Privacy notice

The firm processes only the data necessary to handle your request, depending on the means you use:

• Contact form: name, email address, telephone number (optional), the practice area of your matter, and the message you write.
• Appointment request through the virtual assistant: name, email address, telephone number, practice area, preferred format (in person, video call, or phone call), preferred date and time, and a brief description of your matter. This data is sent to the firm only when you click the “Submit request” button.
• Email sent to contacto@riosmena.com: your name, your email address, and any information you choose to include in the message and its attachments.
• WhatsApp or telephone call: your telephone number, your WhatsApp profile name, and the information you communicate during the conversation.
• Requests to exercise ARCO rights (access, rectification, cancellation, and objection), to withdraw consent, or to limit use or disclosure: the data contained in the request and the copy of the identification document that accompanies it (and, where applicable, those of your representative), which are used solely to verify identity and process the request, and are retained for as long as necessary to evidence that the request was handled.
• Technical connection data: when you visit the site or submit a form, the server and the hosting provider process your IP address and the technical data of the request (date and time, browser type), solely for the security of the site and to limit abusive submissions. The firm does not use analytics tools or build browsing profiles.

The firm does not request sensitive personal data through the site (for example, data concerning health, beliefs, ethnic origin, political opinions, or sexual preference), or financial or asset data (such as account or card numbers); nor does it request an RFC (Mexican taxpayer ID number), a CURP (national population ID number), or passwords.

We ask that you not include this type of data in the form, in the virtual assistant, or in your messages: a general description of your matter is sufficient. If you include such data on your own initiative, the firm will not use it for any purpose other than identifying the nature of your inquiry and will delete it promptly once your inquiry has been answered, without waiting for the general retention period to expire, unless you give your express written consent for it to be retained. If it were necessary to process sensitive, financial, or asset data in order to provide you with a service, the firm will first request your express consent, which, in the case of sensitive data, will be obtained in writing.

Your data is used exclusively for the following primary purposes, which are necessary to handle the request you make:

• Attending to and responding to your inquiries, messages, and requests for information.
• Managing your appointment requests: recording them, replying to you to confirm, reschedule, or decline the date and time, and coordinating the meeting.
• Sending you, at the email address you provided, an automatic acknowledgment of receipt of your message or appointment request.
• Identifying the practice area of your matter and verifying that there is no conflict of interest before accepting an engagement.
• Maintaining the security of the site and preventing automated or abusive submissions.
• Following up on the professional relationship if you decide to engage the firm's services; any additional data requested from you at that time will be processed in accordance with the privacy notice provided to you at that time.
• Complying with the legal obligations applicable to the firm and responding to formal requests (requerimientos) from competent authorities.

Purposes that require your consent. All of the purposes above are based on the consent you give by submitting the form or the appointment request, or by contacting the firm, with two exceptions provided for in Article 9 of the Law: compliance with legal obligations and responding to formal requests from competent authorities do not require your consent (Sections I and VII); and, once you engage the firm's services, processing necessary to fulfill the obligations arising from that legal relationship does not require it either (Section IV).

The firm does not process your data for secondary purposes, that is, purposes other than those necessary to handle your request: it does not use your data for marketing, advertising, or commercial prospecting, and it does not send newsletters or promotional communications. Should the firm offer a newsletter or other informational communications in the future, it will update this notice and request your prior consent, which you may refuse or withdraw at any time.

By checking the “I have read and accept the privacy notice” box on the contact form, or by clicking “Submit request” in the virtual assistant, you give your express consent to the processing of your data in accordance with this notice. In both cases, before submission you are shown the short-form privacy notice with a link to this full notice. Without that acceptance, the site does not send your data to the firm.

When you contact the firm on your own initiative by email, WhatsApp, or telephone, the firm makes this notice available to you as follows: on the site, next to the contact details, a statement indicates that your data is processed in accordance with this notice, with a link to this page; in its first reply by email or WhatsApp, the firm provides you with the short-form privacy notice and the link to this full notice; and, during telephone calls, it informs you who the data controller is, what your data is used for, and where you can consult this notice. If, once the notice has been made available to you, you do not express your objection, you will be deemed to consent to the processing of your data for the purposes described herein, except where the Law requires express consent.

The virtual assistant on this site is an automated tool that provides general information about the firm's practice areas, its business hours, and how to contact it, and helps you request an appointment. It does not provide legal advice and is not a substitute for a consultation with an attorney.

The assistant works with predefined automated replies, without artificial intelligence. The conversation is stored only in your browser while the tab remains open and is not sent to the firm or to third parties. Only when you click “Submit request” is the appointment request data sent to the firm. After submission, that data is hidden from the conversation stored in your browser.

The assistant does not make decisions with legal effects, nor does it evaluate or profile its users. Every appointment request is a request pending confirmation, which is reviewed and answered by a person at the firm by email, during business hours.

Should the assistant use a language model provider to generate its responses in the future, this notice will be updated before that feature is activated to describe the provider, its location, and the retention periods for conversations.

To operate the site and receive your messages, the firm uses the services of the following providers:

• Cloudflare, Inc. (United States of America): hosting and operation of the website, and forwarding of emails sent to contacto@riosmena.com.
• Plus Five Five, Inc., which operates the Resend service (United States of America): an email delivery service that delivers contact form messages and appointment requests to the firm and sends the visitor the acknowledgment of receipt.
• Google LLC (United States of America): the email service (Gmail) that the firm uses, under that provider's terms of service, to receive and store messages.

These providers are located outside Mexico; therefore, your data is processed on servers located abroad. The communication of data to a party that processes it on the firm's behalf (a data processor) does not constitute a transfer (Article 2, Section XX, of the Law) and, under the Regulations, does not require your consent. In all cases, the firm remains responsible to you for your data.

The automatic acknowledgment of receipt is sent to the email address you provided; it states only the practice area selected and, for appointment requests, the format chosen; it does not reproduce your name or the content of your message and does not constitute confirmation of an appointment. If you receive an acknowledgment without having written to the firm, you may reply to it to request that your address be deleted.

The firm does not transfer your personal data to third parties. It could do so without your consent only in the cases set forth in Article 36 of the Law; for example, when the transfer is provided for by law, is legally required for the prosecution or administration of justice, or is necessary for the recognition, exercise, or defense of a right in judicial proceedings. Any other transfer would require informing you in advance and obtaining your consent.

If you choose to communicate via WhatsApp, that communication takes place through a third-party messaging service, which processes your data in accordance with its own terms and privacy policy.

Messages, appointment requests, and email or WhatsApp conversations that the firm receives from persons who are not its clients are retained for six months from the last communication related to the request. Once that period has elapsed, they are deleted, except in the following cases:

• Where you engage the firm's services: your data becomes part of the file for your matter and is retained for the duration of the professional relationship and for the periods established by applicable legal provisions.
• Where there is a legal obligation to retain the data for a longer period.
• Where the data must be kept blocked, solely to address any liability that may arise from its processing, until the limitation periods for the corresponding actions have expired.

You have the right to access the personal data the firm holds about you and to know the conditions of its processing; to rectify it when it is inaccurate, incomplete, or out of date; to cancel it so that it is no longer in the firm's possession; and to object to its processing on legitimate grounds (ARCO rights: access, rectification, cancellation, and objection).

To exercise these rights, you or your legal representative may submit a request to the firm's Personal Data Department, by email at contacto@riosmena.com or in writing at the address indicated in this notice. The request must include, or be accompanied by, the following:

• Your name and a postal or email address at which to receive the response.
• A copy of a document evidencing your identity (valid official identification); a legible digital copy sent by email is sufficient, and the firm may ask you to present the original for comparison only if there is reasonable doubt as to your identity. If you act through a representative: the representative's identification and the document evidencing the representation (a notarial instrument (instrumento público) or a power of attorney signed before two witnesses).
• A clear and precise description of the data with respect to which you wish to exercise your right (not required if you are requesting access).
• The right you wish to exercise or what you are requesting.
• Any other information or document that helps locate your data; for example, the approximate date of your message and the email address or telephone number you used to contact us.
• If you are requesting rectification: the changes to be made and the supporting documentation.

Time limits, in business days. If the request is incomplete or contains errors, the firm may ask you, once only and within five days of its receipt, to complete it; you will have ten days to do so and, if you do not respond, the request will be deemed not to have been submitted. The firm will notify you of its decision within a maximum of twenty days from receipt of the request (or from the date you respond to the firm's request for completion) and, if the request is granted, will give effect to it within fifteen days of that notice. These time limits may be extended once for an equal period when the circumstances of the case so warrant, in which case you will be informed.

The response will be sent to you by the same means through which you submitted your request. In the case of the right of access, and once your identity has been verified, the data will be delivered to you in an electronic document sent to your email address or, if you prefer, as an uncertified paper copy (copia simple).

Exercising ARCO rights is free of charge; only the costs of reproduction, copies, or shipping may be charged.

The firm may deny the exercise of these rights only in the cases provided for in the Law (Articles 25, 26, and 33); for example, when the requester does not prove their identity or representation, the data is not in the firm's possession, the rights of a third party would be harmed, there is a legal impediment or a ruling by a competent authority, or the data must be processed by legal mandate or is necessary for the performance of a contract. In that case, you will be informed of the reason by the same means and within the same time limits.

You may withdraw the consent you have given at any time, without retroactive effect, by writing to contacto@riosmena.com and stating your name and the email address or telephone number you used to contact us. The procedure is free of charge and is handled within the same time limits as an ARCO request; the firm will confirm to you that the processing has ceased and will also delete your data from the services of the providers it uses. Withdrawal will not be available where a legal provision prevents it.

To limit the use or disclosure of your data, send an email to contacto@riosmena.com indicating which use you wish to limit or through which means you do not wish to be contacted (for example, that you not be contacted by telephone, or that the firm reply to you only by email). The firm will record your request and honor it going forward.

The firm does not send advertising, so you do not need to take any action to stop receiving it.

The firm does not use cookies, web beacons, or similar technologies on this site to track your browsing, and it does not use analytics, advertising, or cross-site tracking tools.

The virtual assistant stores its state and the ongoing conversation in your browser's session storage (sessionStorage), a technical mechanism necessary for it to function: the information remains on your device, is not sent to the firm, and is deleted when you close the tab. When you submit or abandon an appointment request, your personal data is hidden from that stored conversation.

When you visit the site, a notice about cookies and privacy is displayed. When you close it, a record is saved in your browser's local storage (localStorage), under the key “ra-cookies”, so that the notice is not shown to you again on every visit. That record is also a necessary technical mechanism: it contains only the version of the notice, the date, and your preference regarding optional cookies, which the site does not currently use; it remains on your device, is not sent to the firm, and does not allow you to be identified. It is valid for six months; after that period, or if the notice changes, it ceases to have effect and the notice is displayed again.

You can view the notice again at any time through the “Cookie preferences” link at the bottom of each page; should the site ever use optional cookies, you will be able to change your choice there. You can also delete that record through your browser settings.

The server and the hosting provider process the IP address and technical data of each request for security reasons and to limit the number of form submissions. The hosting provider may use strictly technical security and diagnostic mechanisms (for example, a temporary cookie in response to suspicious traffic, or network error reports), which are not used to track your browsing.

Should any audience measurement tool or tracking technology be incorporated in the future, this notice will first be updated to describe it and to explain how to disable it.

The firm maintains administrative, technical, and physical security measures to protect your data against damage, loss, alteration, destruction, or unauthorized use, access, or processing. Communication between your browser and the site is encrypted using HTTPS (TLS). The site does not store your data in a database: it forwards it to the firm by email.

The persons involved in processing your data are bound by a duty of confidentiality, even after their relationship with the firm has ended.

In the event of a security breach that significantly affects your economic or non-economic (moral) rights, the firm will inform you immediately so that you can take the appropriate measures.

If you believe that your right to the protection of personal data has been violated, if the firm does not respond to your request, or if you are not satisfied with the response, you may contact the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Government), the authority competent in matters of protection of personal data held by private parties, and file a data protection request (solicitud de protección de datos) within fifteen business days following the date on which you receive the firm's response or, if you receive no response, from the expiration of the period the firm has to respond to you. In any event, we suggest that you contact us first so that we can address your concern.

The firm may amend this notice to reflect legislative changes or changes in its operations or in the site's services. Any amendment will be published on this same page, with the date of its last update.

If a change involves new purposes that require your consent, the processing of sensitive data, or transfers to third parties, the firm will also notify you at the email address you provided, for as long as it retains your data, and will obtain your consent where necessary.

Please also see the site's Terms of Use.