Privacy Notice

INFORMATION ABOUT THE DATA CONTROLLER

Trade name: PAQPAQ

Owner (Controller): Aranzazu Gamboa Andrade

Tax regime: Individual with Business Activity (Persona Física con Actividad Empresarial)

1. INTRODUCTION AND LEGAL FRAMEWORK

Aranzazu Gamboa Andrade (an individual with business activity), operating under the trade name PAQPAQ ("PAQPAQ", "we" or "the Platform"), is the controller responsible for processing your personal data in accordance with:

The Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP"), published in the Official Gazette of the Federation on March 20, 2025.
The Regulations to the LFPDPPP and other applicable provisions on personal data protection in Mexico.
The Federal Consumer Protection Law (Ley Federal de Protección al Consumidor, "LFPC").

This Privacy Notice (the "Notice") explains how we collect, use, share and protect your personal data. We recommend that you read it in full before using PAQPAQ.

2. DEFINITIONS

Personal data: information that identifies you directly or indirectly (name, RFC tax ID, phone number, address, email address, among others).

Sensitive data: data that affects your privacy or may give rise to discrimination (biometric data, detailed tax information, etc.).

Processing: any operation performed on personal data (collection, use, processing, storage, transfer, deletion).

Data subject: you, as the owner of the personal data.

3. PERSONAL DATA WE COLLECT

We collect the following data during registration, use of the platform and label generation:

Personal identification data:

Full name, Federal Taxpayer Registry number (RFC), Email address, Phone number, Business address, Emergency contact details.

Tax data (sensitive data):

Validated RFC, Tax regime registered with the SAT, Proof of tax status (Constancia de Situación Fiscal), Digital Seal Certificates (CSD) for CFDI stamping, Filing history.

Billing and payment data:

History of balance top-ups and charges, Registered payment methods (credit cards are not stored in full; they are processed by Stripe), Transactions carried out, Invoices issued.

Operational and shipping data:

Origin and destination addresses of shipments, Recipient details (name, phone number, address), General description of contents, Package weight and dimensions, Tracking numbers generated, History of delays, losses or deliveries of shipments.

Technical data:

IP address, Browser type and version, Operating system, Session identifiers, Platform access history, Usage patterns (for technical diagnostics), Cookies and similar technologies.

Communication data:

Messages sent to support, Customer service tickets, Record of inquiries and complaints.

4. PURPOSES OF DATA PROCESSING

4.1 PRIMARY PURPOSES (Consent required — you cannot object)

These purposes are essential for PAQPAQ to function. Without consent for them, we cannot provide the service:

Identity verification: confirming that you are over 18, of legal age and have legal capacity.
Account management: creating, maintaining and administering your PAQPAQ profile.
Label generation: creating shipping labels and validating data with carriers (Skydropx, FedEx, UPS, DHL, Estafeta, Paquete Express, etc.).
CFDI issuance: generating Digital Tax Receipts via Internet (CFDI) 4.0 with the SAT in accordance with tax provisions.
Payment processing: processing balance top-ups and shipping charges through Stripe or other authorized processors.
Compliance with tax obligations: meeting tax obligations before the SAT, customs and competent authorities.
Compliance with legal obligations: responding to requests from Mexican authorities (federal, state, municipal) on legal, tax, customs or security matters.
Fraud prevention: detecting and preventing fraudulent activity, unauthorized account use and the shipment of prohibited content.
Technical support: handling inquiries, error reports and platform operation issues.
Platform security: protecting systems against unauthorized access and cyberattacks, and maintaining data integrity.

4.2 SECONDARY PURPOSES (You may object — optional consent)

We use data for these purposes only if you expressly consent. You may withdraw your consent at any time:

Commercial communications: sending information about new services, promotions, updates, special offers or changes to the platform.
Statistical analysis and service improvement: aggregate (not individual) analysis to improve features, interface and user experience.
Reporting: creating reports on shipping trends and operating volumes (always in aggregate and anonymous form).
Surveys and feedback: asking for your opinion about the service in order to keep improving.

5. TRANSFER OF DATA TO THIRD PARTIES

We share your personal data ONLY with authorized third parties and only for the purposes that are necessary:

5.1 Operational third parties (necessary for the service):

Skydropx and other logistics operators (FedEx, UPS, DHL, Estafeta, Paquete Express, etc.): to generate, track and deliver shipping labels. They receive: name, RFC, addresses, phone number, general contents.
Stripe: for secure payment processing. It receives: transaction data (without storing the credit card in full). Stripe is certified as GDPR compliant and has its own privacy policies.
Finkok (PAC authorized by the SAT): for CFDI 4.0 stamping. It receives: tax data, receipts and XML files. Finkok complies with the SAT's security obligations.
Resend: for sending transactional emails (label confirmations, receipts, notifications). It performs no additional processing or marketing.

5.2 Integrated e-commerce platforms (synced data only):

If you sync your Shopify, Tiendanube, WooCommerce or other platform account, we share ONLY the information needed to automate shipping orders. We do not share tax data or payment history.

5.3 Government authorities (legal compliance):

Tax Administration Service (Servicio de Administración Tributaria, "SAT"): for compliance with tax obligations, CFDI and filings.
General Customs Administration (Administración General de Aduanas): for customs formalities on international shipments.
Federal Consumer Protection Agency (Procuraduría Federal del Consumidor, "PROFECO"): in the event of claims or investigations.
Competent authorities (federal, state or municipal): where there is a judicial or legal order requiring information in criminal, fraud or national security investigations.

PAQPAQ does not sell, rent or share personal data with third parties for direct marketing purposes. We do not engage in data brokerage practices.

6. DATA SECURITY

PAQPAQ implements technical, administrative and physical security measures to protect your data:

HTTPS/TLS encryption for all communications.
Multi-factor authentication (2FA) available for accounts.
Secure storage with access restricted to authorized personnel only.
Periodic security audits and compliance with international standards.
Security incident response policies and notification of those affected.
Access restrictions based on the principle of least privilege.

However, no system is 100% secure. PAQPAQ is not liable for security breaches caused by factors beyond its control (sophisticated cyberattacks, force majeure).

7. ARCO RIGHTS

Under the LFPDPPP, you have the right to:

Access: obtain a copy of all your personal data held by PAQPAQ.
Rectify: correct inaccurate, incomplete or outdated data.
Cancel: request the deletion of data when you consider it is no longer necessary (except where legal obligations apply).
Object: choose not to have your data processed for secondary purposes (such as commercial communications).

7.1 How to exercise your ARCO rights:

Option 1 (online): Log in to your PAQPAQ account, go to "Settings > Privacy and Data" and use the download, correction or deletion options.

Option 2 (by email): Send an email to hola@paqpaq.mx including:

Subject: "PRIVACY - [ARCO RIGHT] Type of Request (Access/Rectification/Cancellation/Objection)"
A clear description of what you are requesting.
A copy of official identification (INE, passport, etc.).
A digital or authenticated signature.

7.2 Response times:

PAQPAQ will respond to ARCO rights requests within 20 calendar days, in accordance with the LFPDPPP. If further information is required, we will notify you within 5 days. The total period does not exceed 60 calendar days.

8. COOKIES AND TRACKING TECHNOLOGIES

PAQPAQ uses cookies and similar technologies:

Strictly necessary cookies: to keep your session active, validate authentication and protect against CSRF.
Analytics cookies: to understand how you use the platform and identify technical issues (Google Analytics, Mixpanel).
Preference cookies: to remember your language, theme (light/dark), etc.

You can disable them from your browser settings. Disabling them may affect PAQPAQ's functionality.

9. THIRD-PARTY DATA (RECIPIENTS)

When you generate a label, we collect the recipient's name, phone number and address. This data is necessary for delivery. The recipient:

Acknowledges that their data will be shared with carriers for delivery purposes.
May exercise ARCO rights directly with the carrier or by requesting our mediation at hola@paqpaq.mx.

10. DATA RETENTION

PAQPAQ retains personal data for the following periods:

Active account data: for as long as your account is active.
Tax/CFDI data: minimum 6 years (in accordance with SAT audit requirements).
Label/shipment data: minimum 3 years (for claims and audits with carriers).
Access/security logs: 12 months (for fraud investigation).
Communication/support data: for as long as necessary to resolve complaints, maximum 2 years.

Once these periods expire, we delete data securely, unless the law requires longer retention.

11. CHANGES TO THIS NOTICE

PAQPAQ reserves the right to update this Privacy Notice. Material changes will be notified:

By email to the address registered in your account.
By a prominent notice on the PAQPAQ platform.
At least 15 days before they take effect.

Your continued use of PAQPAQ after that period constitutes acceptance of the changes.

12. CONTACT DETAILS AND COMPLAINTS PROCEDURE

For privacy inquiries, to exercise ARCO rights or to file complaints:

Contact email: hola@paqpaq.mx

Privacy Officer: Aranzazu Gamboa Andrade

Trade name: PAQPAQ

Jurisdiction: Mexico City, Mexico

12.1 Complaints procedure:

If you believe your privacy rights have been violated, you may:

Contact us directly at hola@paqpaq.mx to resolve the matter amicably (within 10 business days).
File a complaint with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI) at https://www.gob.mx/inai.
File a claim with PROFECO if you believe there has been a breach of the Federal Consumer Protection Law.

12.2 Governing law and jurisdiction:

This Privacy Notice is governed by the laws of the United Mexican States. Any dispute will be resolved by the competent courts of Mexico City.

13. SPECIAL CONSIDERATIONS

Data of minors:

PAQPAQ does not allow anyone under 18 to register. If we detect minors, we will suspend their account.

International data transfers:

Some processors (Stripe, Resend, Google Analytics) may process data outside Mexico. PAQPAQ verifies that they have EU standard contractual clauses or certifications such as Privacy Shield (although Privacy Shield was invalidated, PAQPAQ verifies that our processors hold security certifications
such as ISO 27001 to guarantee data protection).

Data portability:

You have the right to request your data in a structured format (JSON, CSV) in order to port it to another service. Send your request to hola@paqpaq.mx.

Last updated: 07/16/2026