Privacy notice
What data the firm collects through the site, what it uses it for, and how to exercise your rights.
About this translation
This privacy notice is an English translation of the notice published in Spanish, Aviso de privacidad , provided for convenience. The Spanish version is the one that binds the firm and prevails in case of any discrepancy.
Responsible party
Ostos Rincón Gallardo Abogados, with its address at Prado Sur 140, 3rd floor, Lomas de Chapultepec, 11000, Mexico City, is responsible for the processing of the personal data you provide through this site.
Data the firm collects
Through the «Book a consultation» form the firm collects your name, email address, phone number, the type of matter you wish to consult about, whether any authority has already acted and, optionally, a brief description that you decide to write. The firm asks you not to include in that description data about third parties or documents. The firm does not collect sensitive personal data through the site.
The site keeps its own count of how many times each page is viewed and how many times the form is started or sent. That count is a number, not a record of people: it does not store your network address, it cannot tell one visit from another and it cannot reconstruct your path through the site.
In addition, the site uses two third-party measurement tools, which use cookies:
- Google Analytics, by Google LLC: measures how many people visit the site, from which country, approximate city and type of device, how they arrive (a search engine, a link or an ad) and which pages they view.
- Microsoft Clarity, by Microsoft Corporation: records how each page is used, where people click, how far they scroll and where they leave, and can replay those sessions to fix problems on the site. It is set to hide the text of every form field, which is never recorded.
These tools receive technical data about your browsing: IP address, type of browser and device, pages visited and time spent on each. Google and Microsoft process it as the firm’s service providers, on servers that may be outside Mexico. The firm looks at it only in aggregate to improve the site; it does not use it to identify you or for advertising, and what you write in the form never reaches them.
Purposes
Your data is used for a single primary purpose: contacting you so that the firm can assess the viability of the matter you raise and, where appropriate, book a first conversation. It is not used for advertising and it is not transferred to third parties, unless an authority requires it under the law.
As a secondary purpose, technical browsing data is used to measure and improve the site. This purpose is not necessary to handle your request, and you can object to it as explained in «How to turn off measurement».
How to turn off measurement
You can prevent these tools from recording your visit, and the site works the same:
- If your browser sends the Do Not Track or Global Privacy Control signal, the site does not load either tool.
- You can block or delete cookies in your browser settings, or use a tracker blocker.
- For Google Analytics, you can install Google’s opt-out browser add-on, available at tools.google.com/dlpage/gaoptout.
- You can object to this use by writing to the firm through the same channel as ARCO rights.
How the data travels and how long it is kept
Submitting the form generates an email to the firm; the site does not store your data in any database. The email with your data is kept only while the request is being handled; the maximum period is set by the firm and will be published on this page, dated, like any other change to this notice. If the matter becomes a professional engagement, retention is then governed by the obligations of professional secrecy and the applicable rules. The server keeps for one hour an irreversible technical identifier (hash) of the IP address, only to limit automated submissions; it is not linked to your data.
To tell a person from an automated program, the form uses Cloudflare Turnstile, from Cloudflare, Inc., which checks the IP address and technical signals from the browser. Cloudflare processes them as a provider to the firm, on servers that may be outside Mexico; the firm does not receive that data or use it for advertising. The site’s server also checks automatically that the content of the submission is not unsolicited advertising, and keeps for 90 days a log of each attempt with the date, the result and the same irreversible identifier, without your name, email, phone number or description.
ARCO rights
You may access, rectify and cancel your personal data, object to its processing or withdraw the consent you gave. To exercise them, write to us through the form at /en/contact/ or call +52 55 2870 5598, stating that you are exercising ARCO rights and including your full name and a means of replying to you, a document proving your identity, and a clear description of the data concerned.
| Right | How it is exercised | Period |
|---|---|---|
| Access | Email to the firm with the subject «Derechos ARCO» | 20 business days for the decision; 15 further business days to give it effect |
| Rectification | Email to the firm with the subject «Derechos ARCO» | 20 business days for the decision; 15 further business days to give it effect |
| Cancellation | Email to the firm with the subject «Derechos ARCO» | 20 business days for the decision; 15 further business days to give it effect |
| Objection | Email to the firm with the subject «Derechos ARCO» | 20 business days for the decision; 15 further business days to give it effect |
The firm responds within the periods set by law. If the firm’s response does not satisfy you, you may file a request for the protection of your rights before the Secretaría Anticorrupción y Buen Gobierno (Anti-Corruption and Good Government Ministry), the appeal authority under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), as amended in the Official Gazette of the Federation of March 20, 2025.
Changes to this notice
Any change to this notice is published on this same page: the date is updated and a summary of what changed is added at the foot of the document.
Last updated: . What changed: the form adds Cloudflare Turnstile and an automatic content check to stop automated submissions; the notice describes the data they use and the 90-day log of attempts. The rest of the notice is unchanged.
Previous change, : the site adds Google Analytics and Microsoft Clarity to measure its use.
Reviewed against the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), in force since March 20, 2025 (Official Gazette), on .