Privacy notice

1. Data controller

The controller of your personal data is Adair Isai Vargas Pastrana, an individual trading under the Galio Labs name, with address at Av. Mazatlán B 4726, entre 47 y 48, Col. Solidaridad, San Luis Río Colorado, Sonora, Mexico.

For anything related to this notice you can write to adair.vargas@galiolabs.com.

2. Personal data collected

The form on this site collects three pieces of data, all three provided by you directly and voluntarily:

• Name. So I can address you correctly.
• Email address. So I can reply.
• Company and trade. So I can judge whether the case fits before the call, instead of spending the first reply asking.

Two further things happen without you typing them, and you should know about both:

• IP address. The server reads it when your submission arrives and uses it transiently, in memory, to cap submissions per minute and contain abuse of the form. It is not written to any database and does not travel in the email I receive. The hosting provider keeps its own server logs independently, under its own policies.
• Language preference. If you dismiss the bar suggesting the other language version, your browser stores that dismissal in its local storage. It is not a cookie, it never reaches the server, it identifies nobody, and you can clear it from your own browser.

No sensitive personal data is collected, and no financial or asset data either. No analytics, advertising or third-party tracking is used, and the site sets no cookies.

3. Purposes of processing

Primary purposes, necessary for our dealings:

• Responding to your request for a call.
• Judging whether the case fits the work I do.
• Sustaining the correspondence arising from that request.
• Where applicable, preparing and sending you a professional services proposal.

There are no secondary purposes. Your data is not used for marketing, commercial prospecting, newsletters or profiling, and is not added to any mailing list.

4. Processors and transfers

To run the site and deliver the emails I rely on two providers acting as data processors, meaning they process the data on the controller's behalf and under its instructions. Both are established in the United States:

• Vercel Inc. — site hosting and execution of the function that receives the form.
• Resend (Plus Five Five, Inc.) — delivery of the email carrying your request.

The law distinguishes between transferring data to a third party that processes it for its own purposes and passing it to a processor that handles it solely on the controller's behalf: the second does not require your separate consent. These two providers are processors, not recipients of a transfer. Beyond them, your data is not transferred, sold or shared with third parties, except on a founded request from a competent authority.

5. Retention period

Data is kept for 24 months from your last contact, or until you request its deletion, whichever comes first. If the request leads to a contractual relationship, it will be kept for the duration of that relationship and for the periods required by applicable tax and commercial law.

6. ARCO rights

You have the right to access your personal data, to request its rectification where it is inaccurate or incomplete, to seek its cancellation where you consider it is not needed for the stated purposes, and to object to its processing for specific ends.

To exercise them, send a request to adair.vargas@galiolabs.com stating your name, a means of replying to you, a clear description of what you are requesting, and a copy of official identification proving your identity. A response will be issued within a maximum of 20 business days and, where it succeeds, acted on within the following 15 business days.

You may also withdraw consent at any time, through the same channel.

7. Limiting use or disclosure

As there are no secondary purposes and no promotional communications, there are no exclusion lists to manage. If at any point you want me to stop processing your data, simply request it at the address above and it will be deleted.

8. Changes to this notice

Any change to this notice will be published at this same address, updating the date shown at the top. It is on you to review it periodically; substantial changes will additionally be communicated by email to anyone with an active request.

9. Supervisory authority

If you consider that your right to personal data protection has been infringed, you may approach the competent Mexican authority for personal data protection.