Frequently asked questions

Compliance — what regulations we cover and how we prove it

LFPDPPP, INAI, PROFECO, NOM-050, REACH, RoHS, ISO 9001, ISO 14001. What sits on the file we hand over with every order, from Polanco to the Bajio.

Compliance is not a folder, it is a living file

In Mexico, regulatory compliance for corporate merch sits at the intersection of at least four fronts: personal data protection (LFPDPPP and its latest reform), labeling and consumer protection (PROFECO and NOM-050-SCFI-2004), workplace health and safety (STPS), and international regulation when the piece crosses the border or gets assembled in a northern IMMEX maquiladora. A supplier that ships polos without more is leaving its client exposed.

At Corp-Merch Mexico we structure compliance as a per-order file, not as a verbal promise. Every order carries the LFPDPPP-format privacy notice with the controller and the third parties involved (transfers to courier, to printer, eventually to a maquiladora in Tijuana or Ciudad Juarez), a no-conflict-of-interest letter signed by our legal representative, and the certifications that apply to the product. If your brand runs a compliance area that asks for documented evidence, we hand it over within 48 hours after order close, no extra charge.

On data protection we work aligned with INAI criteria. Files with final recipient data (shipping lists, personnel bases) are encrypted at rest and in transit, and get destroyed 90 calendar days after delivery, unless your legal area issues written instruction otherwise. That window is consistent with what LFPDPPP allows for contractual relationship purposes and leaves room for any PROFECO or Ministry of Economy review. If your brand runs a stricter internal policy, we adjust the timeline and sign it as an addendum to the master agreement.

For food-contact pieces —mugs, tumblers, containers, primary packaging— we require our suppliers to show NOM-251-SSA1-2009 compliance and, where applicable, NOM-050-SCFI-2004 on commercial labeling. If the piece ships abroad, we add REACH SVHC for the European Union and RoHS for electronic components like USB drives or power banks. The CE declaration is issued by our partner in Madrid when the client asks, without extending the Mexican lead time.

Environmentally, NOM-141-SEMARNAT-2003 on special-handling waste applies to the textile scrap and cardboard leaving our plant. We hold an agreement with an authorized final-disposal provider and hand over the waste manifest when the client asks for their GRI report or ISO 14001 environmental management system. If your brand reports to the Sustainability Accounting Standards Board (SASB) or is preparing an ESG report, we also add the carbon footprint per batch under the GHG Protocol Scope 3 category 1 (purchased goods).

One piece that comes up often in government tenders and large orders: LFPIORPI. When the order amount crosses the SAT threshold for vulnerable activities, we register the operation in the system and, if the CFDI 4.0 invoice carries the payment complement, we identify it there too. That stops your brand from being exposed when an upstream supplier missed its own filing. We hand over a copy of the filing when applicable and walk with you if the UIF asks for follow-up information.

For brands operating in the Bajio industrial corridor or in the northern maquiladora belt, we also prepare the proof-of-origin paperwork that some government programs and free trade agreements demand. The USMCA certificate of origin, the corresponding declarations for the Pacific Alliance, and the special regimes for IMMEX companies are part of the per-order file when applicable. We work with your trade compliance team to keep the paperwork consistent with what your customs broker files at the border, so no surprises surface during a SAT or customs audit.

For brands with operations in the Bajio industrial corridor or in the northern maquiladora belt, we also support the proof-of-origin documentation that some government programs and free trade agreements require. The USMCA certificate of origin, the corresponding declarations for the Pacific Alliance, and the special regimes for IMMEX companies are all part of the per-order file when applicable. We work with your trade compliance team to keep the documentation consistent with what your customs broker files at the border, so no surprises show up during a SAT or customs audit.

Frequently asked questions about compliance

What legal, compliance, and procurement teams most often ask before closing an order.

How do you handle recipient personal data?

Aligned with LFPDPPP and INAI criteria. Databases encrypted at rest and in transit, destroyed 90 calendar days after delivery unless told otherwise in writing. Privacy notice included with every commercial proposal.

Which certifications do you deliver with each order?

Depends on the product. OEKO-TEX Standard 100 on textile when applicable; RoHS and CE declaration on electronics; NOM-251-SSA1-2009 and NOM-050-SCFI-2004 on food contact. The certificate is attached to the delivery file.

Do you comply with REACH for shipments crossing into Europe?

Yes. We request the current-year REACH SVHC declaration from our ink and substrate suppliers. The declaration goes to the client alongside the CFDI 4.0 invoice when the final destination includes EU countries, the UK, or Switzerland.

How do you evidence waste handling and environmental compliance?

Agreement with an authorized provider under NOM-141-SEMARNAT-2003. We hand over the final-disposal manifest on request. Scope 3 footprint gets added when the client reports under GHG Protocol or SASB.

What happens with government orders or high amounts?

We comply with LFPIORPI when the amount crosses the SAT threshold for vulnerable activities. We register the operation, hand over a copy of the filing, and walk with the client if the UIF asks for additional information.

Do you hand over documentation for internal client audits?

Yes. Per-order file with privacy notices, certifications, manifests, no-conflict letters, and the CFDI 4.0 with Carta Porte 3.0 complement when the piece moves outside the metropolitan area. Delivered within 48 hours after close.

Do you have a certified quality management system?

We work under ISO 9001:2015 with third-party annual audit and per-plant certifications. If your supplier requires ISO 14001 or ISO 45001, we add them to the file at no extra cost when the plant already has them contracted.

Need the compliance file before signing?

Send us the brief, the destination market, and the regulatory frameworks your legal area demands. We send the file template and, if you want, schedule a call with our compliance lead to walk through your case.