Notice contents
Who is responsible for your data
Productores y Microempresarios Mexicanos Mexpyme, S.C. (MexPyme) is the data controller for your personal data: it decides what it is used for and how. This notice applies to mexpyme.com.mx, including the /diagnostico/ page, and to anything you share with us by WhatsApp, phone or email.
- Legal name
- Productores y Microempresarios Mexicanos Mexpyme, S.C.
- Trade name
- MexPyme
- RFC (Mexican tax ID)
- PMM1002045T8
- Address
- Calle Siracusa 240, Edificio J3, Int. 304, Col. San Nicolás Tolentino, C.P. 09850, Iztapalapa, Ciudad de México
- Privacy email
- contacto@mexpyme.com.mx
- Phone
- +52 55 3905 3993Monday to Friday, 9:00 a.m. to 6:00 p.m. (Mexico City time)
Requests about your data are handled by the MexPyme personal data department, at the same email address.
Source: LFPDPPP (DOF Mar. 20, 2025), arts. 15, sec. I, and 29.
What data we collect
We only ask for what is needed to understand your operation and contact you. We collect it directly from you: through the form, by WhatsApp, by phone or by email.
Identification and contact
- Your name
- Your company name, if you choose to give it
- Your WhatsApp number (10 digits)
- Your email address
- The channel and time you prefer to be contacted
- Any comment you decide to add
Your operation
- Whether you import or export, and what stage you are at
- What the goods are and which country they come from or go to
- If they are held up: what is happening, where the goods are and whether you received an official notice (acta)
- When you need them
- Whether it is for your company or for personal use
- Whether you have an RFC and are in the importer registry: only yes or no, never the RFC number
- The approximate value of the goods, in ranges
Technical data
- Your IP address and your browser and device type
- The page from which you sent the request
- The campaign parameters (UTM) of the link you arrived through
- On /diagnostico/ and /en/review/, the identifiers of the Meta pixel cookies and of the submission event
Value of the goods. This may be considered financial (patrimonial) data. That is why the form is only sent if you check the box accepting the notice: that is your express consent.
What we don’t ask for
- Sensitive data
- e.firma (electronic signature)
- SAT or VUTCE passwords
- Bank accounts or cards
- Your RFC number on the form
Sensitive data includes, for example, data about health, ethnic origin, beliefs, political opinions or sexual orientation. If you share any of this data with us by mistake, we will not use it and will delete it from our records.
If you hire a service, we will later ask for the data and documents that operation requires: tax and billing data, your legal representative’s data and documents such as the commercial invoice, packing list, transport document, certificates or permits. Before asking for them, we will tell you which ones and why.
If you share data about other people with us, for example your supplier, share only what is needed and make sure you are allowed to do so. This website is intended for adults; we do not knowingly collect data from minors.
Source: LFPDPPP (DOF Mar. 20, 2025), arts. 2, sec. VI; 7; 8 and 15, sec. II.
How we use your data
They are the reason for your request. Without them we cannot assist you.
- Receive your request, assign it a reference number and confirm it by email.
- Contact you through the channel and at the time you chose, and follow up.
- Review your operation: understand what is happening, tell you the next step and whether we can help.
- Prepare quotes and, if you accept them, provide the foreign trade, logistics and customs services you hire, such as coordinating your customs clearance, transport or warehousing.
- Invoice, collect payment and manage the relationship with you if you are a client.
- Protect the form from automated submissions and detect duplicate requests.
- Comply with legal obligations and respond to requests from competent authorities.
To organize contact, the system assigns each request a priority level based on the stage and urgency you describe. A person on the team reviews every request: we do not make automated decisions about you.
They are not needed to assist you. If you decline, your request is not affected.
MexPyme updates
Send you information about our services and changes in foreign trade, only if you checked the optional box on the form.
How to decline: don’t check the box, or unsubscribe at any time at contacto@mexpyme.com.mx or by replying to any of those messages.
Advertising measurement
Know whether your visit or your request came from a Meta ad (Facebook or Instagram), to measure which ads work. The events do not include your name, email, phone, company, goods, country, value or the description of your case.
How to decline: block the pixel cookies (section 09), message us by WhatsApp or email instead of using the form, or ask us not to use your data for this. If you do not object, we understand that you accept; you can change your mind at any time.
If we wanted to use your data for something not covered in this notice, we would ask for your consent first.
Source: LFPDPPP (DOF Mar. 20, 2025), arts. 7; 11; 15, sec. III, and 26, sec. II.
Service providers that support us
To run the website and assist you, we rely on providers that process your data on behalf of MexPyme and only for the purposes of this notice. The law calls them personas encargadas (data processors); this is not a transfer.
You send your request
From a form on this website, such as the one at /diagnostico/.
MexPyme server
Validates the request, assigns it a reference number and stores it. It runs on Google Cloud.
Each provider receives only what it needs
Google Workspace
Spreadsheet and email
Stores the follow-up spreadsheet, which only the MexPyme team can access, and sends your confirmation email from contacto@mexpyme.com.mx.
Receives: Your complete request.
2chat
Team alert
Sends an alert to the MexPyme team’s WhatsApp group so they contact you on time.
Receives: The reference number, your name and company, your WhatsApp, the campaign you came from and a summary of the operation (for example, what is happening, goods, country, approximate value and how you prefer to be contacted). It does not receive your email or your comment.
Development and operation
Website and server
The provider that develops and maintains this website and its server, on behalf of MexPyme.
Receives: Technical access, only to maintain the system and fix issues.
If you choose WhatsApp to talk to us, the conversation is also governed by WhatsApp’s terms. Some providers may store data on servers outside Mexico; they always do so on behalf of MexPyme and with confidentiality and security obligations.
Source: LFPDPPP (DOF Mar. 20, 2025), arts. 2, secs. XII and XX, and 20.
When we share your data with third parties
We do not sell or rent your data. We only share it with third parties, without asking for further consent, in the cases permitted by law:
When required by law or by an authority. If a law or a treaty to which Mexico is a party requires it, or a competent authority requests it through a duly grounded and reasoned order.
When the service you request needs it. For example, to the licensed customs broker (agente aduanal) who handles the clearance of your goods, and to carriers, shipping lines, airlines, warehouses or insurers involved in your operation.
To defend a right. When necessary to establish, exercise or defend a right in judicial proceedings.
Whoever receives your data assumes the same obligations toward you as MexPyme. If we ever wanted to share it for something else, we would ask for your consent first.
Source: LFPDPPP (DOF Mar. 20, 2025), arts. 9, sec. VII; 35 and 36, secs. I, IV, V, VI and VII.
Your ARCO rights and how to exercise them
Access
Know what data of yours we hold and how we use it.
art. 22Rectification
Correct it if it is inaccurate, incomplete or out of date.
art. 23Cancellation
Ask us to remove it from our files and systems.
arts. 24 and 25Opposition
Ask us to stop using it when you have a legitimate reason.
art. 26
How to submit your request
Write to contacto@mexpyme.com.mx with the subject “Derechos ARCO” (ARCO rights). Your request must include:
- Your name and a way to reply to you, such as your email or postal address.
- A document proving your identity, for example a valid official ID. If someone requests it on your behalf, also the document proving their representation.
- Which right you want to exercise and over which data, clearly described. For access, simply asking is enough.
- If you request a rectification, what needs to be corrected and the document that supports it.
- Any information that helps us find the data, such as your request’s reference number.
Response times
- Up to 20 daysWe send you our response.
- 15 more daysIf it applies, we carry it out.
It is free. We could only charge you the cost of copies or shipping; if you give us an electronic means, we deliver your data at no cost. We reply through the same channel you used to write to us.
We may deny a request only in the cases set out in the law, for example if identity is not proven or if the data is not in our possession. If that happens, we will tell you why.
If you disagree with the response, or do not receive it on time, you may file a data protection request with the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Government) within 15 business days after the response. If we do not reply, you may file it as soon as the deadline for our reply expires.
Source: LFPDPPP (DOF Mar. 20, 2025), arts. 2, sec. VIII (business days); 21 to 34, and 40.
How to withdraw your consent
You may withdraw the consent you gave us at any time. Write to contacto@mexpyme.com.mx with the subject “Revocación de consentimiento” (withdrawal of consent) and the same information as in an ARCO request. We reply within the same deadlines.
Withdrawal is not retroactive. It also does not apply to the data we need to fulfill a legal obligation or a current contract with you; if that is the case, we will tell you which data and why.
Source: LFPDPPP (DOF Mar. 20, 2025), arts. 7, last paragraph, and 25.
How to limit the use or disclosure
Updates. Don’t check the box, or unsubscribe. We add you to our internal exclusion list so we don’t write to you again.
Channels. Tell us if you prefer not to be contacted by WhatsApp, phone or email.
Measurement. Block the pixel cookies or message us directly by WhatsApp or email.
Any other use. Ask at contacto@mexpyme.com.mx and we will reply within the deadlines in section 06.
Source: LFPDPPP (DOF Mar. 20, 2025), art. 15, sec. IV.
How long we keep your data
- 24months
Requests that don’t become a service
We keep them for up to 24 months from our last contact. After that, we delete them.
Clients
For as long as the relationship lasts and, afterward, for the periods required by tax, customs and commercial laws. Then the data is blocked and deleted.
Updates
Until you unsubscribe. After that, we only keep what is needed so we don’t write to you again.
If you request cancellation earlier, we block your data and then delete it, unless the law requires us to keep it for longer.
Source: LFPDPPP (DOF Mar. 20, 2025), arts. 2, sec. III; 10; 24 and 25.
How we protect your data
Limited access. Only the staff who need it to assist you.
Encrypted connection. The website and the form run over HTTPS.
Confidentiality. Anyone who processes your data keeps it confidential, even after their relationship with us ends.
We apply administrative, technical and physical measures against damage, loss, alteration, destruction or unauthorized use. If a breach occurred that significantly affected your financial or moral rights, we would notify you immediately so you can protect yourself.
Source: LFPDPPP (DOF Mar. 20, 2025), arts. 18, 19 and 20.
Changes to this notice
We may update this notice due to changes in the law, in our services or in the providers we use. Each version is published on this page with its number and date, and the form always shows the current version.
If a change adds purposes that require your consent, we will ask for it again, through the contact details you gave us, before using your data for them.
- v1
First version for the new website and the /diagnostico/ page. It replaces the privacy policy published in August 2025.
Source: LFPDPPP (DOF Mar. 20, 2025), arts. 11 and 15, sec. VI.