Privacy Notice
This English version is provided for convenience only. In the event of any discrepancy, the Spanish version shall prevail.
Faz Palau, S.C. (“FPA” or the “Firm”) provides this Comprehensive Privacy Notice (this “Notice”) in compliance with Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on March 20, 2025 (the “Data Protection Law”), its Regulations to the extent they do not conflict with it, and other applicable provisions. Its purpose is to let you know what personal data we process, why we process it, with whom we may share it and how you can exercise the rights the law grants you.
A. Identity and address of the data controller
FPA is a Mexican professional partnership (sociedad civil) that provides legal advisory and defense services, with its office at Avenida Misión de Loreto No. 3050, Interior N2 02, Zona Urbana Río, 22010 Tijuana, Baja California, Mexico. FPA is the controller of the personal data you provide to us or that we obtain in connection with our services.
For any matter related to the processing of your personal data, and to receive and handle requests to exercise your rights, FPA has appointed its Personal Data Department, headed by César Gustavo Faz Palau, who can be reached at info@fazpalau.com, by phone at +52 (664) 866 6226 or at the address above.
We process your personal data in accordance with the principles of lawfulness, purpose limitation, fairness, consent, data quality, proportionality, transparency and accountability set out in the Data Protection Law, and subject to the security and confidentiality duties it imposes. In addition, given the nature of our services, the information our clients entrust to us is protected by attorney professional secrecy.
B. Who this Notice applies to
This Notice applies to the personal data of the following data subjects:
- FPA clients, as well as their legal representatives, attorneys-in-fact, partners, shareholders, employees and contact persons.
- Prospective clients who request a consultation, quote or service proposal.
- Users of the fazpalau.com website and anyone who contacts the Firm by email, phone, WhatsApp or social media.
- Third parties whose data we receive in connection with the matters we handle, such as opposing parties, our clients’ suppliers and customers, customs brokers, witnesses, experts and the authorities involved.
- Attendees of seminars, training sessions, conferences and other events organized by or featuring the Firm.
C. Personal data we process
To fulfill the purposes described in this Notice, FPA may process the following categories of personal data, depending on your relationship with the Firm:
- Identification data, such as name, signature, nationality, date of birth, CURP (Mexican population registry code), official ID and documents evidencing legal representation or authority to act.
- Contact data, such as address, email and landline, mobile or WhatsApp numbers.
- Employment data, such as the company you work for, job title, department and work address.
- Tax data, such as RFC (Mexican taxpayer ID), tax regime, tax address, tax status certificate (constancia de situación fiscal) and the information required to issue electronic invoices (CFDI).
- Financial or asset data, such as bank details for payments or refunds, fee payment history and the financial, accounting, tax or foreign trade information contained in the documents of your matter (contracts, financial statements, customs entries or pedimentos, tax assessments, among others).
- Matter-related data, meaning the information and documents needed for the advice or defense entrusted to us, such as administrative and court files, minutes, rulings, correspondence and factual background.
- Browsing data, collected when you visit the website as described in Section F of this Notice.
Financial or asset data needed to provide the services you hire are processed on the basis of your legal relationship with FPA. Where such processing does not arise from that relationship and no other legal exception applies, FPA will obtain your express consent.
Sensitive personal data
As a general rule, FPA does not request sensitive personal data. However, certain matters (for example, labor audits, litigation or proceedings involving health information, union membership, religious beliefs or ethnic origin) may require us to know data of this kind. In such cases we will inform you that the data are sensitive and will obtain your express written consent, by handwritten signature, electronic signature or any other authentication mechanism, unless one of the exceptions provided in the Data Protection Law applies.
Please do not include sensitive personal data in the website contact form or in your first messages to the Firm. If your matter involves such data, we will request them through an appropriate channel once the professional relationship has been formalized.
Third-party personal data
When you provide us with personal data of third parties (employees, partners, opposing parties, suppliers or anyone else related to your matter), you represent that you obtained them lawfully and are authorized to share them with FPA for the handling of your matter. The Firm will process such data only for that purpose and in accordance with this Notice.
Personal data of minors and legally incapacitated persons
FPA does not provide services directed at minors. If a matter requires processing personal data of minors or legally incapacitated persons, we will do so only with the consent of the person exercising parental authority, guardianship or legal representation, which must be evidenced with the appropriate documents under applicable civil law.
D. Purposes of processing
Primary purposes
Your personal data will be processed for the following purposes, which are necessary for the relationship you have or intend to have with FPA:
- Responding to your request for a consultation, quote or information, whether submitted through the website, by email, by phone, by WhatsApp or through social media.
- Identifying you as a client or prospective client, running conflict-of-interest checks and, where applicable, formalizing the professional services agreement.
- Providing the services hired, including foreign trade, customs, tax and corporate advisory, audits and compliance programs, and defense in administrative proceedings and lawsuits.
- Representing or assisting you before administrative, tax, customs and judicial authorities, as well as before private parties.
- Opening, maintaining and managing the physical and electronic file for each matter.
- Communicating with you about your matters, including sending reports, status updates, notices and requests for information or documents.
- Issuing electronic invoices, collecting fees and expenses, and keeping the related accounting records.
- Complying with the Firm’s legal obligations, including tax obligations and, where applicable, client identification requirements under anti-money laundering rules.
- Responding to requests from competent authorities, and establishing, exercising or defending the rights of FPA or its clients.
- Maintaining information security and the proper operation of the website and the Firm’s communication channels.
Secondary purposes
In addition, unless you object, FPA may process your identification, contact and employment data for the following purposes, which are not necessary to provide the services but help us serve you better:
- Sending you newsletters, alerts and analyses on regulatory changes in foreign trade, customs, tax, corporate and other practice areas of the Firm.
- Inviting you to seminars, training sessions, conferences and other events organized by or featuring FPA.
- Informing you about Firm services that may be of interest to you.
- Conducting quality and satisfaction surveys about the services provided.
If you do not want your personal data processed for some or all of these secondary purposes, you may object at any time by emailing info@fazpalau.com with the subject line “Secondary purposes”, or when signing the consent form we provide when you hire our services. Your objection will not be grounds for denying you the services you request or hire from FPA.
E. Sharing with service providers and data transfers
Sharing with data processors
FPA may share your personal data with providers that process them on the Firm’s behalf and under its instructions, such as email and cloud storage services, website hosting, accounting and electronic invoicing services, and courier services. Some of these providers may be located outside Mexico. Under Mexican law this sharing is not a transfer and does not require your consent, and it takes place only with providers bound to keep the information confidential and apply security measures.
Transfers
To fulfill the primary purposes of this Notice, FPA may transfer your personal data, within or outside Mexico, to the following recipients:
- Administrative, tax, customs and judicial authorities, federal or local, before which your matter is processed or defended, or that require the data under the law.
- Correspondent attorneys, customs brokers, experts, translators, notaries public and commercial notaries (corredores públicos), in Mexico or abroad, whose involvement is necessary to handle your matter.
- Opposing parties and their representatives, to the extent necessary for the negotiation, proceeding or lawsuit concerned.
These transfers do not require your consent because they fall under the cases provided in Article 36 of the Data Protection Law, as they are required by law, necessary under an agreement entered into in your interest, needed to establish, exercise or defend a right in judicial or administrative proceedings, or necessary to maintain or perform the legal relationship between you and FPA. In each case, the Firm will inform the recipient of this Notice and of the purposes to which you agreed.
FPA does not sell, rent or share your personal data with third parties for commercial or advertising purposes, and does not carry out transfers that require your consent. Should it need to do so in the future, we will inform you through an update to this Notice and obtain your consent beforehand.
F. Cookies, tracking technologies and third-party sites
The fazpalau.com website uses technical cookies and similar technologies that are essential for it to work, such as those that remember your language selection. The site may also use audience measurement tools that automatically collect browsing data, such as IP address, browser and operating system, pages viewed, date and time of the visit and referring site. These data are used to run the site and to understand, on a statistical basis, how it is used.
You can disable or delete cookies in your browser settings, although disabling technical cookies may prevent some sections of the site from working.
The site contains links to third-party services such as WhatsApp, Facebook, Instagram, LinkedIn and Google Maps. When you use them, the processing of your data is governed by those third parties’ privacy notices and policies, over which FPA has no control.
G. Exercising your ARCO rights
You, directly or through your legal representative, have the right to access the personal data FPA holds about you and learn the conditions of its processing; to rectify them when they are inaccurate, incomplete or outdated; to cancel them when you consider they are not needed for any of the purposes of this Notice; and to object to their processing for a legitimate reason or for specific purposes (together, your “ARCO Rights”, after the Spanish acronym for access, rectification, cancellation and objection). FPA does not subject your personal data to automated processing that produces legal effects or significantly affects you without human involvement.
To exercise any of your ARCO Rights, submit a request to FPA’s Personal Data Department, either in writing at the Firm’s office or by email to info@fazpalau.com with the subject line “ARCO Rights”. Your request must include the following:
- Your name and an address, email or other means to send you the response.
- Documents evidencing your identity or, where applicable, the identity and authority of your legal representative.
- A clear and precise description of the personal data in respect of which you wish to exercise a right, except for access requests.
- A description of the right you wish to exercise or what you are requesting from FPA.
- Any other information or document that helps locate the personal data.
For rectification requests, you must also state the changes requested and attach supporting documents.
If the information provided is insufficient or incorrect, or the necessary documents are not attached, FPA may ask you, within five business days after receiving your request, to clarify or complete it. You will have ten business days, counted from the day after you receive that notice, to respond; otherwise, the request will be deemed not filed.
FPA will notify you of its decision within twenty business days from receipt of your request and, if the request is granted, will give effect to it within fifteen business days after notifying you of the response. Both periods may be extended once, for an equal period, when justified by the circumstances. Personal data will be delivered in response to an access request only after your identity, or that of your representative, has been verified.
If you submit your request by email, FPA will respond through the same channel unless you expressly indicate otherwise. Information may be delivered as plain copies, as electronic documents in commonly used formats or by any other means that ensures the effective exercise of the right. Exercising your ARCO Rights is free of charge; you will only cover, where applicable, justified shipping costs or the cost of reproduction in copies or other formats. If you repeat your request within less than twelve months, costs may not exceed three UMAs (Unidad de Medida y Actualización, Mexico’s official reference unit for fees and fines).
Cancellation of your data will trigger a blocking period, after which the data will be deleted. FPA is not required to cancel your personal data in the cases provided in the Data Protection Law, including when the data must be kept to comply with legal obligations, are the subject of a pending administrative or judicial proceeding, or are needed to fulfill obligations arising from the legal relationship with you.
If you disagree with FPA’s response, or do not receive a response within the applicable period, you may file a rights protection request with the Ministry of Anticorruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), Mexico’s data protection authority, within fifteen business days after you are notified of the response or, if none is given, once the response period has expired.
H. Withdrawing consent
You may withdraw at any time the consent you have given for the processing of your personal data, without retroactive effect, in all cases where withdrawal does not prevent compliance with legal obligations or obligations arising from your legal relationship with FPA. Withdrawing consent for data essential to handle a matter may mean the Firm is unable to continue providing the service.
The procedure to withdraw consent is the same as the one described in Section G for ARCO Rights, using the subject line “Withdrawal of consent”.
I. Options to limit the use or disclosure of your data
In addition to the procedures described in Sections G and H, you may limit the use or disclosure of your personal data by asking to be added to FPA’s internal opt-out list for secondary purposes, by email to info@fazpalau.com. Once added, your data will not be used for the secondary purposes of this Notice. You may also register with the Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad) managed by Mexico’s Federal Consumer Protection Agency (PROFECO).
J. Security measures and data breaches
FPA maintains administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction or unauthorized use, access or processing, and requires everyone involved in any stage of processing to keep it confidential, even after their relationship with the Firm ends.
If a security breach significantly affects your property or moral rights, FPA will notify you immediately so you can take the necessary steps to protect your rights.
K. Data retention
FPA will keep your personal data for as long as needed to fulfill the purposes of this Notice and, thereafter, for the periods required by applicable tax, commercial and statute-of-limitations rules, or for as long as any proceeding related to your matter remains pending. Once those periods end, the data will be blocked and deleted.
L. Changes to this Privacy Notice
FPA may amend or update this Notice to reflect legal changes, authority guidance, new services or adjustments to its privacy practices. Changes will be posted on the fazpalau.com website, in the “Privacy notice” section, together with the date of the latest update. When changes concern the purposes of processing or require new consent, FPA will also notify you at the email address you have established as your contact with the Firm.
M. Consent
By providing your personal data through the website, by email, by phone, by WhatsApp or by any other means, or by hiring FPA’s services, you acknowledge that this Notice was made available to you. Unless you object, you will be deemed to consent to the processing of your identification, contact, employment and browsing data in accordance with this Notice. For financial or asset data and sensitive data whose processing does not fall under a legal exception, FPA will obtain your express consent (in writing, in the case of sensitive data), ordinarily through the professional services agreement or the corresponding consent form.