Privacy policy — how we handle personal data
Corp-Merch Mexico processes personal data to run branded merch programs: employee rosters, attendee lists, recipient addresses, per-employee sizing records. This page documents what we collect, why we collect it, how long we keep it, who we share it with, and how the data subject can exercise the rights granted by Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and the equivalent regulations in the markets where our buyers operate.
The principle behind the policy
Three principles govern how Corp-Merch Mexico handles personal data. The first is purpose limitation: we collect personal data only for the purpose of running the merch program the buyer has contracted us for. We do not sell, rent or share the data with third parties for marketing, advertising or analytics purposes. The second is data minimisation: we collect only the data we need to run the program, and we strip the data from our systems as soon as the program closes. The third is transparency: this page, the data-processing agreement we sign with each buyer, and the privacy notice we issue to each data subject together describe what we do with the data, in language that the data subject can read.
LFPDPPP grants data subjects four rights — Acceso, Rectificación, Cancelación and Oposición — collectively known as ARCO rights. The mechanics for exercising those rights are documented below.
What we collect and why
Employee rosters (onboarding programs)
Name, role, location, size, address and start date. Used to produce and deliver the welcome kit. Retained for 90 days post-employment unless the buyer requests long-term storage under a separate data-processing agreement.
Attendee lists (event programs)
Name, organisation, role, address and email where relevant. Used to produce and ship the event merch. Retained for 90 days post-event unless the buyer requests long-term storage under a separate agreement.
Recipient addresses (gift programs)
Name, role, organisation and shipping address. Used to deliver the gift. Retained for 90 days post-delivery unless the buyer requests long-term storage under a separate agreement.
Sizing records (uniform programs)
Per-employee size, height, weight and women's-cut flag. Used to produce the uniform. Retained for the life of the framework agreement; stripped at agreement close unless the buyer requests long-term storage.
Chapter 1 — Legal basis and the controller-processor relationship
Corp-Merch Mexico acts as the data processor; the buyer is the data controller. The legal basis for the processing is the data-processing agreement (DPA) signed between the buyer and Corp-Merch Mexico before the program starts. The DPA specifies the purpose, the categories of data, the recipients (Corp-Merch Mexico's decorators, freight carriers and customs brokers acting as sub-processors), the retention period, the security measures and the breach-notification obligation.
For US-domiciled buyers, the DPA also references the standard contractual clauses (SCCs) for the cross-border transfer of personal data from the EU to Mexico, where relevant. For EU-domiciled buyers operating in Mexico, the DPA references the GDPR adequacy decisions and the LFPDPPP-equivalent obligations.
Chapter 2 — Security measures
Personal data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access is restricted to the account team and the production lead assigned to the program, with role-based access controls and an audit trail. The data is stored on Mexican-located servers inside a certified data centre; cross-border transfers are governed by the SCCs referenced in the DPA. Physical access to the production facilities is restricted to authorised staff, with visitor logs and CCTV at the entrances.
Sub-processors — decorators, freight carriers, customs brokers — are required to sign back-to-back DPAs that mirror Corp-Merch Mexico's obligations. The list of active sub-processors is available on request; material changes to the list are notified to the buyer inside 30 days.
Chapter 3 — Retention and deletion
Personal data is retained for 90 days after the program closes (defined as the post-event reconciliation memo for event programs, the last roster release for onboarding programs, or the final delivery manifest for gift programs). After 90 days, the data is deleted from production systems and the backup cycles complete within a further 30 days. The buyer receives a written confirmation of deletion on request.
For buyers who require long-term storage of personal data — typically for compliance or audit purposes — the DPA can be extended with a separate data-processing agreement that specifies the extended retention period, the access controls and the deletion trigger. The extended retention is priced separately.
Chapter 4 — ARCO rights and how to exercise them
LFPDPPP grants data subjects four rights. Acceso (access) — the right to know what personal data we hold and how we process it. Rectificación (rectification) — the right to correct inaccurate or incomplete data. Cancelación (cancellation) — the right to delete the data from our systems. Oposición (opposition) — the right to object to the processing for specific purposes.
To exercise any of these rights, write to [email protected] with the data subject's name, the program reference (if known) and the right being exercised. We acknowledge within 5 business days and respond within 20 business days as required by LFPDPPP. The response includes the data held, the rectification made, the deletion confirmation or the opposition acknowledgement, as applicable.
FAQ — privacy policy
How long do you keep personal data?
90 days after the program closes for standard programs. Long-term storage is available under a separate data-processing agreement.
Do you share personal data with third parties?
Only with sub-processors acting on our behalf to run the program — decorators, freight carriers, customs brokers. Each sub-processor signs a back-to-back DPA mirroring our obligations.
How do I exercise my ARCO rights?
Write to [email protected]. We acknowledge within 5 business days and respond within 20 business days as required by LFPDPPP.
Where is the data stored?
On Mexican-located servers inside a certified data centre. Cross-border transfers are governed by the SCCs referenced in the DPA.
How do you handle a data breach?
The breach is reported to the buyer inside 24 hours of detection. We cooperate with the buyer's incident-response process and provide the forensic detail required by LFPDPPP and the equivalent regulations in the buyer's home market.
Corp-Merch Mexico is an independent production house for branded merchandise and corporate gifts. This privacy policy describes how we handle personal data in the course of running merch programs. It is not legal advice; data subjects and buyers with specific questions should consult their own counsel. The current version of the privacy notice is filed with the Secretaría de Economía and is available on request.
Contact the privacy officer
Send us the inquiry — a DPA request, an ARCO rights request, a sub-processor list request or a general privacy question — and we will reply inside five business days.