Privacy notice

Information we handle

We may receive your name, email address, telephone number, language and enquiry. If you use the portal, we also handle your account and billing profile, including your name or business name, Mexican tax ID (RFC), tax regime, postal code and CFDI use, together with information needed to identify your proposal or requested service.

To record and verify transactions, we handle references, amounts, currency, dates, payment status, payment-provider identifiers and the files and identifiers of generated receipts. Conekta’s hosted form receives card information; do not send us full card numbers, CVV codes, passwords or private keys through our forms or email.

Access and security controls use technical information such as IP addresses, session identifiers, language, access dates and hashed email identifiers. We do not request sensitive personal information for the services described here; please do not include it in free-text fields.

Why we use information

Necessary purposes include answering enquiries, preparing and following up on quotations, identifying customers, managing access and requests, providing agreed services, recording payments and invoices where applicable, communicating service issues or conditions, handling cancellations and complaints, preventing abuse and meeting legal obligations.

We do not sell your personal information. Reading or accepting this notice and sending an enquiry do not constitute acceptance of a service agreement or authorise charges or promotional campaigns unrelated to your request. If we later offer promotional communications or optional processing, we will explain the purpose and how to accept or decline it without making necessary services conditional on that choice.

Providers and disclosure of information

Depending on the function used, providers include hosting and email services, Google reCAPTCHA for abuse protection, Conekta for hosted payment forms and payment processing, and Facturama for generating and managing receipts. Information necessary for each function is communicated; some providers may process it outside Mexico under their own terms and notices.

We distinguish processing by providers acting on our behalf from transfers to other controllers. Disclosures necessary for the legal relationship or legal obligations and requests take place within the applicable legal grounds. If a transfer requires consent and no statutory exception applies, we will request that consent beforehand. Providers collecting information directly through their own forms also make their privacy notices available.

Sessions and form protection

The site uses cookies or identifiers needed to maintain sessions, protect forms and preserve access context. You can manage them in your browser; blocking them may prevent sign-in or form submission.

Protected forms load Google reCAPTCHA. This tool may send Google technical information such as an IP address, browser information and interaction signals, and use cookies to distinguish legitimate requests from abuse. This security function does not mean that ZATEU has enabled personalised advertising. Any addition of non-essential analytics or advertising must be disclosed and, where required, provide appropriate consent choices.

Retention and security

We keep information for as long as needed to address the enquiry or relationship, manage receipts and complaints and comply with statutory retention periods. When it is no longer needed, applicable blocking or deletion measures will be taken, accounting for backups and retention duties. Cancelling a service does not immediately erase invoices or records that must be retained.

We apply access controls and security measures intended to protect information. No system offers absolute security. If we identify a breach that significantly affects your rights, we will notify you in accordance with applicable obligations.

Your rights and how to exercise them

You may request access, rectification, cancellation or objection to the processing of your information (ARCO rights), withdraw consent where applicable and limit its use or disclosure. Contact the controller using the email address displayed on this page or the contact form, with the subject “Privacy / ARCO”. You do not need to purchase another service to make a request.

Provide your name, a means of receiving a reply, the right or request, and the relevant information or account if known. To correct information, describe the correction and provide relevant supporting material. We will request only what is necessary to establish identity or authority proportionately and explain how to provide it; do not send full card information or access secrets.

We will communicate our determination within a maximum of 20 business days of receiving the request and, if it is granted, implement it within the following 15 business days after the response. These periods may be extended once by an equal period when justified, and we will tell you why. Exercising these rights is free, except for reproduction or delivery costs allowed by law.

Erasure or withdrawal may be limited by legal obligations or information necessary to perform an ongoing relationship. If so, we will explain the reason and scope of our response. Such a limitation will not be used to continue optional purposes you have declined.

Changes to this notice

Changes will be published on this page with a version and date. Where a new purpose or other change requires direct notice or renewed consent, we will use the available contact channel before carrying out the relevant processing. Merely publishing a change does not replace any consent that is required.