Privacy Policy

This comprehensive privacy notice is issued in compliance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (the "Law"), its regulations and other applicable provisions. It explains who processes your data, which data, for what purposes, with whom it is shared and how you can exercise your rights. The Spanish version (Aviso de privacidad) is the original; this English version is a faithful translation provided for convenience.

1. Identity and address of the data controller

Dos Palomitas is a brand of Abdul Hamid Achik Lopez, an individual (persona física) carrying out business activity in Mexico, with an address in Guadalajara, Jalisco, Mexico (hereinafter "Dos Palomitas", "we", "us").

2. Two different roles: controller and processor

Dos Palomitas takes part in the processing of personal data in two ways:

1. As controller, when you write to us through the contact form or by email, or when you browse our website (dospalomitas.com). This notice applies directly to that data.
2. As processor, when a client company hires us to send WhatsApp satisfaction surveys to its own customers. In that case, the client company is the controller of its customers' data, and Dos Palomitas processes it only on its behalf and following its instructions, in order to operate the service. If you received a survey, the company that sent it has its own privacy notice; you can still exercise your rights directly with us (sections 8 and 9) and we will handle your request or forward it to that company.

3. Personal data we collect

3.1. Website visitors and people who contact us

• Name, company, email address and phone number (optional) that you type in the contact form.
• The content of the message you send us.
• Minimal technical data generated by the server when you visit the site, such as IP address and browser, used for security and operation.

3.2. Survey recipients (data processed as a processor)

On behalf of client companies we process:

• Name and mobile phone number of the buying company's contact.
• Data about the purchase that triggered the survey, for example the division, brand, branch, product family, customer type and the transaction amount.
• Record of consent to receive WhatsApp messages and record of opt-outs.
• Survey answers: three ratings from 1 to 10, a free-text comment and, where applicable, the name of the staff member the customer chooses to recognize.
• Message metadata generated by Meta's WhatsApp Business Platform, such as message identifiers, delivery and read status, and date and time.

3.3. Sensitive data

We do not request sensitive personal data. Please do not include it in the contact form or in survey comments.

4. Purposes of processing

4.1. Primary purposes (necessary)

• Answer your information or demo requests and follow up on the conversation you started.
• Operate the WhatsApp survey service contracted by the client company: determine eligibility, send the survey, the reminder and the thank-you message, and record the answers.
• Record and honor opt-outs and contact frequency limits, so we do not message people who do not want it.
• Produce the results, follow-up cases and reports that the client company reviews in its dashboard.
• Maintain security, prevent fraud and abuse, and comply with legal, tax and contractual obligations.

4.2. Secondary purposes (not necessary)

• Send you communications about product news or blog content, only if you ask for them or accept them.
• Produce internal, anonymous statistics about the use of the website and the service.

If you do not want your data to be processed for secondary purposes, write to privacidad@dospalomitas.com. Your refusal does not affect the handling of your request or the service.

5. Consent and opt-in for WhatsApp messages

WhatsApp messages are only sent to people who gave the client company their consent to receive them. Dos Palomitas does not send advertising over WhatsApp. Survey messages always include a simple way to opt out (see section 9).

6. Transfers and disclosures of data

We do not sell personal data. To operate the service we use providers that process data on our behalf (processors). We list them for transparency; under the Law, these disclosures do not require your consent.

Some of these providers are outside Mexico, so your data may be processed in other countries. We require our providers to apply security measures consistent with this notice.

Beyond this, we will only share data with authorities when a law or ruling requires it, and with the client company that contracted the service, which is the controller of its customers' data.

7. Retention

• Contact form messages: up to 24 months after the last communication, unless it becomes a business relationship.
• Survey service data: for the duration of the contract with the client company and, afterwards, for the time it instructs or the law requires. When the contract ends, data is deleted or returned.
• Opt-out record: we keep the minimum number needed to avoid contacting again anyone who opted out.
• Tax and contractual data: the periods set by tax and commercial laws.

8. Data subject (ARCO) rights and other rights

You have the right to access your personal data and know how we process it, to rectify it if it is inaccurate or incomplete, to cancel it when you believe it is not needed for the stated purposes, and to object to its processing for specific purposes (ARCO rights). You may also limit its use or disclosure and request portability where applicable.

How to exercise them. Send an email to privacidad@dospalomitas.com or write to us through the contact form, stating that it is a data subject rights request, including:

1. Your full name and a way to reply to you.
2. If you received a survey, the mobile number it was sent to.
3. A clear description of the right you want to exercise and the data it refers to.
4. A document that proves your identity (simple copy of an official ID) or, if applicable, that of your legal representative.

We will reply within a maximum of 20 business days from receipt of your complete request, and we will carry it out within the following 15 business days if it is appropriate. These periods may be extended once for an equal period when there is justified cause, and we will notify you. Exercising your rights is free of charge, except for shipping or reproduction costs where applicable.

If your request concerns data we process as a processor, we may forward it to the responsible company and we will let you know.

To specifically request deletion of your data, see the Data Deletion page.

9. Withdrawing consent and opting out of surveys

You may withdraw your consent to the processing of your data at any time, without retroactive effects, by writing to privacidad@dospalomitas.com.

To stop receiving WhatsApp surveys:

• tap the "No recibir encuestas" ("Do not receive surveys") button shown in the message, or
• reply BAJA in the conversation.

We will register your opt-out immediately and you will not receive further surveys from that service.

10. Cookies and similar technologies

The site only uses essential storage to work (for example, remembering your light or dark theme preference in your browser). We measure visits and performance with Vercel Web Analytics and Speed Insights, which do not use cookies and do not identify you individually. We do not use advertising or third-party tracking cookies.

11. Security measures

We apply reasonable administrative, technical and physical measures to protect your data against damage, loss, alteration, destruction or unauthorized access, including encrypted connections (HTTPS), access controls and verification of the signatures of messages we receive from the WhatsApp platform. If a breach occurs that significantly affects your rights, we will notify you as required by the Law.

12. Changes to this notice

We may update this notice because of legal, operational or provider changes. We will publish the current version on this page with its last-updated date; if the change is substantial, we will let you know by a reasonable means.

13. Authority

If you believe your right to personal data protection has been violated, you may go to the competent authority for the protection of personal data held by private parties in Mexico (currently, the Secretaría Anticorrupción y Buen Gobierno).

14. Contact

For any question about this notice write to privacidad@dospalomitas.com.