How to design the data strategy for a merch program without creating problems

When a merch program kicks off, the data question arrives late: we already shipped the thousand pieces, the business cards with QR are out, scans happened at the Centro Banamex trade show, and nobody defined what to do with the information. Corp-Merch.MX has seen enough programs where the data ended up in an unprotected Excel and where legal later asked for an explanation. This guide collects the process to design a data strategy that captures what is useful, complies with the LFPDPPP, and does not expose the company to fines or loss of trust.

Design my strategy

Why the data strategy is defined at the end and not at the start

The data strategy for a merch program is defined at the end because merch is perceived as "a physical object", not "a data channel". The mistake is common: the t-shirt, the backpack, the thermos, the notebook are tangible things, they do not look like a system that captures information. But the moment the merch carries a QR, a personalized URL, a registration form, a redeemable coupon, or a referral code, it stops being only merch and becomes a personal data capture point.

Corp-Merch.MX requires defining the data strategy before locking the product artwork. When a client asks for a QR on a t-shirt without having defined what sits behind the QR, the most likely outcome is that the QR will point to a generic landing page that captures nothing, or that captures without complying with the privacy notice under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). Both options are wasted opportunity or legal risk.

The second problem is capturing data that will never be used. Many merch programs ask for full name, RFC, address, personal email, phone, date of birth, and consumption preferences in a single form when scanning the QR. Half of those fields never get analyzed, and the more sensitive the field, the higher the compliance cost. Corp-Merch.MX recommends defining first which decision they will take with each data point, before deciding what to capture.

The third problem is not aligning the privacy notice with the merch flow. The LFPDPPP requires the privacy notice to be available before capture, to identify the controller, the purposes, the transfers, the means to exercise ARCO rights, and the opt-out option for secondary purposes. Corp-Merch.MX works with a modular privacy notice format per program: the client chooses the primary purposes (merch delivery, delivery follow-up, operational contact) and the secondary ones (marketing, profiling, third parties), and the notice is built accordingly.

Steps to build the data strategy

  1. Define the decisions the merch will enable. Before deciding what to capture, know for what. Corp-Merch.MX uses the three-decision form: 1) what operational decision will we take with the capture, 2) what marketing decision will we take, 3) what business decision will we take (cross-sell, retention, repurchase). Each decision translates into a data point, not the other way around.
  2. Map the capture points along the journey. The user journey in a typical merch program has four points: 1) registration upon receiving the merch (web form, app, WhatsApp), 2) activation of the QR or coupon, 3) subsequent interaction (survey, second purchase, referral), 4) unsubscribe or revocation. Corp-Merch.MX works with a journey map with capture points marked and explicit consent at each point.
  3. Reduce fields to the useful minimum. Every extra field is friction and cost. Corp-Merch.MX recommends between 3 and 7 fields per capture point. For delivery: name, contact, delivery address, schedule. For activation: single scan plus opt-in to the privacy notice. For interaction: NPS, preference, referral. For unsubscribe: a single click.
  4. Publish the modular privacy notice before launch. Corp-Merch.MX delivers a standard format that adapts per program with controller, collected personal data, primary and secondary purposes, transfers, means to exercise ARCO rights, and opt-out option for secondary purposes. The notice is published at each capture point before launch and the signed version is archived as evidence before the INAI.
  5. Set up the ARCO process with a 20-business-day window. Corp-Merch.MX recommends standing up a dedicated email [email protected] and a documented process to respond to access, rectification, cancellation, and opposition requests within the legal 20-business-day window. The logbook with request date, right type, response sent, and response date is kept as auditable evidence for the INAI in any review.
  6. Define the retention period per data category. Before capture, Corp-Merch.MX recommends defining 6 months for operational data, 12 months for marketing data, and 24 months for profiling data, with automatic deletion at the end of the period. Without this definition, data stays in the system and legal and operational risk grows over time.
  7. Operate the deletion and ARCO rights logbook. Corp-Merch.MX delivers a table with request date, right type exercised, response sent to the data subject, response date, and documentary evidence. The logbook is updated monthly and filed as part of the program record, being the best defense against a data subject complaint or INAI review.

Pitfalls that cost real money

The first pitfall is capturing without a visible privacy notice. The LFPDPPP requires the notice to be available before the first personal data point. Corp-Merch.MX rejects programs where the client wants to capture without a signed notice published at the same capture point. If the legal team has not signed the notice, the form does not go live.

The second pitfall is transferring data without third-party consent. The LFPDPPP requires express consent to transfer data to parties other than the controller. Corp-Merch.MX recommends that any transfer to a mailing provider, to an external CRM, or to a partner be covered with explicit opt-in in the privacy notice and with a visible checkbox on the form. Without this, the transfer is illegal and the fine can reach the equivalent of thousands of UMAs.

The third pitfall is not having a process for ARCO rights. The law requires responding to access, rectification, cancellation, and opposition requests within no more than 20 business days. Corp-Merch.MX recommends setting up a dedicated email ([email protected]) and a documented process before launching any program. When the request arrives and there is no process, the fine is certain.

The fourth pitfall is not defining the retention period. The LFPDPPP requires data to be kept only as long as necessary to fulfill the purpose. Corp-Merch.MX recommends defining, before capture, how long each category will be retained: 6 months for operational data, 12 months for marketing data, 24 months for profiling data, with automatic deletion at the end of the period. Without this definition, data stays forever and risk grows over time.

Tools Corp-Merch.MX uses for the data strategy

The first tool is the three-decision form. It is a one-page PDF that the client fills before quoting the merch and which decides what data to capture, what purposes to declare, and what transfers are authorized. The form is filed as evidence of compliance before the INAI.

The second tool is the modular journey map. Corp-Merch.MX delivers a diagram with the four capture points and the associated data, with opt-in checkboxes and privacy notice text at each point. The diagram becomes the technical specification of the web form, the WhatsApp flow, or the app flow.

The third tool is the modular privacy notice. Corp-Merch.MX has a standard format that adapts per program. The notice includes controller, personal data collected, primary and secondary purposes, transfers, means to exercise ARCO rights, opt-out option for secondary purposes, and date of last update. The notice is published before launch and the signed version is archived.

The fourth tool is the deletion logbook. Corp-Merch.MX delivers a table with request date, type of right (access, rectification, cancellation, opposition), response sent, response date, and evidence. This logbook is auditable by the INAI in any review and is the best defense against a complaint from a data subject.

Let us design your data strategy

If your merch program will capture data, the strategy must be ready before the first QR. Send us the program brief and we will build the journey, the privacy notice, and the compliance logbook together so the launch goes out without risk.



Corp-Merch.MX is a corporate merch and business gifting production workshop that operates independently. We are not a partner or official supplier of any brand mentioned on this page. Las marcas, denominaciones y nombres comerciales pertenecen a sus respectivos titulares. Mentions are made exclusively for descriptive purposes to identify the operational context of the Mexican merch market.