How to
How to handle data privacy in corporate merch programs
An operating guide for brand and procurement teams in Mexico City, Monterrey and Guadalajara who collect employee names, shipping addresses and tax IDs to dispatch kits without breaching Mexico's LFPDPPP, without exposing the company to fines, and without losing a vendor over non-compliance.
What personal data flows through a merch program
The most common mistake is treating a corporate kit as "purely logistics." It is not. From the moment you collect an employee's name to embroider a jacket or a customer's address to ship a year-end gift, you are processing personal data under the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). Embroidering a name means storage; shipping to a home means transfer; sharing the list with your vendor means a data-processing engagement. Every step touches the law.
A typical corporate merch program in Mexico touches at least three databases: the requesting client (legal name, tax ID, contact), the final recipient (name, address, sometimes size or preference), and the logistics operator handling the delivery. Each is a separate data controller under the law and each needs its own privacy notice. Sharing a single document across all three is the first mistake.
The good news: compliance does not require a large legal department. Three base documents (a notice for the client, a notice for the recipient, a data-processing agreement with each vendor) plus a treatment registry refreshed once a year will keep your merch program covered. What it does require is operational discipline: the name embroidered on a tee also lives in a database that you must protect.
If your brand ships kits to Europe as well as Mexico, the GDPR applies on top of the LFPDPPP, and California recipients add the CCPA/CPRA on top of that. The safest strategy is to operate under the strictest standard that touches your recipient base, not the other way around.
Operating plan in 7 steps
- Map the data you collect. Before any campaign, list recipient name, tax ID when applicable, shipping address, size, color preference, confirmation email. What you do not collect, you do not need to protect.
- Define the legal basis for each treatment. For employees of your own client, contractual consent is enough. For external recipients, you need express written consent under article 8 of the LFPDPPP.
- Issue a PRIVACY NOTICE for each data flow. One for the client, another for the final recipient, another for the logistics operator. Each notice must state which data are processed, the purpose, and where to go to exercise ARCO rights.
- Sign a data-processing agreement with every vendor. The kit maker, the embroiderer, the warehouse operator, and the carrier must each sign a contract binding them to your instructions, confidentiality, and incident notification.
- Limit access on a need-to-know basis. The embroiderer does not need the address; the carrier does not need the size. Hand each link only what it needs, encrypted whenever the data are sensitive.
- Set retention and deletion timelines. Define how long you keep the recipient list (12 months for campaigns is a fair rule; 5 years for accounting evidence is the legal floor). Once the clock runs out, delete for good.
- Document the ARCO channel and incident response. Assign a responsible person (can be external) to handle access, rectification, cancellation, and opposition requests within the 20 business days the law allows. Keep a log.
Common pitfalls that cost money
The first pitfall is confusing notice with consent. The privacy notice informs; consent is the data subject's signature accepting your use of their data. Without express consent for shipping the kit, the processing has no legal basis and the INAI can fine the company.
The second pitfall is sending the full list to a vendor. When you email "all names and addresses in one spreadsheet" to your manufacturer so they can manage the shipment, you are transferring data without control. The law allows transfer, but only with a signed data-processing agreement and under your instructions.
The third pitfall is forgetting to encrypt the recipient file. A spreadsheet with 500 names and addresses travelling by email is a leak waiting to happen. Use AES-256 encryption or at least a password-protected file sent through a separate channel.
The fourth pitfall is overlooking European recipients. If your client passes you data on employees in Berlin or Paris, the GDPR applies alongside the LFPDPPP, and you must demonstrate legal basis, a treatment record, and where monitoring is systematic, a DPO or equivalent.
The fifth pitfall is having no answer for an incident. When a database leaks, the first 72 hours are critical: notice to the INAI, notice to the data subjects, and in Europe, notice to the supervisory authority. Without a playbook ready, the response becomes chaotic and the fine is heavier.
Tools, templates, and references
Privacy notice template: written in plain language, with sections covering the controller, the data collected, primary and secondary purposes, transfers, means to limit use, and means to exercise ARCO rights. The INAI publishes a guide on its site.
Data-processing agreement clauses: minimum clauses include purpose, duration, nature of the processing, type of data, processor obligations, confidentiality, security measures, sub-processing, incident notification, and return or deletion at the end.
European supplier clauses: if you transfer data outside the EEA, attach the Standard Contractual Clauses (SCC) adopted by the European Commission in Decision 2021/914, plus an impact assessment where required.
Technical and legal references: LFPDPPP published in the DOF on 5 July 2010; the LFPDPPP Regulation; the Privacy Notice Guidelines issued by the INAI; GDPR (Regulation EU 2016/679); CCPA/CPRA for California; NOM-035 on labour equality and non-discrimination when the data include sensitive attributes.
Suggested timelines: issue the notice before any data collection; sign the data-processing agreement before the first shipment; refresh the notice annually; keep consent records for 5 years; rehearse the incident protocol every 6 months.
Team ownership: assign one accountable owner for privacy in the merch programme — usually the head of legal or compliance — and give them a quarterly slot on the procurement review. Privacy is not a one-time setup; it needs to travel with every new category of merch, every new destination country, and every new vendor added to the roster.