Privacy policy

Last updated: 9 October 2026

Here's what personal data we use, why, and what you can do about it. No small print.

In short

  • We use your data to ship your order, take payment and help you.
  • To get your order to you, we give your name, address and phone number to our supplier in China, who ships it.
  • Analytics and advertising cookies (Shopify, Meta, TikTok) are only switched on if you accept them.
  • We don't sell your data.
  • You can ask us to see, correct or delete your data at info@dulmio.com.

1. Who is responsible (controller)

  • Controller: Micketa Horizon LLC, a limited liability company (LLC) organized in New Mexico, USA, which runs the Dulmio store.
  • Address: 1209 Mountain Road Place NE, Albuquerque, NM 87110, USA
  • Email for anything about your data: info@dulmio.com

2. What data we use

  • Contact and identification: first name, last name, email and phone number.
  • Shipping and billing: delivery and billing address.
  • Order: what you buy, amount, date, tracking number, returns and refunds.
  • Payment: payment is processed by Shopify's checkout. We only see limited data (card type, last digits and payment result). We never see your full card number.
  • Your messages: what you write to info@dulmio.com or in the withdrawal form.
  • Browsing: IP address, device, browser, pages you visit and how you reached the site (for example, from an ad). Some of it only if you accept cookies (see section 9).

We don't ask for special category data (health, beliefs, etc.).

3. Why we use it and on what legal basis

Why Legal basis (GDPR)
Handling your order: payment, shipping, tracking, returns, refunds and guarantees Performance of the purchase contract (art. 6(1)(b))
Answering your messages Performance of the contract or, if you're not yet a customer, our legitimate interest in helping you (art. 6(1)(b) and 6(1)(f))
Keeping invoices and sales records Legal, tax and consumer-law obligations (art. 6(1)(c))
Preventing fraud and protecting the store and payments Our legitimate interest in nobody paying with stolen cards (art. 6(1)(f))
Sending you news and offers by email, and reminding you of a purchase you left unfinished Your consent, if you tick the box (art. 6(1)(a)). If you're already a customer, we may write to you about products similar to those you bought unless you object (art. 6(1)(f)). You can unsubscribe from any email
Measuring how the site is used and showing you Dulmio ads on other platforms (analytics and advertising cookies) Your consent in the cookie banner (art. 6(1)(a))
Knowing whether you open our newsletter emails (open-tracking pixel) Your consent (art. 6(1)(a)). Without it, you still get the email but we don't measure whether you open it

4. How long we keep it

  • Order data: for as long as our relationship lasts and, after that, for as long as tax and commercial rules require (10 years at most) and as needed to handle guarantees and claims.
  • Customer service messages: up to 3 years after our last contact, unless they're part of an order.
  • Newsletter: until you unsubscribe. If you're a customer, at most 3 years from your last purchase; if not, 3 years from your last contact with us.
  • Cookies: as shown in section 9. Your choice in the banner is kept for up to 6 months, after which we ask again.

5. Who else has access to your data

Only those who need it to make your purchase work:

  • Shopify (Shopify Inc., Canada, and Shopify Technology (USA) Inc., USA): store platform, hosting and checkout. It acts as our processor.
  • Shopify Payments (USA) Inc. and its payment processor, Stripe, Inc. (USA), to take payment and prevent fraud.
  • Our supplier in China, who prepares and ships your order, and the tool we use to pass orders to them. They only get what's needed for shipping: name, address, phone number and order contents.
  • Carriers that bring the parcel to your door.
  • Our email and customer service providers, to receive and answer your messages.
  • Meta Platforms Ireland Limited (Facebook and Instagram) and TikTok Technology Limited (Ireland), only if you accept advertising cookies. In that case they collect data about your browsing on our site, and we are joint controllers with them for that collection and transmission (art. 26 GDPR). You can exercise your rights over that data with them or with us. What they do with it afterwards is governed by their own policies.
  • Authorities, when the law requires it.

We don't sell or rent your data to anyone.

6. Data leaving the European Economic Area

We're a company established in the United States and the GDPR applies to us just as it does to a European company. In addition, some providers process data outside the European Economic Area:

  • Canada (Shopify Inc.): the European Commission recognises its level of protection as adequate.
  • The United States and other countries where Shopify and its providers operate (for example, Singapore): with the safeguards in their data processing agreement, based on the European Commission's standard contractual clauses, or the EU-U.S. Data Privacy Framework where the recipient is certified.
  • China, to ship your order. China has no adequacy decision from the European Commission. Where our supplier has signed the European Commission's standard contractual clauses with us (Decision 2021/914), the transfer is based on them (art. 46(2)(c) GDPR). Where it hasn't, we only pass on the data strictly needed for shipping, and the transfer is based on it being necessary to perform your contract with us (art. 49(1)(b) GDPR): without it we couldn't ship your order.

You can ask us for more information or a copy of the safeguards at info@dulmio.com.

7. Your rights

You can ask us at any time for:

  • Access: to know what data we hold about you.
  • Rectification: to correct anything wrong.
  • Erasure: to delete it, except what the law requires us to keep.
  • Objection: to stop using it for something (for example, sending you offers).
  • Restriction: to keep it without using it while a question is resolved.
  • Portability: to receive it in a format you can take to another company.
  • Withdrawing your consent whenever you like, without affecting what was done before.

We don't make decisions about you based solely on automated processing that have legal effects on you. If the anti-fraud system flags a payment as suspicious, a person reviews it.

How: email info@dulmio.com from the address on your order (or include your order number), saying which right you want to exercise. We reply within one month at most. If we can't confirm it's you, we'll ask for a bit more information.

8. If you're not happy

You can complain to the data protection authority of your country:

  • Spain: Agencia Española de Protección de Datos (AEPD), Paseo de la Castellana 141, planta 9, 28046 Madrid — www.aepd.es
  • France: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr

We'd appreciate it if you wrote to us first at info@dulmio.com: almost everything gets solved in one email.

9. Cookies

Cookies are small files the website stores in your browser. Here's how we use them:

Type What for Examples Need your permission?
Technical (necessary) Making the store work: cart, checkout, security, country and language, and remembering your cookie choice _shopify_essential, cart, localization (Shopify) No: the store doesn't work without them
Analytics Knowing how many people visit and which pages work best _shopify_y, _shopify_s, _shopify_analytics (Shopify) Yes
Advertising Measuring our ads and showing you Dulmio ads on Facebook, Instagram and TikTok _shopify_marketing (Shopify), _fbp (Meta), _ttp (TikTok) Yes
  • On your first visit, we show a notice to accept or reject the cookies that need permission. Rejecting is as easy as accepting.
  • If you reject them, they're not switched on and the store works the same.
  • You can change your mind at any time from the "Cookies" link at the bottom of every page.
  • Each cookie's lifetime is set by whoever places it; Shopify's last 1 year at most. Meta's and TikTok's are governed by their cookie policies.
  • You can also delete or block cookies in your browser settings.

10. Children

The store is aimed at adults. We don't knowingly collect data from children under 14 (Spain) or 15 (France). If a child has given us their data, write to us and we'll delete it.

11. Security

We take technical and organisational measures to protect your data: encrypted connection, payments through a certified checkout, and access to data only for those who need it.

12. Changes to this policy

If we change anything important, you'll see it here with the update date and, if it affects you directly, we'll let you know by email.