Privacy Notice
This document is the privacy notice of Corp-Merch.MX prepared in accordance with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulation and the Privacy Notice Guidelines published by the Mexican Ministry of Economy. It applies to the personal data we collect from website visitors, corporate clients, suppliers, candidates and any person who interacts with us. We wrote it in clear language so that you understand what data we ask for, what we use it for, with whom we share it and how you can exercise your ARCO rights.
Who is the controller
The data controller is Corp-Merch México, S.A.P.I. de C.V. (hereinafter Corp-Merch.MX), with a conventional address for purposes of this notice at Av. Insurgentes Sur 1234, Colonia del Valle, Alcaldía Benito Juárez, C.P. 03100, Mexico City, Mexico. Our privacy contact email is [email protected] and our phone is +52 55 1234 5678 from Monday to Friday, 9:00 to 18:00 Mexico City time.
Corp-Merch.MX is a Mexican company constituted under the laws of the United Mexican States, with RFC CME160101AAA, dedicated to the production, import and commercialization of corporate merch, uniforms and business gifts. This notice is published in compliance with article 17 of LFPDPPP and is binding on all areas of the organization that process personal data.
What personal data we collect
To fulfill the purposes described in this notice, we collect the following categories of personal data: identification data (full name, RFC, CURP where applicable, employee number, passport or consular ID when the subject is foreign), contact data (tax and commercial address, email, landline and mobile phone), billing data (tax status certificate, proof of address, card or bank account details for payments), employment data (position, area, cost center, tenure) and personalization data (garment size, preferred color, requested engraving, shipping address).
We do not collect sensitive personal data (racial origin, health, ideology, sexual life, etc.) through the website. If a process requires sensitive data processing, we will ask for express written consent in a separate document.
Primary and secondary purposes
Primary purposes (necessary for the legal relationship): product and service quotation, preparation of commercial proposals, execution of service or purchase contracts, invoicing and collection with CFDI 4.0 before SAT, delivery of merchandise at the indicated address, warranty and returns handling, compliance with tax and foreign trade obligations, retention of accounting and tax documentation for the applicable legal term.
Secondary purposes (not necessary for the legal relationship but which allow us to improve service): newsletter with news and case studies, invitation to webinars and sector events, satisfaction surveys, statistical analysis of website usage, commercial prospecting. If you do not want your data to be processed for secondary purposes, you may express so by sending a request to [email protected] with the text "I do not want secondary purposes".
Transfers and remissions
To fulfill the primary purposes, we share your data with the following categories of recipients: allied workshops that participate in production (embroidery, screen printing, laser engraving, sewing) with whom we sign a processing agreement; couriers and fleets for delivery (DHL, FedEx, Estafeta, Paquetexpress, Castores) with confidentiality clauses; technology providers that host our invoicing platform and email (with servers in Mexico and, in some cases, in the United States under standard contractual clauses); tax authorities when legally required (SAT); customs authorities when merchandise crosses the border (ANAM, SAT).
For the indicated transfers, we require your express consent. In all cases we require recipients to adopt the administrative, technical and physical security measures necessary to protect your data. We do not sell, rent or commercialize personal data with third parties.
ARCO rights and consent revocation
You have the right to know what personal data we have about you, what we use it for and the conditions of use we give it (Access). Likewise, it is your right to request the correction of your personal information if it is outdated, inaccurate or incomplete (Rectification). You can also request that we delete it from our records or databases when you consider that it is not being used in accordance with the principles, duties and obligations set out in the regulations (Cancellation). And you can oppose the use of your personal data for specific purposes (Opposition).
To exercise any of these rights, send a request to [email protected] containing: name of the subject, means to receive a response, clear and precise description of the right to exercise, and a copy of valid official identification. We will respond to your request within no more than twenty business days from receipt, and if applicable, it will become effective within the following fifteen business days. The response is sent to the email you indicate.
Security measures and retention periods
We adopt administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorized use. Technical measures include TLS encryption for transmissions, role-based access control to databases, segregation of duties, and encrypted backups. Administrative measures include confidentiality agreements signed by all employees, annual training in data protection and periodic internal audits.
Personal data is retained for the time necessary to fulfill the purposes that motivated its processing and, subsequently, for the time required by applicable legal provisions — typically five years for accounting documentation and ten for tax documentation. Once the deadlines are met, the data is deleted from active databases and, subsequently, from backups.
Cookies and similar technologies
Our website uses first-party and third-party cookies for analytical purposes and to improve the browsing experience. First-party cookies allow us to remember your language and currency preferences. Third-party cookies (Google Analytics with anonymized IP) let us measure traffic and understand which pages are most useful. You can disable cookies from your browser settings; however, some site functionality may be affected.
We do not use cookies for behavioral advertising personalization or to build browsing profiles for commercial purposes.
Modifications to the Privacy Notice
We reserve the right to modify this Privacy Notice to reflect legal, operational or business changes. Any substantial modification will be notified with at least fifteen calendar days in advance through publication on the website www.corp-merch.mx and, when the change affects primary purposes or transfers, by email to the contact we have on file. The current version of this notice includes the last update date at the bottom.
Last update: September 29, 2026.
Questions about this Privacy Notice?
If you have questions about the processing of your personal data, about exercising ARCO rights or about the transfers we carry out, share your case and the privacy team responds in less than five business days. For formal matters, you can also contact the National Institute for Transparency, Access to Information and Personal Data Protection (INAI).
This Privacy Notice is published in compliance with LFPDPPP and its regulations. The information described here is declarative and does not constitute a contract. Corp-Merch.MX reserves the right to modify it in accordance with the law. Regulatory references are current at the time of the last update; we recommend confirming with your legal area.