Mazappán

Privacy Policy

GDPR & International Compliance Statement

Data Controller: Mazappán Consultoría de Sistemas y Agencia Digital S.A. de C.V. (hereinafter referred to as “the Company”)
Registered Address: Calle Palmira 99, Cuernavaca, Morelos México
Effective Date: August 18, 2017
Data Protection Officer: preguntanos@mazappan.com

Introduction & Scope

The Company operates as a premier IT Consultancy and Software Development firm providing enterprise-grade software architecture, custom application development, cloud migration, cybersecurity engineering, and technical staffing solutions.

As a commercial entity established under the laws of the United Mexican States, we are natively bound by the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP). However, because our global advisory frameworks, cross-border cloud management infrastructure, remote development environments, and consulting assignments interface directly with enterprise clients, contractors, and users located within the European Economic Area (EEA), we are fully committed to compliance with the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) pursuant to its extraterritorial reach under Article 3(2).

This Privacy Policy details how we ingest, store, cross-reference, safeguard, and transfer Personal Data collected from European corporate clients, independent tech consultants, web visitors, and prospective hires based in the EU/EEA.

Legal Basis for Processing

Under GDPR Article 6, our processing of your Personal Data is structurally anchored onto specific lawful foundations:

  • Contractual Necessity (Art. 6(1)(b)): Execution of IT master services agreements (MSAs), Statements of Work (SOWs), software development lifecycle (SDLC) agreements, and independent contractor arrangements.
  • Legal Obligation (Art. 6(1)(c)): Compliance with local Mexican fiscal reporting, international anti-money laundering (AML) protocols, and global tax compliance standards (e.g., FATCA/CRS).
  • Legitimate Interests (Art. 6(1)(f)): Maintaining secure enterprise networks and code repositories, optimizing corporate web delivery, analyzing business-to-business leads, and protecting company assets from cyber threats.
  • Explicit Consent (Art. 6(1)(a)): Voluntarily granted credentials or preferences submitted during marketing opt-ins or specialized consulting applications.

Categories of Data & Collection Methods

We process only the minimum amount of information necessary to deliver high-quality IT consultancy and system implementation services. The data handled is categorized as follows:

  • Corporate Clients & Enterprise Leads: Full name, business email, corporate telephone, organizational role, LinkedIn profile URL, billing/VAT credentials, and operational metadata. Used for SOW execution, technical advisory, infrastructure provisioning, billing, and strategic account updates.
  • Contractors & Technical Specialists: Full legal name, CV, GitHub or portfolio handle, technological stack matrices, bank account data (IBAN/SWIFT), tax identifiers, and hourly bill rates. Used for resource allocation, subcontractor onboarding, processing consulting fee disbursements, and code-review identity logging.
  • Digital Platform Visitors: IP addresses, device parameters, system logs, geolocational country indicators, and behavioral patterns logged via analytical cookies. Used for network vulnerability assessments, web-infrastructure load distribution, and digital service optimization.

International Data Transfers out of the EU

Because the Company operates out of its primary corporate headquarters in Mexico, your Personal Data will be transferred outside the EEA and stored on secure cloud clusters in Mexico and/or our global cloud-hosting provider regions.

Adequacy Framework & Safeguards: While the European Commission has not yet issued a comprehensive, blanket adequacy decision for Mexico under GDPR Article 45, the Company enforces rigorous cross-border protection parameters under GDPR Article 46. To govern these data transfers safely:

  • We execute the European Commission’s approved Standard Contractual Clauses (SCCs) (Controller-to-Controller or Controller-to-Processor modules, as applicable) within our corporate legal agreements.
  • We demand end-to-end Transport Layer Security (TLS 1.3) and AES-256 resting encryption across all data pathways.
  • We perform technical Transfer Impact Assessments (TIAs) to verify that local authorities cannot access your data in a manner inconsistent with democratic norms or fundamental rights.

Data Retention & Erasure Protocol

We store Personal Data only for as long as required by our active B2B business relationships or legal mandates. Retention thresholds follow clear criteria:

  • Client Engagement & Development Records: Maintained for the active duration of the contract plus 5 structural years following termination to satisfy corporate liability statutes under Mexican Commercial and European civil codes.
  • Consultant Profiles & Resumes: Retained for 2 years following last active contact, or deleted within 30 business days upon explicit data subject request.
  • Server Metadata, Code Commit Logs & Technical Logs: Retained for a maximum period of 90 days before automated system purging, unless required for ongoing cyber forensic investigations or specific client contract requirements.

Data Subject Rights Under the GDPR

If you are an individual residing within the European Union, you possess robust, actionable privileges regarding your information. Under GDPR Chapter III, you have the right to:

  • Right of Access (Art. 15): Request clear copies of all Personal Data we hold about you at any time.
  • Right to Rectification (Art. 16): Demand correction of inaccurate or structurally incomplete technical records.
  • Right to Erasure / “Right to be Forgotten” (Art. 17): Have your data permanently deleted from our systems when it is no longer needed for contractual or legal retention mandates.
  • Right to Restriction of Processing (Art. 18): Instruct us to isolate data processing while you challenge records veracity or legal validity.
  • Right to Data Portability (Art. 20): Request your data be extracted into a structured, machine-readable format (such as JSON or CSV) for transfer to alternative vendors.
  • Right to Object (Art. 21): Terminate processing operations tied to legitimate corporate marketing interests.

Exercising Your Rights: To invoke any of these statutory protections, please transmit a formal request to our designated Data Protection Officer via email at preguntanos@mazappan.com. We are legally committed to answering your request without undue delay and at the latest within one calendar month of receipt.

Security Framework & Incident Response

We employ advanced physical, administrative, and technological safety measures to minimize risks of unauthorized access, altering, or accidental destruction. Our software development and IT engineering environments utilize multi-factor authentication (MFA) protocols, strict Role-Based Access Controls (RBAC), code repository access audits, and continuous monitoring frameworks.

In the highly improbable event of a data breach endangering personal freedoms, we pledge to notify our supervising European Data Protection Authorities within 72 hours of technical confirmation, in direct adherence to GDPR Article 33. Affected data subjects will be communicated with immediately if the vulnerability presents a high risk to personal security.

Right to Lodge a Complaint

While we encourage you to approach us directly to remediate any concerns regarding data handling, you possess an unconditional right to submit an official complaint to a European Union Supervisory Authority within your country of residence, workplace, or localized point of alleged infraction.

Simultaneously, you maintain your rights to seek domestic regulatory oversight from the Mexican national authority, the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) located in Mexico City.

Policy Amendments

As global cybersecurity frameworks, software standards, and international trade pacts mature, we may issue periodic changes to this policy. Any modifications will be broadcast via a direct notice banner on our platform or via targeted electronic distribution to our contractual stakeholders.

Mazappán Consultoría de Sistemas y Agencia Digital S.A. de C.V. — RFC: MCD170818H31
Corporate Legal Department & International Data Protection Office