Document Retention Policy
Last updated: October 18, 2026 · Version 2026-10-18.2 · Español (texto que rige)
This policy explains how long the firm keeps the documents and data of its clients and of people who contact it, why, and what happens when each period ends. It is part of our Privacy Notice.
1. Principles
We keep information only while the matter needs it or the law requires it (articles 10 and 12 of Mexico's Federal Law on the Protection of Personal Data Held by Private Parties). When the period ends, the information is blocked —kept without being used, only to meet liabilities— and then securely deleted (article 24 of that law).
Periods run from the conclusion of the matter or from the date of the act, as shown. If a lawsuit, appeal or investigation is pending, the period is suspended until it ends.
2. Retention periods
| Information | Period | Basis |
|---|---|---|
| Client identification and documents of regulated transactions (purchase, sale or assignment of real estate, fideicomisos, forming or running companies, handling client funds) | At least 10 years from the date of the act | Mexican anti-money-laundering law (LFPIORPI), articles 17 fr. XI and 18 fr. IV (amended DOF 16-07-2025) |
| Accounting, tax receipts and supporting documents (services agreements, receipts, payments) | 5 years from the related tax return | Código Fiscal de la Federación, article 30 |
| Matter file (agreement, documents, filings, correspondence, recordings tied to the matter) | During the matter and 10 years after it ends, blocked | General limitation period: Civil Code of the State of Baja California, article 1146; Data Protection Law, article 24 |
| Face photo for identity verification (sensitive data) | Same as the ID it accompanies; if no matter followed, deleted after 2 years | Data Protection Law, articles 8 and 12 (minimum period for sensitive data) |
| Inquiries, appointment requests and messages from people who did not engage us | 2 years from the last contact | Data Protection Law, article 10 (deletion when no longer needed) |
| Calls and voicemails not tied to a matter | 2 years from the call | Data Protection Law, article 10 |
| Messages classified as unwanted (spam) | 6 months | Data Protection Law, article 10 |
| Records of acceptance of the Privacy Notice and of consent | As long as the data they refer to is kept, and 10 years after | Proof of consent (Data Protection Law, articles 7 and 8) |
| Electronically signed agreements and their signing certificate | For the life of the agreement and 10 years after it ends | Civil Code of the State of Baja California, articles 1146 and 1721 |
When the same information falls under several periods, the longest applies. The firm does not keep card payment data: Stripe processes it.
3. Original documents
The firm works with digital copies. Original documents you entrust to us (deeds, powers of attorney, IDs) are returned to you when the procedure they were given for is finished or whenever you ask, and we keep a copy under this policy.
4. How deletion is done
When each period ends, firm staff review the information and delete it from the system, from document storage and from backups as these are renewed. Paper documents are destroyed so they cannot be reconstructed.
You may ask at any time for your data to be cancelled under the Privacy Notice; we handle it within the limits set by the legal periods in this policy.
5. Contact
For questions about this policy, write to privacidad@galarza.mx.