its job requires:

• Shipping carriers. Name, delivery address and phone number, so they can deliver your order.
• Payment gateway. The transaction data. Your card details go straight to the processor; we never see or store them.
• Transactional email provider. Your email address and the content of the message, to send you confirmations, tracking and password resets.
• Hosting and database providers. They store the site and account information under a confidentiality agreement.
• Competent authorities, where there is a duly founded and substantiated legal request.

None of these transfers requires your additional consent under article 37 of the LFPDPPP, since they are necessary to carry out the legal relationship between us. Outside these cases, we transfer your data to no one.

6. How long we keep it

• Order and billing data: kept for at least five years from the purchase, under the applicable accounting and tax obligations.
• Account data: for as long as the account stays active. If you ask us to close it, the data is deleted except what we are legally required to keep.
• Subscription email address: until you unsubscribe.
• Contact form messages: up to twenty-four months after the question is resolved.

Once the relevant period ends, the data is blocked and then deleted.

7. ARCO rights

At any time you may request Access to your data, Rectification when it is inaccurate, Cancellation when you believe it is no longer needed, or state your Opposition to a specific use. These four are known collectively as ARCO rights under Mexican law.

Send your request to contacto@nexalabs.mx with your name, a way to reach you, a clear description of the data the request concerns and a document proving your identity. We answer within twenty business days at the latest.

8. Withdrawing consent

You can withdraw the consent you gave us by writing to contacto@nexalabs.mx. For marketing email, the unsubscribe link at the bottom of every message is enough.

Keep in mind that withdrawal cannot reach data we are legally required to keep, and does not affect the validity of processing carried out before you withdrew.

9. Limiting use and disclosure

Besides ARCO rights, you can ask us to limit the use or disclosure of your data through the same channel. There is no charge for this.

10. Minors

Our site is not aimed at minors and we do not sell to minors. We do not knowingly collect data from anyone under eighteen. If we find an account was created with a minor's data, we will delete it. If you are a parent or guardian and believe this happened, write to us at contacto@nexalabs.mx.

11. Security

We apply reasonable technical and administrative measures to protect your data against unauthorised access, loss or alteration: encryption in transit, access control on the database and separation of administrative credentials. No system is foolproof; we also recommend protecting your own credentials and not reusing passwords.

12. Changes to this notice

We may update this notice from time to time. The date of the last update appears at the top of this page. Substantial changes will be announced by email to registered accounts.

13. Supervisory authority

If you believe your right to personal data protection has been infringed, you may turn to the competent Mexican data protection authority.

14. Contact

contacto@nexalabs.mx