Introduction
This Privacy Policy (“Policy”) governs the manner in which Iniciativas de Exito, S.A. de C.V. with offices Avenida Antonio Dovali Jaime Numero 70, Torre A, Piso 2, Colonia Santa Fe, C.P.01210. Delegación Álvaro Obregón, Mexico, City, México doing business as Ganax (the “Company,” “we,” “us,” or “our”) collects, uses, processes, and protects the personal data of individuals (“you,” “your,” or “Users”) who interact with our website, platforms, and services (collectively, the “Service”). The Company is committed to safeguarding personal data in compliance with applicable data protection laws.
By accessing or using our Service, you consent to the collection, use, and disclosure of your personal data in accordance with this Policy, as amended from time to time. This Policy is an integral part of our terms of service and applies to all Users that provide personal when they use the Service.
2. Data Controller
The Company acts as the data controller with respect to the personal data collected through the Service, meaning that we determine the purposes and means of the processing of your personal data. In certain circumstances, the Company may act as a data processor on behalf of third parties, in which case this Policy applies solely to our capacity as a data controller.
3. Categories of Personal Data Collected
We may collect and process the following categories of personal data from you, depending on your interactions with the Service, your device settings, and the nature of your relationship with us:
Identifiers: Full name, email address, telephone number, postal address, social media handles, account login credentials, government-issued identification numbers (e.g., national identification numbers, driver’s license numbers), and other personally identifiable information.
Device and Online Identifiers: IP address, Mac address, device IDs, cookie identifiers, and similar online identifiers.
Demographic Information: Age, gender, nationality, country of residence, citizenship and professional qualifications or experience.
Commercial Information: Records of products or services purchased, obtained, or considered, as well as your transaction history.
Content Data: Direct messages, posts, audio and video recordings, and other personal content shared through the Service.
Financial Information: Credit card numbers, debit card numbers, billing information, and other financial account data.
Internet or Other Electronic Network Activity Information: Information concerning your browsing history, search history, interactions with our website and advertisements, and referral data.
Geolocation Data: Precise or approximate location data inferred from your IP address or obtained via device settings, where applicable.
Inferences: Information drawn from the data collected to create a profile about your preferences, behavior, and characteristics.
The personal data collected may vary depending on the nature of your relationship with us and the services you use. We will not collect any personal data that is not necessary for the legitimate purposes outlined below.
4. Legal Bases for Processing
We process personal data under the following legal bases:
Consent: Where required by law, we obtain your express consent to process your personal data for specific purposes, including for direct marketing and targeted advertising. In accordance with the applicable law, your consent when using the Services may be express or implied depending on the sensitivity of the data and the context of collection.
Contractual Necessity: We process personal data where it is necessary for the performance of a contract to which you are a party, such as providing services you have requested, processing payments, and facilitating transactions.
Legal Obligations: We process personal data to comply with our legal obligations under applicable laws and regulations, such as responding to lawful requests, maintaining records, and fulfilling statutory reporting requirements.
Legitimate Interests: We process personal data in pursuit of our legitimate interests, provided that such interests are not overridden by your fundamental rights and freedoms. These interests may include improving our services, securing our operations, and protecting our business. This includes processing necessary to fulfill the purposes for which the data was obtained, as long as it is consistent with your expectations and does not violate your rights.
5. Purposes of Data Processing
Your personal data may be processed for the following purposes:
Service Delivery: To provide, maintain, and improve the Service, including facilitating transactions, processing orders, and delivering goods or services.
Communication: To communicate with you regarding your use of the Service, including responding to inquiries, providing customer support, and sending important notices.
Marketing and Advertising: To deliver personalized advertising, promotional content, and targeted offers based on your preferences, and to analyze the effectiveness of marketing campaigns.
Compliance and Legal Obligations: To comply with applicable laws, regulations, legal processes, and court orders, and to enforce our legal rights, including investigating fraud, resolving disputes, and ensuring compliance with our terms of service.
Security and Fraud Prevention: To detect, prevent, and respond to security incidents, including unauthorized access, data breaches, and fraud.
Analytics and Research: To analyze user behavior, conduct research, and perform statistical analysis to improve our Service and develop new offerings.
Personal data collected will only be processed for the specific purposes for which it was collected, unless we have a legal basis to process it for other purposes.
6. Data Retention
We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. The duration of retention may vary depending on the nature of the data, the purpose for which it is processed, and legal or regulatory requirements. Once the applicable retention period expires, your personal data will be securely deleted, anonymized, or otherwise rendered inaccessible.
In accordance with the applicable privacy law, we will ensure that the personal data is retained only for the period necessary to fulfill the purpose for which it was collected, unless a longer retention period is required or permitted by applicable law.
7. Data Sharing and Transfers
We may share your personal data with third parties under the following circumstances:
Intracompany Transfers: Personal data may be shared within our corporate group to fulfill the purposes outlined in this Policy.
Service Providers: We engage third-party service providers to assist in the operation of the Service, including payment processors, marketing agencies, IT service providers, and data analytics companies. These third parties process personal data on our behalf and are contractually obligated to maintain its confidentiality and security.
Legal Disclosures: We may disclose personal data to comply with legal obligations, such as responding to lawful requests from regulatory authorities, government bodies, or courts. Under the applicable law, we may disclose personal data to competent authorities, subject to applicable law and regulations.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of the transaction, subject to this Policy.
Advertising and Marketing Partners: We may share non-personalized data with advertising partners to serve ads, analyze ad performance, and optimize marketing strategies. Personal data will only be shared with your express consent.
Cross-border data transfers will comply with applicable law requirements, including the use of appropriate safeguards such as standard contractual clauses, binding corporate rules, or other approved mechanisms.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These measures include encryption, access controls, and regular audits of our security practices. While we strive to maintain a high level of data security, no security measures are completely infallible, and we cannot guarantee absolute security.
In the event of a data breach that poses a significant risk to your rights and freedoms, we will notify you and the relevant supervisory authorities in accordance with applicable data protection laws.
9. User Rights
Under applicable law, Users have the following rights with respect to their personal data:
Right of Access: The right to request information about the personal data we process about you, including the categories of data, purposes of processing, and recipients of data.
Right to Rectification: The right to request corrections to inaccurate or incomplete personal data.
Right to Erasure: The right to request the deletion of personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected. This right is also known as the “Right to Be Forgotten”.
Right to Restrict Processing: The right to request the restriction of processing of personal data under specific conditions.
Right to Data Portability: The right to receive your personal data in a structured, commonly used format and transmit it to another data controller where technically feasible.
Right to Object: The right to object to the processing of your personal data for direct marketing purposes or based on legitimate interests.
Right to Withdraw Consent: The right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise any of these rights, please contact us using the contact information provided below.
10. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance user experience, analyze site traffic, and deliver personalized content and ads. For more information on our use of cookies and how you can manage your preferences, please refer to our Cookie Policy.
11. Changes to this Privacy Policy
We reserve the right to modify this Privacy Policy at any time to reflect changes in our practices, regulatory requirements, or industry standards. Any modifications will be communicated to you via updates posted on our website, and where required by law, we will seek your consent for material changes. Please review this Policy periodically for any updates.
12. Contact Information
If you have any questions or concerns regarding this Privacy Policy, or if you wish to exercise your rights as outlined above, you may contact us at privacy@ganax.com.
