Celestia Comprehensive Privacy Notice

Last updated: July 24, 2026

1. Identity and address of the data controller

[FULL NAME OF THE INDIVIDUAL OR BUSINESS ENTITY], who operates commercially under the name Celestia, with address at [FULL ADDRESS FOR THE PURPOSES OF THIS PRIVACY NOTICE], is responsible for the processing, protection, and safekeeping of the personal data collected through the website [CELESTIA DOMAIN], personalization forms, email, WhatsApp, payment methods, and any other authorized channels.

For the purposes of this Privacy Notice, the data controller may be contacted through:

From now on, the name "Celestia" will be used to refer to the data controller.

2. Scope of the Privacy Notice

This Privacy Notice regulates the processing of the personal data of:

  1. people who browse or interact with the Celestia website;
  2. people who request information or support;
  3. people who purchase certificates or add-ons;
  4. people who are the recipients of a Celestia certificate;
  5. people who request an invoice;
  6. people who exercise data-protection rights;
  7. people who take part in promotions, surveys, or campaigns; and
  8. people who authorize the use of testimonials or personalized products in promotional materials.

When a buyer provides information that belongs to a recipient or to a third party, Celestia may receive such data indirectly in order to prepare and deliver the contracted product.

3. Personal data processed

Celestia may collect and process the following categories of personal data, depending on the relationship maintained with each data subject.

3.1 Identification data

3.2 Contact data

3.3 Order-related data

3.4 Content provided by the buyer

Celestia will process this content only to prepare, review, deliver, temporarily back up, and, when appropriate, correct the requested product.

3.5 Payment and transaction data

Celestia may process:

When the payment is processed by an external platform or financial institution, Celestia will not necessarily store the full card numbers, security codes, passwords, or financial credentials. Such data will be processed directly by the payment provider under its own terms and privacy notices.

3.6 Tax data

When an invoice is requested, Celestia may collect:

3.7 Browsing and site-usage data

Celestia may automatically obtain certain technical data, such as:

3.8 Data related to rights requests

To verify identity and respond to requests for access, rectification, cancellation, opposition, limitation, or revocation, Celestia may process:

4. Sensitive personal data

Celestia does not ordinarily request sensitive personal data and does not require information related to racial or ethnic origin, health status, genetic information, religious beliefs, political opinions, trade union membership, sexual orientation, or other aspects of the most intimate sphere of a person.

The buyer should avoid including sensitive personal data in dedications, images, audio, links, or files.

When Celestia identifies sensitive personal data that is not necessary to prepare the order, it may request its deletion or replacement.

If, exceptionally, it becomes essential to process sensitive personal data, Celestia will first request the express written consent of the data subject through an autograph signature, an electronic signature, or an equivalent authentication mechanism. Mexican law requires express written consent for the processing of this category of data.

5. Data of recipients and third parties

The buyer may provide data of another person for the purpose of dedicating a certificate or delivering a product to them.

In such cases, the buyer declares that:

  1. they have a relationship or legitimate cause to provide the information;
  2. the data is appropriate and relevant to prepare the gift;
  3. they do not provide it for purposes of harassment, threats, deception, or impersonation;
  4. they hold the necessary authorizations when providing images, audio, sensitive data, or protected content; and
  5. they will inform the recipient about the processing of their data when legally required.

Celestia will limit the processing of the recipient's data to the preparation, identification, internal registration, and delivery of the product, unless the recipient grants additional authorization for other purposes.

The recipient may exercise their rights over their own data through the procedure established in this Privacy Notice.

6. Primary and necessary purposes

The personal data will be processed for the following purposes necessary to establish, maintain, and fulfill the legal relationship between the data subject and Celestia:

  1. identify the buyer;
  2. register and process the order;
  3. verify and confirm the information provided;
  4. prepare the Celestia certificate and the selected add-ons;
  5. personalize names, dates, dedications, images, links, and other elements;
  6. generate folios and internal records;
  7. generate, embed, or verify QR codes;
  8. process and confirm payments;
  9. prevent fraudulent or unauthorized operations;
  10. request necessary information or clarifications;
  11. provide previews, when part of the service;
  12. make applicable corrections and modifications;
  13. deliver the digital products;
  14. send confirmations, files, and order-related communications;
  15. temporarily keep backups for resending or corrections;
  16. respond to support requests;
  17. manage cancellations, refunds, chargebacks, and claims;
  18. issue fiscal receipts;
  19. keep evidence of the acceptance of the Terms and Conditions and the Privacy Notice;
  20. comply with contractual, tax, accounting, administrative, and legal obligations;
  21. protect the rights, safety, and legitimate interests of Celestia, its customers, and third parties;
  22. respond to duly founded requests from competent authorities; and
  23. manage requests related to personal data protection rights.

These purposes are necessary to provide the requested products and services. When the information is indispensable and the data subject refuses to provide it, Celestia may not be able to process or complete the order.

7. Secondary and optional purposes

With the corresponding consent, Celestia may process certain data for:

  1. sending news, promotions, and discounts;
  2. informing about new certificates, add-ons, or collections;
  3. sending editorial content or brand communications;
  4. conducting satisfaction surveys;
  5. requesting testimonials or reviews;
  6. analyzing general customer preferences;
  7. improving campaigns and commercial experiences;
  8. creating advertising audiences, when authorized tools are used for this; and
  9. publishing certificates, postcards, testimonials, or personalized content in the Celestia portfolio, website, or social media.

The secondary purposes are not necessary to complete a purchase. Refusing to authorize them will not affect the price, preparation, delivery, or quality of the product or access to Celestia services.

The data subject may express their refusal from the moment the data is collected, or afterwards through the procedure described in this Notice.

8. Promotional use of certificates, testimonials, and images

Celestia will not publish for promotional purposes any certificate that contains names, dates, dedications, photographs, audio, or other identifiable data without prior, specific, and separate authorization.

The authorization must identify at least:

Refusing to authorize the promotional use will not prevent the purchase from being made.

Celestia may freely use examples created with fictitious data or materials previously dissociated so that they do not allow the identification of the data subject.

9. Consent

By providing their personal data and having this Privacy Notice available, the data subject consents to their processing for the primary purposes stated, except in cases where the law allows processing without consent.

For secondary purposes, Celestia may request consent through an independent, voluntary, initially unchecked checkbox.

Express consent will be requested when it becomes necessary to process financial, patrimonial, or sensitive data, unless an exception recognized by applicable law applies. The law allows consent to be expressed through electronic means and establishes special requirements for financial, patrimonial, and sensitive data.

10. Limitation of use or disclosure of the data

The data subject may request that Celestia limit the use or disclosure of their personal data, especially to stop receiving promotions or secondary communications.

The request may be sent to the email:

[PRIVACY EMAIL]

The message must include:

Celestia will register the request in its internal exclusion list and will stop using the data for the indicated purposes, except for communications necessary to handle active orders, legal obligations, clarifications, security, or support.

The data subject may also use the unsubscribe mechanisms included in promotional emails.

11. Revocation of consent

The data subject may revoke the consent granted for purposes that require it.

The revocation must be requested by email sent to [PRIVACY EMAIL], with the subject line:

REVOCATION OF CONSENT

The request must contain:

  1. name of the data subject;
  2. channel for receiving notifications;
  3. information that allows locating their data;
  4. clear description of the consent they wish to revoke; and
  5. document that proves their identity or representation, when needed.

The revocation will not have retroactive effects and will not prevent Celestia from retaining or processing information when a legal, contractual, tax, administrative, or rights-defense obligation exists.

The law recognizes that consent may be revoked at any time without retroactive effects and requires that the notice establish the mechanism to do so.

12. Rights of access, rectification, cancellation, and opposition

The data subject or their legal representative may exercise the following rights at any time:

Access: learn which personal data Celestia holds, what it is used for, and the conditions of its processing.

Rectification: request the correction or update of inaccurate, incomplete, or outdated data.

Cancellation: request that the data be blocked and subsequently deleted when it is no longer needed or when its processing is inappropriate.

Opposition: request that the processing cease for a legitimate cause related to a particular situation or with respect to specific purposes.

The exercise of one right will not be a prerequisite for exercising another.

13. Procedure to exercise ARCO rights

Requests must be sent to:

The request must contain:

  1. name of the data subject;
  2. address, email, or other means for receiving notifications;
  3. documents that prove their identity;
  4. documents that prove the identity and standing of the representative, when applicable;
  5. clear description of the personal data involved;
  6. right they wish to exercise;
  7. explanation of the request; and
  8. any element that helps locate the information.

Rectification requests must indicate the requested changes and include the documents that support them.

Celestia will communicate its decision within a maximum of twenty business days from receipt of the request. When appropriate, it will enforce the right within the following fifteen days. These terms may be extended once for an equal period when circumstances justify it.

The delivery of information may be made through electronic documents, simple copies, or any other suitable means. The exercise of ARCO rights will be free of charge, except for justified costs of reproduction, copies, or shipping.

When the request does not meet the necessary requirements, Celestia may require additional information to continue processing it.

14. Inadmissibility of ARCO requests

Celestia may deny a request in whole or in part when:

  1. the identity or representation is not duly proved;
  2. the data is not in Celestia's possession;
  3. the rights of third parties are affected;
  4. there is a legal impediment or a resolution from a competent authority; or
  5. the requested rectification, cancellation, or opposition has already been carried out.

Celestia will communicate the reason for its decision within the legal term and, when appropriate, attach the supporting elements. These causes are provided for in the applicable law.

15. Procedure for the protection of rights

When the data subject considers that their right to the protection of personal data has been violated, they may file the corresponding request or procedure before the Secretaría Anticorrupción y Buen Gobierno, under the terms of the Federal Law on Protection of Personal Data Held by Private Parties.

Current law grants that Secretariat the supervision of compliance, the resolution of rights-protection procedures, and the imposition of sanctions in this area.

16. Transfers of personal data

Celestia may communicate personal data to national or foreign third parties only when necessary, lawful, and compatible with the purposes of this Privacy Notice.

Transfers may be made without additional consent when:

  1. they are required by a law, treaty, mandate, or resolution of a competent authority;
  2. they are necessary for the administration of justice;
  3. they are necessary for the recognition, exercise, or defense of a right;
  4. they are necessary to maintain or fulfill the legal relationship with the data subject;
  5. they are necessary by virtue of a contract concluded in the interest of the data subject; or
  6. any other case allowed by the legislation applies.

The legislation allows transfers without consent in certain cases, including compliance with the legal relationship, legal obligations, defense of rights, and authority mandates.

Celestia does not sell or commercialize personal data databases.

When Celestia intends to make a transfer other than the legal exceptions that requires consent, it will inform in advance about:

When consent must be obtained, the following independent statement may be used:

☐ I consent to the transfer of my personal data for the expressly informed purposes.

17. Data processors and technology providers

Celestia may contract providers that process personal data on behalf of and under the instructions of the data controller, including:

These parties will act as data processors when they process data solely on behalf of Celestia and will be subject to confidentiality, security, and processing obligations in accordance with the instructions received.

Cloud computing services must be provided by vendors that maintain data-protection policies and controls consistent with the applicable obligations.

18. Cookies and tracking technologies

The website may use cookies and similar technologies to enable its operation, store preferences, and obtain information about the interaction with its pages.

18.1 Necessary cookies

They may be used to:

These cookies are necessary to operate certain functions.

18.2 Preference and analytics cookies

With authorization, they may be used to:

18.3 Advertising cookies

Only when implemented and authorized, they may be used to:

Non-necessary cookies must be managed through a [BANNER OR PREFERENCE CENTER], where they may be accepted, rejected, or configured.

They may also be deleted or blocked from the browser. Disabling necessary cookies may cause some site functions to stop working properly.

The active tools will be identified in the cookies policy or in the site's preference center, including, where applicable, [NAMES OF THE TOOLS ACTUALLY USED].

19. Automated decisions

Celestia does not currently use personal data to make exclusively automated decisions that produce legal effects or significantly affect the rights or interests of a person.

If such processing is implemented in the future, Celestia will inform about its general logic, consequences, and opposition mechanisms before starting it.

20. Data of children and adolescents

Celestia contracting services are aimed at people with the legal capacity to make purchases.

When a minor wishes to acquire a product, the purchase must be made with the authorization and participation of their parent, guardian, or legal representative.

When the certificate is dedicated to a minor, the buyer must provide only the necessary data and have the authorization of whoever exercises parental authority, guardianship, or representation when applicable.

Celestia may delete information of minors that has been provided without authorization or that is not necessary to prepare the order.

21. Security and confidentiality measures

Celestia will establish and maintain reasonable administrative, physical, and technical measures to protect personal data against damage, loss, alteration, destruction, use, access, disclosure, or unauthorized processing.

Access will be limited to people who need the information to fulfill the authorized purposes.

The people involved in the processing must maintain confidentiality even after their relationship with Celestia ends.

The law requires maintaining administrative, technical, and physical measures according to the risks and the nature of the data, as well as confidentiality controls during all stages of the processing.

22. Security breaches

When Celestia confirms a security breach that significantly affects the patrimonial or moral rights of a data subject, it will inform them in a timely manner so they can take the necessary measures to protect their rights.

The communication may include:

The obligation to report significant breaches is set out in the applicable legislation.

23. Retention of personal data

Celestia will retain the data only for the time necessary to fulfill the purposes that motivated its collection and the legal obligations derived from the relationship.

In general:

  1. the files used to personalize certificates will be kept for [BACKUP PERIOD, FOR EXAMPLE, 90 DAYS] after delivery;
  2. the order, payment, acceptance, and support records will be kept for the period necessary to address clarifications, liabilities, and legal obligations;
  3. tax and accounting data will be kept for the periods established by the applicable provisions;
  4. promotional data will be kept until the person withdraws their consent or requests the limitation;
  5. ARCO requests will be kept for the period necessary to prove their handling; and
  6. authorized promotional content will be kept while the consent remains in force.

When the data is no longer needed, it will be blocked and subsequently deleted or dissociated, unless it must be retained to fulfill an obligation or defend a right. The law requires deletion after the retention period when the data is no longer necessary for the informed purposes.

24. Changes to the Privacy Notice

Celestia may modify this Privacy Notice to address:

The current version will be published at:

[ADDRESS OR SECTION OF THE SITE WHERE IT WILL BE AVAILABLE]

When the change involves new purposes that require consent, sensitive data, or transfers subject to authorization, Celestia will request the corresponding consent before applying the new processing.

The date of the last update will appear at the beginning of the document.

25. Acceptance and acknowledgment of the Privacy Notice

Before completing a purchase, the buyer may have access to a checkbox with the following text:

☐ I confirm that I have read the Celestia Privacy Notice and acknowledge that my personal data will be processed to process, personalize, and deliver my order.

When the same checkbox is used to accept the Terms and Conditions, the following wording may be used:

☐ I confirm that I have reviewed my order details and that I have read and accept the Celestia Terms and Conditions and Privacy Notice.

Authorization to receive advertising must be requested separately:

☐ I wish to receive news, promotions, and commercial communications from Celestia.

The promotional authorization will be voluntary and will remain unchecked by default.

26. Optional consents

Promotional communications

☐ I authorize Celestia to use my name, email, and contact data to send me news, promotions, and commercial communications.

Use of certificate or testimonial

☐ I authorize Celestia to use the certificate, testimonial, or material expressly identified in the corresponding authorization for portfolio and promotional purposes.

Sensitive personal data

When exceptionally necessary:

☐ I expressly and in writing consent to the processing of the sensitive personal data identified in the corresponding request, exclusively for the purpose that has been informed to me.

27. Contact

For any question related to this Privacy Notice, the processing of personal data, the revocation of consent, the limitation of use, or the exercise of rights, the following channels may be used: