MX | US

Privacy notice

Pursuant to the LFPDPPP (DOF March 20, 2025, amendment DOF November 14, 2025)

Last updated

May 18th, 2026

1. Identity and Contact Information of the Data Controller

In compliance with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP, DOF March 20, 2025, last amendment DOF November 14, 2025), this Privacy Notice is made available.

Data Controller

Amaury Terrazas Ferrer under the commercial brand Konsulitika

Tax Regime

RESICO (Simplified Trust Regime)

Commercial Brand

Konsulitika

Address

Polanco V Section, Mexico City, Mexico

Privacy Email

[email protected]

Website

www.konsulitika.com

2. Personal Data Collected

The following categories of personal data are collected and processed in accordance with Article 15, Section II of the LFPDPPP:

2.1 Identification and Contact Data

• Full name

• Email address

• Mobile phone number / WhatsApp

• Username on messaging platforms (if applicable)

• Country of residence

• Company, title, or position (if applicable)

• RFC, business name, tax regime, and tax address (exclusively for clients who contract services and require invoicing)

• Tax Identification Certificate (if applicable, for invoicing purposes)

• Information derived from interactions conducted through our artificial intelligence agents

2.2 Digital Interaction Data

• IP address and approximate geolocation

• Browsing and behavior data on the website (pages visited, session duration, traffic source)

• Interactions with social media posts and advertisements

• Content of conversations initiated by the data subject via digital messaging

• Data generated by tracking technologies (cookies and advertising pixels)

2.3 Commercial Data

• Declared interests in Konsulitika products or services

• Stage in the commercial process (prospect, qualified lead, client)

• History of interactions and communications

2.4 Transaction Data (Clients with Purchases)

Konsulitika does not directly store card or payment instrument data. Payment processing is delegated to certified processors. The following transaction data is retained:

• Amount, date, and product or service purchased

• Email address used in the purchase

• Transaction identifier provided by the payment processor

2.5 Data Collected During the Contracting and Service Delivery Process

Prior to the provision of its services, Konsulitika may collect information from the prospect or client at two distinct stages of the process, each governed by a different legal basis and legal instrument. The processing of this data is subject to the following two subcategories:

2.5.1 Data Collected Through Initial Evaluation Questionnaires

This information is collected through digital forms with the purpose of initially evaluating the prospect, identifying the most suitable service for their situation, and scheduling an initial consultation. The legal basis for processing is the express consent granted by the data subject at the time of completing the questionnaire. No documents, files, exact figures, or detailed financial or tax information are requested at this stage. This subcategory includes, without limitation, the following types of information:

Business characterization data: industry or sector, number of employees, and the data subject's role within the organization.
Annual revenue range, expressed in aggregate intervals without disclosing exact figures.
Budget range, expressed in aggregate intervals without disclosing exact figures.
Data on perceived need and urgency: description of the primary operational, financial, legal, or productivity pain point motivating the inquiry, as well as the timeframe within which the data subject requires a solution.
Data on tools and systems in use: management software, productivity tools, data platforms, and the team's level of technological adoption.
Data on operational structure and team capabilities: number of people involved in the processes of interest, profile of the team to be trained, digital skill levels, and existence of a technology or data department.
Data on processes and reporting frequency: areas of greatest time consumption, frequency of report generation, and existence of prior improvement attempts.
Data on availability of historical information: general indication of whether the organization has organized historical data, years of history available, and existence of prior projections or business plans, without any such documentation being requested or received at this stage.
Contextual data on legal disputes or litigation: general stage of the case, type of documentation broadly available, and prior experience with financial analysis in litigation, without any documents or confidential case information being received at this stage.
Technology licensing data: indication of whether the organization holds licenses for Microsoft 365, Copilot, or other platforms relevant to the provision of the service.

2.5.2 Data Received Under a Non-Disclosure Agreement (NDA)

The information described in this subcategory is not collected under this Privacy Notice or during the initial evaluation stage. Its processing is governed exclusively by the Non-Disclosure Agreement executed separately between Konsulitika and the client or prospect, whose legal basis is the performance of a contractual relationship and applicable legal obligations. It is mentioned in this Notice solely for transparency and informational purposes.

This subcategory includes, on an enunciative but not limiting basis:

Detailed financial and accounting information: financial statements, cash flow, cost structure, margins, customer portfolio, accounts payable and receivable, inventory levels, debt structure, and outstanding financing arrangements.
Tax and invoicing data: electronic tax receipts (CFDI), tax returns, accounting records, and supporting documentation for business transactions.
Actual working files of the team: templates, internal reports, and documented workflows.
Historical business data: sales series, demand, inventory, customer behavior, staff turnover, and operational variables relevant to artificial intelligence models or predictive analytics.
Strategic and confidential information: business plans, financial projections, corporate structure, shareholder and partner data, and information intended for presentation to investors or financial institutions.
Legal and financial documentation related to disputes: contracts, bank statements, correspondence with financial relevance, information on trusts, interest rates, amounts claimed, and periods in dispute.
Third-party information provided by the data subject: data on customers, suppliers, employees, or counterparties whose transfer to Konsulitika is necessary for the provision of the service. In such cases, the data subject declares having the necessary legal bases to share such information.

2.6 Meeting and Videoconference Records

When the data subject participates in virtual meetings with Konsulitika through videoconferencing platforms, and provided that recording is active and the data subject has been informed thereof before the session begins, the following data may be collected:

• Audio and/or video recording of the meeting

• Automatic or manual transcription of the session content

• Username, image, and participation of the data subject in the meeting

• Date, duration, and thematic content of the session

The videoconferencing platforms used by Konsulitika (Teams, Zoom, or equivalent) may generate and store these records in their own systems, subject to their respective privacy policies. Konsulitika will use these records solely for the purposes stated in Section 3 of this Notice.

⚠️ Sensitive Data

Konsulitika does NOT collect sensitive personal data (health, biometrics, political ideology, religion, sexual orientation, ethnic origin, etc.) under ordinary circumstances. We ask that you do not send us data of this nature. Should you voluntarily provide such information and it is received or recorded in our systems, it will be used only to the extent necessary to address the request or service you have required.

3. Purposes of Processing

3.1 Necessary Purposes

• Responding to inquiries, information requests, and quotations

• Managing the commercial and contractual relationship with active clients

• Sending proposals, contracts, invoices, and communications related to contracted services

• Processing payments for courses, programs, and consulting services

• Complying with tax, accounting, and legal obligations in Mexico

• Administering the contact database in Konsulitika's CRM

• Ensuring information security and preventing fraud

• Applying business diagnostic questionnaires to assess the feasibility and scope of services to be provided

• Recording and transcribing virtual meetings with the data subject to document agreements, requirements, and project follow-up

3.2 Optional Purposes

• Sending marketing communications, newsletters, and value-added content via email, WhatsApp, or other channels

• Conducting retargeting advertising campaigns on social networks and digital platforms

• Segmenting and qualifying prospects automatically using artificial intelligence tools

• Conducting statistical and behavioral analyses to improve the service offering

• Initiating and managing automated lead-generation conversations on social networks

ℹ️ Consent

By completing the contact form on the website or by interacting with Konsulitika's digital channels and accepting this Notice, the Data Subject grants consent for the optional purposes. This consent may be revoked at any time by emailing [email protected].

4. Data Collection Channels

Personal data may be collected through the following channels:

Website contact form

Name, email, phone, country of residence, interests

Inbound — data subject initiates contact

WhatsApp Business

Phone number, messages, conversation history

Inbound or automated

Instagram Direct Message (DM)

Username, messages, data provided in conversation

Inbound or automated

Name, title, company, direct messages

Inbound

Email address, name, message content

Inbound

Native lead-gen ads (Meta / LinkedIn)

Name, email, phone

Outbound — data subject responds to ad

Website (cookies and tracking technologies)

IP, browsing, behavior, traffic source

Automatic

Purchase and payment process

Email, amount, product, transaction identifier

Transactional

The technological tools used internally to store, process, and automate the handling of this data (CRM, automation platforms, server infrastructure) are selected based on security and confidentiality criteria. Any change in such tools does not affect the data subject's rights or the purposes stated in this Notice.

5. Data Transfers and Payment Processing

5.1 Data Transfers to Technology Service Providers

We may transfer your personal data to technology service providers used for business operations, such as CRM tools and customer management automation platforms (for example, Relief Academy (as reseller of the Go High Level platform), N8N, and Hostinger).

5.2 Communication to Data Processors

Specialized third parties independently contracted for the execution of specific projects, who process personal data solely on behalf of Konsulitika and only to the extent necessary to fulfill the contracted engagement, subject to contractual confidentiality and security obligations equivalent to those established in this Privacy Notice, in accordance with Article 2, Section XII of the LFPDPPP.

5.3 Transfers That Do Not Require Additional Consent (Art. 36 LFPDPPP)

The following transfers are carried out without requiring additional consent from the data subject, under the provisions set forth in Article 36 of the LFPDPPP:

Mexican tax and regulatory authorities, including the SAT and other competent authorities, when required by applicable legislation.

5.4 Transfers Requiring the Data Subject's Consent

Strategic partners or business associates for joint projects — only with the data subject's express and prior authorization.

5.5 Transfers Arising from Cookie Consent

When the data subject grants consent for the use of analytics and/or marketing cookies under the terms of Section 9 of this Privacy Notice, their browsing and behavioral data may be shared with the following platforms, which will process it in accordance with their own privacy policies:

Analytics: Google Analytics, Google Tag Manager, Microsoft Clarity, Microsoft, LinkedIn

Advertising: Meta, LinkedIn

The legal basis for such communication is the express consent granted by the data subject upon accepting the corresponding cookies.

5.6 Payment Processing

Payments for Konsulitika's services, programs, and courses are processed by third parties certified under PCI-DSS standards, strictly to the extent necessary to execute the transactions contracted by the data subject. Konsulitika does not directly store credit card, debit card, or other payment instrument data. The data subject may consult the privacy policies of the payment processors at the time of completing their transaction.

5.7 Modifications to the Legal Structure of the Data Controller

In the event that the data controller modifies its legal structure by incorporating a legal entity under its majority control, personal data may be transferred to such entity.

Outside the circumstances described in this section, your personal data will not be shared with third parties without your consent, except as otherwise provided by law.

6. Automated Processing and Artificial Intelligence

Konsulitika uses automated tools and artificial intelligence for the following activities involving personal data:

• Automated responses to messages on digital channels (WhatsApp, Instagram DM) via bots that collect contact data and integrate it into the customer management system

• Automated lead scoring based on the data subject's behavior and interactions with Konsulitika's channels

• Contact segmentation to personalize communications and service offers

The user acknowledges that responses provided through artificial intelligence systems may be dynamically generated and may contain unanticipated information. Accordingly, no liability is assumed for responses, promotions, or interpretations that differ from those originally programmed.

📌 Right to Object to Automated Decision-Making (Art. 26, Section II, LFPDPPP)

The data subject has the right to object to the automated processing of their data when such processing produces effects that significantly affect their interests without human intervention. To exercise this right, send your request to [email protected] with the subject line "Objection to Automated Processing".

7. ARCO Rights

Pursuant to Articles 21 through 34 of the LFPDPPP, the Data Subject has the right to Access, Rectify, Cancel, or Object to the processing of their personal data.

Access

Know what data Konsulitika holds about you and for what purposes it is used.

Rectification

Request the correction of inaccurate, incomplete, or outdated data.

Cancellation

Request the deletion of your data. This triggers a blocking period prior to definitive deletion (Art. 24 LFPDPPP).

Objection

Object to the processing of your data for specific purposes, especially marketing, retargeting, and automated decisions.

7.1 Procedure

Channel

[email protected]

Subject line

"ARCO Request — [Access / Rectification / Cancellation / Objection]"

Requirements

Full name + official ID + description of the right you wish to exercise

Response period

20 business days (extendable once for the same period — Art. 31 LFPDPPP)

Cost

Free of charge (Art. 34 LFPDPPP)

8. Revocation of Consent and Restriction of Use

The Data Subject may revoke consent for the processing of their data at any time, without retroactive effect, by submitting a request to [email protected].

To opt out of marketing communications, the Data Subject may:

• Send an email to [email protected] with the subject line "Marketing Opt-Out"

• Use the unsubscribe link included in any Konsulitika marketing email

9. Cookies and Tracking Technologies

Konsulitika's website uses first- and third-party cookies and tracking technologies for the following purposes:

• Essential cookies — technical operation of the site (session, security). No consent required.

• Analytical cookies — traffic measurement, pages visited, and user behavior. Consent required.

• Marketing and retargeting cookies — enabling personalized advertising on digital platforms. Consent required.

The Data Subject may configure their browser to reject cookies. Disabling essential cookies may affect the functionality of the site.

10. Data Retention and Security Measures

10.1 Retention Periods

Information will be retained only for as long as necessary to fulfill the purposes described in this Privacy Notice or in accordance with applicable legal obligations.

10.2 Security Measures

Konsulitika implements administrative, technical, and physical security measures in accordance with Article 18 of the LFPDPPP, including restricted access to systems with authentication, encrypted communications, internal confidentiality policies, and periodic access reviews. In the event of a security breach that significantly affects the rights of the data subject, notification will be made immediately in accordance with Article 19 of the LFPDPPP.

11. Applicable Legal Framework by Jurisdiction

The primary applicable law is the Mexican LFPDPPP. This Privacy Policy is governed by the laws of the United Mexican States. By using the site, you agree that any matter relating to your privacy will be resolved under these laws.

12. Minors

⛔ Minors

Konsulitika's services are directed exclusively at persons over 18 years of age. If you are a minor, we ask that you do not use Konsulitika's services or provide us with personal information. If you are a parent or guardian and become aware that a minor under your responsibility has provided us with personal data, please contact us. Upon notification or detection of such a situation, we will make reasonable efforts to delete any personal information we have collected or stored about that person. Please notify us at [email protected].

13. Changes to This Privacy Notice

This Notice may be amended at any time to reflect changes in services, applicable legislation, or data processing practices. Any material changes will be notified through publication at www.konsulitika.com/aviso-de-privacidad (with the update date). Continued use of Konsulitika's services following notification constitutes acceptance of the changes.