‌Effective Date: October 15, 2026‌

1. Introduction

Welcome to the privacy policy of TONY TIENDAS, S.A. DE C.V. (hereinafter referred to as “we”, “us” or “our”). We operate the e-commerce shopping website accessible at www.tonytiendas.com, and we are deeply committed to protecting the personal information, privacy rights and data security of every user who visits, browses, shops and interacts with our platform.

We recognize that your personal information is of great importance, and your trust in us is the cornerstone of all our services. In full compliance with applicable Mexican data protection regulations, including the Ley de Protección de Datos Personales and the newly revised Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) which entered into force on March 21, 2025, as well as relevant international data protection standards aligned with global best practices, we have formulated this Privacy Policy. This document clearly explains how we collect, use, store, transmit, protect and manage your personal information when you use our platform services, so that you can fully understand our data processing rules and make informed choices when using our e-commerce services.

If you have any questions, comments or requests related to this Privacy Policy or our personal information processing activities, you can contact us at any time via the following channels:

• Contact Email: pixen@tonytiendas.com
• Physical Address: Avenida Urano 585, Interior B, Colonia Jardines de Mocambo
• Contact Telephone: +52 800 925 6278

2. Definitions of Key Terms

For the purpose of this Privacy Policy, the following terms shall have the meanings specified below:

1. ‌Personal Data‌: Refers to any information that can directly or indirectly identify a specific natural person, including but not limited to your full name, identification number, contact information, account credentials, order details, and device related identifiers that can be linked to you.
2. ‌Sensitive Personal Data‌: Refers to personal data that is highly private, or whose improper use may lead to discrimination, physical harm, property loss or other high risks to you. This category includes but is not limited to health data, biometric information such as facial features and fingerprints, religious beliefs, political affiliations, financial account information, precise geolocation data, and personal information of minors under the age of 14. In accordance with the requirements of LFPDPPP, any processing of sensitive personal data will strictly follow the principle of obtaining your explicit written consent, and will only be carried out within the scope necessary to provide you with the agreed services.
3. ‌User‌: Refers to any natural person who visits our website, creates a user account, browses products, submits orders, or uses any other functions and services provided on www.tonytiendas.com.

3. Scope of Application of This Policy

This Privacy Policy applies to all personal information processing activities carried out by us when you access and use all services provided through our official website www.tonytiendas.com, including web pages, mobile adaptive versions, subsequent official applets and other new service forms that may be launched in the future.

If we or our affiliated companies provide independent privacy policies for specific exclusive product lines or special customized services, the corresponding independent privacy policy shall prevail for those specific service scenarios. This Privacy Policy does not apply to services provided by third-party merchants, third-party payment service providers, third-party logistics partners or other external third parties that you may access through links or service entrances on our website. Those third parties shall be responsible for formulating their own independent privacy policies, and your use of third-party services shall be subject to their respective privacy rules.

4. Collection and Use of Your Personal Information

We only collect personal information that is necessary to achieve the corresponding service functions, strictly abide by the principle of minimization, and will not collect more information than the purpose explicitly notified to you. The specific collection scenarios, information types and usage purposes are as follows:

4.1 Information Collected to Provide Basic E-commerce Functions

When you use the core basic shopping functions of our platform, we need to collect the following necessary personal information to ensure that we can fulfill the shopping service agreement with you smoothly:

1. ‌Account Registration and Login‌: When you choose to register a user account on our platform, we will collect your mobile phone number, create a unique user ID for you, and set up the account security authentication system. This information is used to verify your identity, protect the security of your account, and prevent unauthorized access to your account and order information. If you refuse to provide this part of the necessary information, you will not be able to complete the registration and normally use the complete order submission, order tracking and other shopping functions.
2. ‌Order Fulfillment and Delivery‌: When you place an order to purchase goods on our platform, we will collect your full name, contact phone number, detailed delivery address, and the specific information of the goods you purchase. This information is used to process your payment request, arrange the delivery of goods, complete the order fulfillment process, and ensure that the goods you purchase can be accurately delivered to you.
3. ‌Payment Processing‌: When you complete the payment for the order, we will collect the necessary payment related information according to the type of payment method you choose, including transaction records, payment status confirmation information. We will not directly store your complete bank card number, full CVV code and other highly sensitive financial information, and all payment processing processes are completed in cooperation with licensed and qualified third-party payment institutions that comply with Mexican financial regulatory requirements.
4. ‌Service Security and System Operation‌: During your visit and use of our website, we will automatically collect your device information (including device model, operating system version, unique device identifier), browsing log information (including access time, page dwell time, click path, network IP address) to maintain the normal operation of our service system, identify abnormal access risks, prevent fraud, malicious attacks and other behaviors that damage platform security and user interests.

4.2 Information Collected for Optional Additional Functions

In order to provide you with a more optimized and personalized shopping experience, we will collect the following information only after you separately grant us your explicit consent. If you choose not to grant the corresponding consent, you can still normally use the basic shopping functions of our platform, but you will not be able to enjoy the corresponding additional value-added services:

1. ‌Personalized Recommendation Service‌: With your separate consent, we will collect your browsing history on our website, product search keywords, add-to-cart records, order purchase history, rough geographic location information, and service operation logs. We will use this information to analyze your shopping preferences, and recommend products, promotional activities and content that may be of interest to you, helping you quickly find the products you need.
2. ‌Social Sharing Function‌: When you use the share function to share product links, activity information to other social platforms, we will apply for your permission to access the storage permission of your device, so that you can save product pictures, share content to your local device, and smoothly complete the sharing operation.
3. ‌After-sales Service and Customer Support‌: When you submit an after-sales application for ordered goods, and upload photos or videos of product defects to assist in handling the after-sales request, we will apply for your permission to access the camera function of your device, to help you shoot and upload the required after-sales evidence materials. When you use the online one-to-one customer consultation function, we will apply for your permission to access the microphone function of your device, to support voice consultation and voice after-sales submission services.
4. ‌Event Arrangement and Member Welfare‌: If you participate in our offline customer experience activities, exclusive member offline meetings and other activities, we will collect your identity document information, transportation arrangement information, and special dietary preference information you provide, to arrange the activity itinerary reasonably and provide you with appropriate on-site services.

5. Rules for Sharing, Disclosure and External Provision of Your Personal Information

We will never sell, rent or trade your personal information to any unrelated third parties for profit. We will only share your personal information with third parties under the following clear circumstances:

1. ‌Necessary Sharing with Authorized Service Partners‌: We will share the necessary information related to order delivery with the logistics and distribution partners we cooperate with, only to the extent that it is necessary to complete the goods delivery service. We will share the necessary payment information with licensed payment service providers, only to process your order payment. All our cooperation partners will sign strict data protection agreements with us, and they are only allowed to process your personal information in strict accordance with our requirements, the agreed purpose and scope, and have no right to use your information for any other unauthorized purposes.
2. ‌Sharing Based on Your Explicit Consent‌: If you explicitly agree or independently request us to share your information with a designated third party, we will share the corresponding information with the target subject within the scope of your authorization.
3. ‌Disclosure Required by Law or Authorized by Government Authorities‌: If we receive formal legal notices, court orders or mandatory requirements issued by the competent Mexican government authority, we may disclose your personal information as required, in order to fulfill our legal obligations and safeguard the public interests of society.

6. Your Rights Over Your Personal Information

In full compliance with the provisions of LFPDPPP and other applicable data protection laws, you enjoy the following complete rights over your personal information processed by us:

1. ‌Right of Access‌: You have the right to log in to your personal account on our website at any time, to view, browse and download all your personal information stored on our platform, including account information, order history, stored address book and other related content.
2. ‌Right to Correction‌: If you find that the personal information we hold about you is inaccurate or incomplete, you can submit a modification request on your personal account page, or contact our customer service team, and we will verify and update the relevant information for you in time.
3. ‌Right to Deletion‌: You have the right to request us to delete your personal information under the circumstances that the purpose of processing your personal information has been realized, the information is no longer necessary for the original service purpose, or you withdraw your previous consent to the data processing. We will respond to your deletion request within the time limit required by law, except for the information that we are required to retain in accordance with the provisions of tax laws, e-commerce transaction record retention regulations and other applicable laws.
4. ‌Right to Withdraw Consent‌: You can modify the authorization scope of the permissions you have granted to us, or completely withdraw your consent to the processing of your personal information at any time through the privacy setting page in your personal account. After you withdraw your consent, we will no longer process the corresponding information. Please note that the withdrawal of consent will not affect the validity of any data processing activities we have carried out based on your consent before the withdrawal.
5. ‌Right to Account Cancellation‌: You have the right to submit an application for canceling your user account at any time. After you complete the identity verification, we will complete the account cancellation process for you within the time specified by law, and delete all your personal information except the content that we are legally required to retain.
6. ‌Right to Data Portability‌: You have the right to request us to provide your personal information in a common machine-readable format, and you can transmit this information to other data controllers as you wish.

We will not set up unreasonable barriers for you to exercise the above rights, and will not charge any fees for processing your reasonable requests for exercising your rights, unless your requests are repetitive, obviously excessive or repeated without reasonable reasons.

7. Storage and Protection of Your Personal Information

We store your personal information in server facilities located in the territory of Mexico, and we will not carry out cross-border transmission of your personal information unless it is necessary for the performance of the contract, or we have obtained your separate explicit written consent, and the cross-border transmission meets the relevant regulatory requirements of LFPDPPP. We will retain your personal information for no longer than the period necessary to fulfill the service purpose specified in this policy, or the period required by mandatory legal provisions.

We have adopted industry leading technical and organizational security protection measures to protect your personal information: all data transmission between your browser and our website uses TLS encryption technology to prevent information from being intercepted during transmission. We have deployed multi-layer network security firewalls, intrusion detection systems and regular security vulnerability scanning mechanisms. Our internal data access authority is strictly controlled through hierarchical authorization, and all access and operation records of personal information will be logged and audited. We also organize regular data security compliance training for all our employees, to ensure that all personnel strictly abide by our data protection management regulations. In the event of a personal information security incident that may endanger your interests, we will notify you in accordance with the time and method required by law, and promptly take effective remedial measures.

8. Updates to This Privacy Policy

According to the adjustment of our service operation, the update of new regulatory requirements, or the optimization of data processing rules, we may appropriately update the content of this Privacy Policy. When we make changes to this policy, we will prominently publish the updated version on the homepage of www.tonytiendas.com, mark the latest effective date, and notify you through in-site pop-up reminders, registered email or other appropriate notification channels. The updated Privacy Policy will take effect on the marked effective date. If you continue to use our website services after the effective date of the updated policy, it means that you have fully read, understood and agreed to the modified content of the new Privacy Policy.

9. Protection of Minors’ Personal Information

Our e-commerce platform is mainly oriented to users over the age of 18. If you are a minor under the age of 18, please use our services under the guidance and supervision of your parents or other legal guardians, and do not submit any personal information to us without the consent of your guardian. If we accidentally collect the personal information of minors under 14, we will take measures to delete the relevant information as soon as possible once we discover the situation.

10. Final Provisions

This Privacy Policy is formulated in accordance with the applicable laws and regulations of the United Mexican States. If you have any disputes related to this Privacy Policy, you can first contact us through the contact channels provided in this policy, and we will communicate with you in good faith to resolve the problem. If you believe that our processing of personal information has violated your legitimate rights and interests, you also have the right to submit a complaint to the competent data protection regulatory authority in Mexico.

Thank you for choosing the shopping services provided by TONY TIENDAS, S.A. DE C.V. We will always take strict responsibility for protecting your personal privacy, and strive to build a safe, transparent and trusted e-commerce shopping environment for every user. If you have any questions about this Privacy Policy, please contact us at:

• Email: pixen@tonytiendas.com
• Address: Avenida Urano 585, Interior B, Colonia Jardines de Mocambo
• Phone: +52 800 925 6278‌