Privacy Notice

1. Identity and address of the data controller

The controller of your personal data is Cabo Websites, operated by Santiago Tangassi, operating under the trade name "Cabo Websites" from Cabo San Lucas, Baja California Sur, Mexico. This is an individual with business activity ("persona física con actividad empresarial") providing web design and development services; this site (cabowebsites.com) serves as its commercial showcase and one of its contact channels.

As of this update, the official contact channel for anything related to this notice — including questions, clarifications and the exercise of your ARCO rights — is WhatsApp at +52 624 267 9240 or email at contacto@cabowebsites.com.

2. What personal data we collect

There are two sources of data. The first is data you provide directly and voluntarily when you contact us: your name, your phone or WhatsApp number, your email address (only if you choose to share it), the name of your brand or business, and the content of the messages or information you share with us about your project.

The second source is data collected automatically through your interaction with the site, via analytics and measurement tools, and only if you accepted non-essential cookies: pages and sections you visit, time on page, scroll depth, clicks on interface elements, device type, browser and operating system, language, approximate location at the country or city level (inferred from network infrastructure, not GPS), and the origin of your visit (for example, whether you arrived from a search engine, a social network or a direct link).

None of our analytics tools is designed to identify you by name from your browsing alone: they operate with technical identifiers (cookies or browser local storage), not with your name, email or phone number, unless you share those with us yourself when you message us.

The specific tools collecting this automatic data today are: Google Analytics 4 (measurement ID G-D92J7BL1YN), operated by Google LLC; Microsoft Clarity (project xs3s3258za), operated by Microsoft Corporation; CRM-ST, our own analytics, hosted on our own server; and Google Search Console, which gives us aggregate statistics on how people find us in Google search results. The technical detail of each one — including which cookies or storage each uses and for how long — is described in our Cookie Policy.

3. Sensitive personal data

We do not collect sensitive personal data as defined by the LFPDPPP: racial or ethnic origin, present or future health status, genetic information, religious, philosophical or moral beliefs, union membership, political opinions, or sexual preference. No form or interaction on this site requests this kind of information.

If, on your own initiative, you were to include sensitive data within the content of a message you send us, we would process it solely for the specific purpose of handling your request, with the same confidentiality as the rest of your data, and would not use it for any other purpose.

4. Purposes of processing

Primary purposes (necessary to serve you; without them we could not provide the service): responding to your messages and enquiries; preparing quotes and proposals; following up and delivering the web design or development service you may contract; providing support and maintenance during and after the project; and, where a formal commercial relationship exists, meeting the tax, accounting and legal obligations arising from it.

Secondary purposes (not necessary for the relationship between you and us; you must be able to refuse without it affecting the service): today we do not use your data for marketing, advertising or commercial prospecting directed at you. If in the future we decided to send you information about new services or studio content, we would notify you expressly and you could object at any time by messaging WhatsApp at +52 624 267 9240 or emailing contacto@cabowebsites.com, without it affecting any service you are already receiving.

Separately, the aggregate browsing data we obtain from Google Analytics 4, Microsoft Clarity, CRM-ST and Google Search Console is used exclusively for internal statistical purposes: understanding what content works, detecting usability problems and improving the design and performance of the site. We do not use it to build individual advertising profiles, nor do we share it with advertising networks.

5. Legal basis

This notice is issued under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP, published in the Official Gazette on 5 July 2010), its Regulations (Official Gazette, 21 December 2011) and the Privacy Notice Guidelines (Official Gazette, 17 April 2013), as well as the right to personal data protection recognised in Article 16, second paragraph, of the Political Constitution of the United Mexican States.

Additionally, and only as a best-practice reference — given that part of our analytics infrastructure is operated by companies with international reach and that this site is also published in English — we aim to align our practices with principles recognised by the European Union's General Data Protection Regulation (GDPR), such as data minimisation, purpose limitation and transparency.

6. Transfers and remittances of personal data

We do not sell, rent or share your personal data for third-party commercial purposes. The LFPDPPP distinguishes between a "transfer" (communicating data to a third party who becomes a controller) and a "remittance" (communicating data to a processor who handles it on behalf of and under the instructions of the controller, which is not considered a transfer). What we do with Google and Microsoft, for the purposes of this notice, are remittances: both companies act as processors handling aggregate browsing data on our behalf, subject to their own privacy policies and the terms of service governing their products (Google Analytics 4 and Microsoft Clarity, respectively).

You should know that, given the global nature of the infrastructure of Google LLC and Microsoft Corporation, the browsing data these tools collect may be processed on servers located outside Mexico, including the United States. Both companies publish their own privacy policies, which we recommend consulting directly: Google at policies.google.com/privacy and Microsoft at privacy.microsoft.com.

Data collected by our own analytics, CRM-ST, remains exclusively on our server and is not transferred or remitted to any third party.

If you contact us via WhatsApp, that conversation takes place within the infrastructure of WhatsApp Inc. / Meta Platforms, Inc., subject to its own privacy policy; we recommend reviewing it if you have questions about how Meta handles messages on its platform.

We do not carry out data transfers requiring your express consent under Article 36 of the LFPDPPP (for example, to affiliates, business partners or third parties unrelated to providing the service).

7. ARCO rights: what they are and how to exercise them

You have the right to Access the personal data we hold about you and to know the applicable privacy notice; to Rectify it when it is inaccurate or incomplete; to Cancel it when you consider it is not required for any of the purposes stated in this notice, that it is being used for purposes you did not consent to, or that our relationship has ended; and to Object to the processing of your data for specific purposes.

To exercise any of these rights, send us your request via WhatsApp at +52 624 267 9240 or email at contacto@cabowebsites.com. To be able to handle it, your request must include at minimum: your full name; a means of contact for us to communicate our response (WhatsApp itself is sufficient); a clear and precise description of the personal data over which you are seeking to exercise the right; and, for rectification requests, the correction you are requesting together with any supporting document. If you are acting on behalf of another person, you must evidence that representation.

Legal deadlines: once we receive your complete request, we will communicate our determination within a maximum of 20 (twenty) business days. If the request is granted, we will act on it within the 15 (fifteen) business days following the date we communicate our response. These periods may be extended once by an equal period where circumstances justify it, and we would notify you accordingly.

Exercising your ARCO rights is free of charge; we could only charge you for reproduction, certification or shipping costs actually incurred, as permitted by law. If your request is denied, we will explain the reasons.

8. Withdrawal of consent

You may withdraw at any time the consent you have given us to process your personal data, without retroactive effect, by messaging us on WhatsApp at +52 624 267 9240 or emailing contacto@cabowebsites.com. Note that withdrawal may mean we can no longer provide a service that depends on that processing, and that certain information may be retained where a legal, accounting or tax obligation requires it.

9. Limiting the use or disclosure of your data

In addition to your ARCO rights, you may ask us at any time to limit the use or disclosure of your personal data for specific purposes (for example, if we were to process data for marketing purposes in the future), through the same WhatsApp channel.

If your goal is to prevent your personal data from being used for marketing, advertising or commercial prospecting by any company — not just ours — you can also register with Mexico's Public Registry to Avoid Advertising (REPEP), administered by the Federal Consumer Protection Agency (PROFECO).

10. Cookies and other tracking technologies

This site uses cookies and similar technologies (such as browser local storage) for its operation and for the analytics tools described in point 2. The full detail — which cookies exist, their purpose, their duration, and how to accept, decline or delete them — is in our Cookie Policy, accessible from the footer of this site and from the notice that appears on your first visit.

11. Security measures

We implement administrative, technical and physical security measures that are reasonable and proportionate to the nature of the data we process (contact details and browsing identifiers; we do not process financial or sensitive data), to protect it against damage, loss, alteration, destruction, or unauthorised use, access or processing.

These measures include: the site is served exclusively over HTTPS with TLS encryption and an HSTS (Strict-Transport-Security) header to force secure connections; additional security headers are applied (Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy) that limit which external resources the site can load and reduce the risk of attacks such as cross-site scripting or clickjacking; abuse control in our own analytics (CRM-ST) is based on an irreversible salted hash value, never on the plain-text IP address, and that database contains no IP address column at all; and access to the servers and infrastructure hosting this site is restricted and protected by authentication.

No security measure is one hundred percent infallible; however, we monitor and update these protections continuously. As required by law, if a security breach were to occur that significantly affects your economic or moral rights, we would notify you without delay through the contact channel you provided.

Improper processing of personal data for profit, or the deliberate breach of databases to cause harm, may also constitute a criminal offence under the chapter on offences relating to improper processing of personal data set out in the LFPDPPP itself.

12. Data retention

We retain your contact data (name, phone, email if you shared it, and conversation history) for the duration of our relationship with you and, afterwards, for the retention periods required by applicable legal, tax or accounting obligations; once those periods elapse, we delete it or anonymise it so that it no longer identifies you.

Aggregate browsing data collected by Google Analytics 4 and Microsoft Clarity is retained according to each tool's own retention periods, detailed in our Cookie Policy. CRM-ST data is retained only for as long as necessary to fulfil its statistical purpose, after which it is deleted or anonymised.

13. Changes to this privacy notice

We may update this notice when our data processing practices, the applicable regulations, or the tools we use change. The version in force will always be published on this same page, with its last-updated date visible at the top. If the change were substantial — for example, if we started using your data for a new purpose requiring your consent — we would aim to notify you through an additional means, such as a visible notice on the site.

14. Competent authority

The guarantor authority for the protection of personal data held by private parties in Mexico is the National Institute for Transparency, Access to Information and Personal Data Protection (INAI). Before that authority you may file, among other remedies, a rights protection proceeding if you consider we did not properly handle your ARCO request, and a complaint if you consider we processed your data improperly.

You should know that, following the administrative reform approved in Mexico during 2024–2025 — which reorganised and, in some cases, dissolved federal autonomous bodies — INAI's functions are in transition towards whichever authority the Mexican State designates as its successor for personal data protection. While that transition consolidates, this notice refers to the substantive framework of the LFPDPPP, which remains in force, and to whichever authority is competent at the relevant time. We recommend verifying the current designation in the Official Gazette or at gob.mx when you need to approach the authority.