Privacy Policy

Christmasmercantile.com is a brand by Holly&Jolly LLC.

Last Updated: Nov. 17, 2025

This Privacy Policy describes how Holly&Jolly LLC. ("we," "us," or "our") collects, uses, and shares your personal information when you visit or make a purchase from christmasmercantile.com (the "Site") in accordance with the New Mexico Consumer Information Privacy Act (CIPA).

By using the Site, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

We collect information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular consumer or household ("Personal Information"). In the past 12 months, we have collected the following categories of Personal Information:

  1. Identifiers

Examples: A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.

  1. Personal Information Categories
    Examples: A name, telephone number, bank account number, credit card number, debit card number. (Some personal information included in this category may overlap with other categories.)
  2. Commercial Information
    Examples: Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
  3. Internet or Other Electronic Network Activity
    Examples: search history, and information regarding a consumer's interaction with an Internet website, application, or advertisement.
  4. Geolocation Data
    Examples:Physical location (e.g., derived from your IP address).
  5. Inferences
    Examples: Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer's preferences, characteristics, predispositions, behavior, attitudes, abilities, or aptitudes.

We collect this information directly from you when you provide it to us (e.g., during account creation or checkout process) and automatically as you navigate through the site (e.g., using cookies and similar tracking technologies).

2. How We Use Your Personal Information

We use the Personal Information we collect for the following business and commercial purposes:

  • To fulfill or meet the reason you provided the information. This includes processing your payments, arranging for the shipment of your order, and providing you with invoices and/or order confirmations.
  • To operate, maintain, and improve our Site and services.
  • To communicate with you, including for customer service, updates, and promotional purposes.
  • To detect security incidents and protect against malicious, deceptive, fraudulent, or illegal activity.
  • For debugging to identify and repair errors that impair existing intended functionality.
  • For short-term, transient use, such as contextual customization of ads.
  • Undertaking internal research for technological development and demonstration.

3. Sharing Personal Information for Business Purposes

We share your Personal Information with third parties to help us use your Personal Information, as described above. For example, we use Shopify to power our online store and other service providers for payment processing, analytics, and marketing.

Crucially, to fulfill your orders, we use a dropshipping model. This means we share your Personal Information with our trusted dropshipping partners who warehouse the products and ship them directly to you on our behalf.

  • Categories of Third Parties: Our service providers (e.g., web hosts, analytics), payment processors (e.g., Stripe, PayPal), and dropshipping suppliers.
  • Information Shared for Fulfillment: To complete your order, we must provide our dropshipping suppliers with your Identifiers and Personal Information Categories, specifically your name, shipping address, and contact information (e.g., email or phone number for shipping updates). They do not receive your payment information.
  • Purpose of Sharing: This sharing is strictly necessary to perform the services you requested—namely, delivering the physical products you purchased.

All third-party service providers and dropshipping partners are contractually obligated to use your Personal Information only for the specific business purpose for which we provide it and to protect it to the same standard we do. They are prohibited from using your information for their own independent marketing purposes.

4. Selling Personal Information

The CIPA defines "sale" broadly as sharing personal information for "monetary or other valuable consideration."

Our Practice: We do not sell your Personal Information to third parties in the traditional sense for monetary compensation.

We share your information with dropshippers as a core part of our service. This integration is a "business purpose" under CIPA (performing services on behalf of the business), not a "sale," because the information is shared strictly to fulfill your specific transaction. We do not receive any compensation for the data itself from our dropshippers.

5. Your Rights Under the New Mexico CIPA

As a consumer, you have the right to:

  • Request to Know: You can request that we disclose to you the categories and specific pieces of Personal Information we have collected, used, and disclosed about you in the past 12 months.
  • Request to Delete: You can request that we delete any Personal Information about you that we have collected from you.

*Important Note on Deletion: Please be aware that if you request deletion, we may be unable to fulfill outstanding orders or process returns for previous orders, as the information is necessary for those purposes. We will also be required to instruct our dropshipping partners to delete your data from their records, which may impact their ability to support your previous orders.

  • Opt-Out of Sale: You have the right to direct a business that sells Personal Information about you to third parties not to sell your Personal Information. As stated above, we do not sell your Personal Information.
  • Non-Discrimination: We will not discriminate against you for exercising any of your CIPA rights.

6. How to Exercise Your Rights

To exercise your Right to Know or Right to Delete, please submit a verifiable consumer request to us by either:

  1. Emailing us at: support@christmasmercantile.com
  2. Visiting: christmasmercantile.com/contact

Only you, or a person registered with the New Mexico Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your Personal Information.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request. The verifiable consumer request must provide sufficient information to allow us to verify you and describe your request with sufficient detail to allow us to understand, evaluate, and respond to it.

We will endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period.

7. Data Security

We have implemented measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. All data transfers to our dropshipping partners are done through secure channels. However, the transmission of information via the internet is not completely secure, and we cannot guarantee the security of your Personal Information transmitted to our Site.

8. Changes to This Privacy Policy

We reserve the right to update this privacy policy at any time. When we do, we will revise the "Last Updated" date at the top of this page. We encourage you to frequently check this page for any changes.