LFPDPPP · LFT · Code of conduct · Traceability
The questions we hear from compliance teams, ESG committees, legal and internal audit when a corporate evaluates working with a Mexican merch workshop. We answer with the legal basis that applies, what we actually do, and where the limits of what we can attest are.
When we handle employee data from the customer — name, size, shipping address — we apply the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and the INAI guidelines. We ask you, as data controller, to provide the legal basis for sharing the data with us and, where applicable, the data subject's consent. We operate as data processor and sign the corresponding processing agreement before the first data exchange.
We retain personal data only for the duration of the order plus a retention period for post-order clarifications — typically six months — and we delete it from our systems at the end of that period unless the customer requests a different timeline. The data is stored on internal systems with profile-based access and two-factor authentication. We do not sell, share, or use the data for purposes other than fulfilling the order.
The in-house workshop operates with employees on payroll, statutory benefits, IMSS affiliation, profit-sharing where applicable and PTU in line with the LFT. With partner workshops — embroidery, sewing, specialised screen printing — we require a signed code of conduct from the workshop principal covering: active IMSS affiliation, compliance with the general minimum wage for the zone, no use of child labour per ILO Convention 138, no use of forced labour per ILO Convention 29, and willingness to receive audits without prior notice.
When a customer requires a social audit of their supplier — for example programmes that must comply with Sedex, amfori BSCI or an international brand code of conduct — we accompany the visit and facilitate access to the partner workshop. If a partner workshop does not meet the code's criteria, we find a replacement or reassign the run to a workshop that does. In cases of serious breach, we terminate the commercial relationship.
We work with certified textile lines. Ringspun cotton carries GOTS — Global Organic Textile Standard — certification when the customer requests it for their sustainability programme. Recycled polyester carries GRS — Global Recycled Standard — certification with traceability of the recycled content from the processing plant through to the yarn. Water-based screen printing inks meet OEKO-TEX Standard 100 and the brand's restricted substances list where applicable.
For workshops that produce abroad — for example sewing in Bangladesh or Vietnam when a customer requires production outside Mexico for scale reasons — we ask for current third-party audited certifications. We share the certifications with you when you need them for your sustainability or ESG reporting. Certifications are a floor, not a ceiling — they do not substitute for a social audit.
We sign non-disclosure agreements — NDAs — before any conversation that touches an unreleased product, a visual identity in development, customer code or launch strategy. The NDA can be one-way or mutual depending on what you prefer. When we work with the customer's marketing or communications team, the NDA is signed before the first call.
Samples and files are kept in an encrypted repository with profile-based access. Physical samples are held for the duration of the programme and destroyed — certified recycling or document destruction — at programme closure unless you request return or extended retention. For programmes involving pre-sale pieces or imminent launches, we operate a reinforced protocol with two named responsible persons per access.
We do not accept gifts, travel or hospitality that could compromise commercial objectivity. The policy applies to every member of the workshop and every partner workshop. When a supplier or customer offers hospitality that could compromise a commercial decision — event tickets, paid trips, gifts of value — we return it with a note explaining the policy. When the hospitality is minor and does not compromise the decision, it is recorded in a courtesies register and disclosed to the customer.
Any workshop employee who has a personal or family tie with a supplier or customer declares it at the start of the relationship and it is documented. Purchasing decisions that involve the tied employee with are made by someone else on the team. The policy also applies when the employee has a stake in a sector supplier.
Yes. We operate as data processor, sign the corresponding processing agreement, retain the data only for the duration of the order plus six months and delete it on closure. Access is profile-restricted.
No. The code of conduct prohibits child labour per ILO Convention 138. When a partner workshop breaches it, we terminate the relationship. When a customer requests it, we accompany social audits.
Yes, when the customer requests it, we purchase cotton with GOTS certification and recycled polyester with GRS certification. We share the supplier certificate for your ESG report. Certification does not replace social audit.
Yes. We sign one-way or mutual NDAs before the first conversation when the project involves unreleased product or visual identity in development.
If you are evaluating a workshop that meets your ethical, ESG and data protection criteria, let's talk. We deliver the signed code of conduct, current partner workshop certifications and the processing agreement in your format.
Compliance with LFPDPPP, LFT and environmental certifications must be verified against current regulation and standards at the time of each operation. Environmental certifications belong to the input suppliers and partner workshops, not to Corp-Merch.MX. Corp-Merch.MX is a Mexican workshop for corporate merch; we operate independently.