Mercarte Studio Legal

Privacy notice

Last updated: October 30, 2026

This notice explains what personal data we collect when you write to us through the contact form on mercartestudio.com, what we use it for and how you can exercise your rights. It is issued under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette on March 20, 2025. This is a translation for convenience; the Spanish version prevails.

1. Who is responsible for your data

Mercarte Studio is the data controller.

Address: Coyoacán, Ciudad de México, México.
Contact email for anything related to your data: mercartestudio@proton.me.

2. What data we collect

Only what you type into the contact form:

• Name.
• Email address.
• The type of project you are interested in.
• The message you send us.

We do not ask for sensitive personal data (for example, about your health, ethnic origin, religious, philosophical or moral beliefs, political opinions or sexual orientation) or financial or asset data (such as card or account numbers). Please do not include them in your message. Note that the message is translated and delivered automatically before we read it; if we find data of that kind, we delete it from our email.

To protect the form against automated spam, technical data from your connection is processed (such as your IP address and browser signals). We do not use it to identify you and we do not store it with your message.

3. What we use your data for

We use your data only for these purposes, which are necessary to handle your request:

• Reading and answering your message.
• Preparing, where applicable, a proposal or quote for the project you describe.
• Following up on any professional relationship that results from your request.

To read your message in Spanish, we translate it automatically and also keep the original.

We do not use your data for secondary purposes such as advertising, newsletters or marketing. If we ever wanted to, we would first ask for your express consent.

4. Who we share your data with

We do not transfer your personal data to third parties, except when a competent authority requires it under the law.

To run the site we rely on providers that, for the services we hire them for, process data on our behalf and under our instructions (processors). Sharing data with them for that purpose is a disclosure to a processor, not a transfer:

• Cloudflare, Inc.: site hosting, spam protection, automatic translation of the message and delivery of the email we receive.
• Proton AG: the mailbox where we receive and answer your message.

These providers may process information on servers located outside Mexico. A processor being in another country does not turn the disclosure into a transfer.

Spam check (Turnstile). When you accept this notice in the form, Turnstile is activated: Cloudflare’s service that checks you’re not a bot. To provide that service Cloudflare acts as our processor; in addition, under its own terms, it may use some technical browser signals as a controller to improve its bot detection. That processing is governed by the Turnstile privacy notice.

5. How long we keep your data

We keep messages and contact details from the form for up to 12 months from our last contact, whether or not a project goes ahead. When that period ends, we delete them from our mailbox, our sent mail and any copies.

If a contract results from your request, contractual and tax records are kept for the periods required by applicable law, blocked for any other use, and then deleted.

6. Your ARCO rights

You have the right to access your data, rectify it if it is inaccurate or incomplete, cancel it and object to its processing.

To do so, write to mercartestudio@proton.me including:

• Your name and a way for us to reply.
• A document proving your identity. If a representative acts for you, also their ID and the document proving the representation.
• The right you want to exercise and, except for an access request, a description of the data it concerns.
• For a rectification, the changes to be made and, where applicable, supporting documents.
• Any other detail that helps us locate your data.

We will reply within 20 business days of receiving your request. If it is granted, we will carry it out within 15 business days of our reply. For access requests, we will send your data by email as an electronic document or file. There is no charge.

Withdrawing consent or limiting use. You can do this at any time through the same channel and with the same requirements, and we will reply within the same periods. Please note that if you withdraw your consent, we will no longer be able to handle or follow up on your request; withdrawal does not affect anything done before.

If you believe your right to personal data protection has been violated, you may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno, the competent authority.

7. Cookies and similar technologies

This site does not use advertising or tracking cookies. It only stores your language preference (Spanish or English) in your browser. We may measure visits in aggregate with Cloudflare Web Analytics, which uses no cookies and does not identify people.

8. Changes to this notice

Any change to this privacy notice will be published on this page, mercartestudio.com/privacy-notice, with its update date. If something important changes, such as the purposes or the processors, we will also tell you by email when we have an ongoing relationship with you.

If we wanted to use your data for a new purpose that requires your consent, we will ask for it first: publishing the change or notifying you does not replace that consent.