Privacy policy

Effective from: June 2025  ·  Last updated: September 2026

1. Who we are and the scope of this policy

Caracas Merch operates the website www.caracasmerch.com and sells merchandise products. This Privacy Policy applies to all visitors, customers and subscribers who interact with our platform.

Data controller:

Caracas Merch LLC
6966 NW 116th Ct
Doral, FL 33178
United States
Email: info@caracasmerch.com

By accessing our site or making a purchase, you accept the terms described in this document. If you do not agree with any provision, we ask that you refrain from using our services.

This policy may be updated periodically. The current version will always be available on our website. Continued use of our services after an update constitutes acceptance of the changes.

2. Information we collect

Data you provide directly:

  • Full name
  • Shipping and billing address
  • Phone number
  • Email address
  • Content you voluntarily post, such as product reviews and associated photographs
  • Your customer account data and your participation in our loyalty program, including points history, redemptions and access to exclusive content or collections
  • Payment information (securely processed by certified third parties; we do not store card data)

Data collected automatically:

  • IP address and approximate geographic location
  • Browser type, device and operating system
  • Pages visited, time on site and browsing behavior
  • Records of interaction with the site, including cursor movement, clicks and scrolling, captured in anonymized form through user experience analytics tools
  • Cookies, pixels and similar tracking technologies

We do not request or knowingly collect sensitive data such as health information, ethnic origin, religious beliefs or political opinions.

3. How we use your information

We use your data solely for the following purposes:

  • Order management: processing, confirming and dispatching your purchases through Shopify.
  • Payment processing: completing the transaction through the payment method you choose, including installment payment providers.
  • Transactional communications: sending payment confirmations, shipping notifications and customer service information.
  • Marketing with consent: if you voluntarily subscribe, sending promotions and news through Klaviyo. You may unsubscribe at any time.
  • Targeted advertising: showing relevant ads on third party platforms to people who have visited our site or who share characteristics with our customers. You may opt out under sections 4 and 9.
  • Use of customer posted content: displaying reviews, photographs and comments you post, on our website, social media, email campaigns and advertising materials, in accordance with the "User generated content" section of our Terms of Service.
  • Service improvement: analyzing browsing behavior to optimize the site experience.
  • Fraud prevention: detecting, investigating and preventing fraudulent or illegal activity.
  • Legal compliance: responding to requests from competent authorities where required by law.

Legal basis: We process your data on the basis of (a) performance of the sales contract, (b) express consent for marketing communications and non essential cookies, and (c) legitimate interest in fraud prevention and service improvement.

Automated decisions: Caracas Merch does not make automated decisions producing legal effects concerning you. If you choose to pay in installments, the creditworthiness assessment is carried out by the payment provider, as set out in section 5.

4. Cookies and tracking technologies

We use first party and third party cookies for the following purposes:

  • Essential cookies: required for the shopping cart and authentication to function. These cannot be disabled.
  • Analytics and user experience cookies: collect aggregated data about site usage and record interaction with pages in anonymized form, to detect errors and improve navigation.
  • Marketing and advertising cookies: allow us to show relevant advertising on third party platforms and measure the performance of our campaigns.

You can control or delete cookies from your browser settings at any time. For users in the European Union, the United Kingdom and California, we request explicit consent before activating non essential cookies.

Browser opt-out signals: we recognize and honor privacy preference signals sent by your browser, including Global Privacy Control (GPC), where applicable law requires it. When we detect one of these signals, we treat it as a valid request to opt out of targeted advertising for that browser and device.

5. Sharing information with third parties

We share your data only with the providers necessary to operate our store, analyze its performance and make our products known:

  • Shopify Inc.: e-commerce platform, site hosting and payment processing.
  • Klaviyo Inc.: email marketing platform, only if you subscribe.
  • Logistics providers: courier companies required to dispatch your orders.
  • Payment gateways: Shop Pay, PayPal or other PCI-DSS certified processors.
  • Installment payment providers: Klarna Bank AB (publ) and equivalent providers, when you choose to pay on deferred terms or in installments.
  • Advertising and analytics platforms: Meta Platforms, Inc. (Facebook and Instagram) and Google LLC, through pixels and tags that allow us to measure campaign performance and show relevant ads.
  • User experience analytics tools: Microsoft Clarity, which records interaction with our pages in anonymized form to help us detect errors and improve navigation.
  • Reviews platform: Judge.me, to collect and publish the product reviews you choose to leave.

Installment payments and credit assessment. If you choose to pay with Klarna or another installment payment provider, we share with that provider the data necessary to complete the transaction: name, billing and shipping address, email address, order amount and order details. These providers act as independent data controllers and may carry out identity verification and creditworthiness assessments in accordance with their own policies. Their processing of your data is governed by that provider's privacy policy, available on their website. Caracas Merch does not receive or store the results of those assessments.

Targeted advertising. To show relevant ads, we share online identifiers and browsing data associated with your device with advertising platforms. Under certain laws, including California's, this activity is considered "sharing" personal information, even though we receive no monetary consideration for it. You may opt out at any time under sections 4 and 9.

Express statement: Caracas Merch does NOT sell your personal information for money, and does not rent, trade or transfer it to third parties for those third parties' own commercial purposes.

We may also disclose information where required by law, in response to a valid request from a competent authority, or where necessary to protect our rights, and in the context of a merger, acquisition or sale of assets, in which case the acquirer will be bound by the obligations of this policy.

All of our providers are contractually obligated to protect your data and to use it only for the services they provide to us.

6. Data security

We implement reasonable technical and organizational measures to protect your information:

  • Encrypted connections via SSL/TLS on all pages of the site.
  • Storage on Shopify servers, which meet PCI-DSS standards.
  • Access to personal information restricted to authorized personnel only.
  • Periodic review of our security practices.

Incident notification: in the event of a security breach affecting your personal data that may pose a risk to your rights, we will notify you without undue delay by email to your registered address, and will notify the competent authorities within the timeframes required by applicable law.

Limitation of liability: No internet data transmission system is 100% secure. Caracas Merch will not be liable for security breaches caused by factors outside its reasonable control, including third party attacks, infrastructure failures of external providers or acts of force majeure.

7. Legal compliance and jurisdiction

We operate in compliance with applicable privacy laws, including:

  • GDPR (EU General Data Protection Regulation) for European users.
  • CCPA / CPRA (California Consumer Privacy Act) for California residents, USA.
  • CAN-SPAM Act for commercial electronic communications in the USA.

International data transfers: Caracas Merch LLC operates from the United States. If you reside outside the USA, your data will be transferred to and processed in the United States and in the countries where our service providers operate. These transfers are carried out on the basis of standard contractual clauses or other transfer mechanisms recognized by applicable law.

Right to lodge a complaint: if you reside in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with the data protection supervisory authority of your country of habitual residence, without prejudice to any other remedy. We would appreciate the chance to resolve the matter with you directly first.

Jurisdiction and governing law: This Privacy Policy is governed by the laws of the State of Florida, United States. Any dispute related to this policy will be submitted to the jurisdiction of the competent courts of the State of Florida, without prejudice to the rights granted to you by the mandatory provisions of your country of residence.

8. Your rights as a user

Under applicable legislation, you have the right to:

  • Access: request a copy of the personal data we hold about you, as well as information about the categories of data collected and the third parties with whom it is shared.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure ("right to be forgotten"): request deletion of your personal information, except where we are legally required to retain it.
  • Portability: receive your data in a structured, machine readable format.
  • Objection and restriction: object to the processing of your data for direct marketing or targeted advertising, and request restriction of processing.
  • Withdrawal of consent: unsubscribe from marketing communications at any time, without penalty.

To exercise any of these rights, contact us at info@caracasmerch.com. We will acknowledge your request within a maximum of 2 business days and resolve it within a maximum of 30 calendar days, extendable where applicable law permits and the complexity of the request justifies it, in which case we will inform you. We may request identity verification before processing your request.

Non-discrimination: we will not deny you products or services, charge you different prices, or provide you a different level of service for having exercised any of these rights.

If your request concerns data processed by an installment payment provider such as Klarna, you must direct it to that provider, as it acts as an independent data controller.

9. Specific rights for California residents

If you are a California resident, the CCPA and CPRA grant you the following rights in addition to those in section 8:

  • Right to know: request details of the categories and specific pieces of personal information we have collected about you in the past twelve months, the sources of that information, the purpose of processing and the categories of third parties with whom we have shared it.
  • Right to opt out of sale or sharing: although we do not sell your personal information for money, the use of advertising pixels to show you targeted ads may constitute "sharing" under the CPRA. You may opt out of this activity by rejecting marketing cookies in our consent banner, enabling the Global Privacy Control signal in your browser, or emailing us at info@caracasmerch.com.
  • Right to limit the use of sensitive information: we do not collect or use categories of sensitive personal information as defined by the CPRA for purposes other than those permitted by law.
  • Right to non-discrimination for exercising any of these rights.

You may exercise these rights yourself or through an authorized agent. In the latter case we may request proof of authorization and verify your identity directly.

10. Data retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy:

  • Order and billing data: between 5 and 7 years, in accordance with applicable tax and accounting obligations.
  • Customer account data: while the account remains active, and for up to 24 months after your last interaction with us.
  • Marketing data: until you withdraw consent or request deletion.
  • Browsing data and cookies: according to each cookie's lifespan, and in no case longer than 24 months.

After the retention period expires, your data will be permanently deleted or anonymized.

11. Links to third party sites

Our site may contain links to third party websites. Caracas Merch is not responsible for the privacy practices, content or security of those external sites. Access to third party sites is at the user's sole risk and responsibility.

12. Minors

Our services are not directed at anyone under 18 years of age. We do not knowingly collect personal information from minors. If you are a parent or legal guardian and become aware that a minor has provided us with personal data, contact us at info@caracasmerch.com and we will delete that information immediately.

13. Changes to this policy

Caracas Merch reserves the right to update this Privacy Policy at any time. When we make material changes, we will notify our users through a notice on the website or by email to the address registered on your account, and we will update the last updated date shown at the top of this document.

Continued use of our services after changes are published constitutes acceptance of the updated policy.

Questions? Email us at info@caracasmerch.com, we respond within a maximum of 2 business days.