Privacy Policy

Last updated: October 17, 2026

THERMOSHIFT (“we,” “us,” or “our”) operates thermoshift.store, an online store selling heat-reactive balaclavas. This Privacy Policy explains how personal information is collected, used, disclosed, and protected when you browse our store, place an order, or contact us.

Our store is powered by Shopify. Reading or using this website does not, by itself, constitute consent to optional advertising, marketing, or other processing for which separate consent is required.

1. Contact and scope

For privacy questions and requests, contact:

THERMOSHIFT
Website: thermoshift.store
Email: zdrop004@gmail.com
Address: Dr. Fortino Cuellar #220, Col. Centro, Navolato, Sinaloa, 80320, Mexico.

This policy covers information handled for our store. Shopify and payment providers may also handle information independently under their own privacy notices.

2. Personal information

Depending on how you interact with the store, information processed may include:

• Contact and delivery information: your name, email address, telephone number if provided, and billing and shipping addresses.
• Order information: products, colors, quantities, purchases, payments, delivery updates, returns, exchanges, and refunds.
• Payment-related information: billing details, selected payment method, transaction references, payment status, and payment details supplied to the payment provider at checkout. Information processed by a provider is not necessarily information available to THERMOSHIFT.
• Account information: account identifiers, contact details, preferences, and order history, if you use customer account features.
• Communications: information you provide in emails, customer support requests, and any reviews or photos you choose to submit.
• Technical and usage information: IP address, device and browser details, cookie identifiers, approximate location inferred from IP address, pages visited, and interactions with the store.
• Privacy preferences: marketing choices, cookie preferences, consent records, and privacy requests.

We do not ask you to provide sensitive personal information to purchase a balaclava. Please do not send full payment card details, passwords, or unnecessary sensitive information by email.

3. Where information comes from

Information may come directly from you, automatically through the website and its technologies, or from service providers involved in payments, fraud prevention, store hosting, order fulfillment, and delivery. The categories received depend on the services actually used.

4. Why we use information

Essential store and order purposes

We use relevant information to process payments, fulfill and deliver orders, manage returns and refunds, communicate about purchases, provide support, operate account features where available, maintain security, prevent fraud, and meet accounting, tax, and other legal obligations.

Information needed to fulfill an order must be provided for us to process that order. Optional marketing information is not a condition of purchase.

Optional marketing, analytics, and personalization

Where these features are enabled and permitted, information may be used to measure website performance, understand browsing activity, personalize recommendations, or send promotional communications. Advertising integrations may use browsing and purchase activity to measure or personalize advertising.

These activities are subject to your choices and to any consent or other requirements of applicable law. You may decline optional marketing without affecting your ability to buy from us. You can unsubscribe using the link in a promotional email or contact us to limit optional use. Order confirmations, delivery updates, and necessary service messages may still be sent.

5. Legal grounds where applicable

Where the GDPR, UK GDPR, or similar rules apply, relevant grounds may include:

• Contract: processing information necessary to take steps you request before purchase, fulfill orders, and provide related support.
• Legal obligation: keeping required records and responding to lawful requests.
• Legitimate interests: protecting the store against fraud, maintaining secure and reliable services, and handling business communications, where those interests are not overridden by your rights.
• Consent: optional marketing, cookies, or other activities where consent is required.

You may withdraw consent without affecting processing that was lawful before withdrawal. We rely on other grounds only where applicable law permits them.

6. Cookies and privacy choices

Shopify and enabled integrations may use cookies and similar technologies for checkout, security, remembering preferences, analytics, and advertising.

Where available, use the website’s cookie banner or privacy settings to manage optional technologies. Where prior consent is required, non-essential technologies must remain disabled until consent is given. Browser settings also allow you to manage cookies, although blocking essential cookies may affect checkout or other functions.

Where applicable, you may request to opt out of activities legally classified as a “sale,” “sharing,” or targeted advertising. This terminology can include certain advertising disclosures and does not necessarily mean information is exchanged for money.

Use the store’s privacy controls where available or email zdrop004@gmail.com. Applicable legally recognized opt-out signals, including Global Privacy Control, must be honored as required by law.

7. Who may receive information

Relevant information may be disclosed to:

• Shopify, to host and operate the store and related services.
• Payment and fraud prevention providers, to process payments and protect transactions.
• Fulfillment suppliers and delivery companies, including suppliers shipping directly to customers, to prepare and deliver orders. They receive the information needed for those purposes.
• Technology and support providers, to maintain systems, communicate with customers, and provide enabled store features.
• Analytics or advertising providers, where those services are enabled and disclosure is permitted by your choices and applicable law.
• Professional advisers or public authorities, where reasonably necessary and legally permitted.
• A successor business, if the business is sold or reorganized, subject to applicable privacy obligations.

Consent will be requested for disclosures where required. Necessary operational processing and disclosures permitted without consent remain subject to applicable law.

8. Shopify’s role

Shopify processes information to provide the platform and its services. Depending on the service and store configuration, Shopify may act on our behalf or as an independent controller for its own purposes.

If Shopify features involving information from interactions across merchants are enabled, their operation is subject to Shopify’s notices, applicable settings, and customer choices.

You can read the Shopify Consumer Privacy Policy and use Shopify’s privacy portal for information and requests relating to Shopify’s own processing.

9. International processing

Information may be processed outside your country by Shopify, payment providers, fulfillment suppliers, carriers, and other service providers.

Where required, international transfers must use a valid legal mechanism, such as an applicable adequacy decision, standard contractual clauses, or another recognized safeguard. Contact us to request information about safeguards relevant to your data.

10. Retention and security

We retain information for as long as necessary for the purposes described above, including order fulfillment, support, required tax and accounting records, fraud prevention, and the handling of legal claims. The period depends on the record, applicable legal duties, and limitation periods. Information no longer needed is deleted, anonymized, or restricted as appropriate.

Reasonable organizational and technical safeguards must protect personal information. No online system is completely secure. Where a security incident triggers legal notification duties, affected individuals and authorities will be notified as required.

11. Your rights and how to request them

Depending on applicable law, rights may include access, correction, deletion or cancellation, objection, restriction, portability, withdrawal of consent, and opting out of certain advertising disclosures. Additional rights concerning significant automated decisions may apply where such decisions occur.

To make a request, email zdrop004@gmail.com with the subject Privacy Request and include:

• Your name and a way to contact you.
• The right or request you wish to exercise.
• Enough information to locate the relevant records.

We may request proportionate verification of identity or authority before disclosing or changing information. Please do not send identification documents unless we request them through an appropriate process.

We will respond within the deadline required by applicable law. If a request is refused or limited, we will explain the reason and any applicable appeal or complaint options. You will not be unlawfully discriminated against for exercising privacy rights.

Mexico: applicable rights include access, rectification, cancellation, and opposition (ARCO). We will communicate the decision within 20 business days and, if appropriate, implement it within the following 15 business days, subject to legally permitted extensions and requirements. You may also contact us to revoke consent or limit optional use or disclosure.

EEA and United Kingdom: additional rights may include objection to processing based on legitimate interests, restriction, and portability. Requests are generally answered within one month, with extensions only where legally permitted.

12. Children

The store is not directed at children. We do not knowingly collect children’s information in circumstances prohibited by applicable law. A parent or guardian who believes a child has provided information may contact us to request an appropriate review and deletion.

13. External websites and public content

Other websites and services have their own privacy practices. Review their notices before providing information. Reviews or other content you choose to publish may be visible publicly; avoid including information you do not want others to see.

14. Complaints and policy updates

Please send privacy concerns to zdrop004@gmail.com. You may also complain to the competent data protection authority and use any appeal rights available under applicable law. In the EEA, authorities are listed by the European Data Protection Board.

We may update this policy to reflect changes in practices, services, or legal requirements. The updated version will appear on this website with a revised date. Additional notice or consent will be provided where required.