Privacy Notice

Last updated: October 18, 2026 · Version 2026-10-18.2 · Español (texto que rige)

This notice explains what personal data we process, why, who we share it with and how you can exercise your rights, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, published in the Diario Oficial de la Federación on March 20, 2025, "the Law"). It applies to galarza.mx, mexicotrust.net and rosaritolegal.com, the client portal, our forms, appointments, calls and messages, and to service at our offices.

1. Who is responsible for your data

The party responsible (responsable) for processing your personal data is Lic. Pati Claudia Galarza, attorney (Licenciada en Derecho), Cédula Profesional 15176510, Registro Profesional Estatal 19110 (Baja California), practising under the trade name "Galarza Legal" (in this notice, "the firm"), with domicile at Blvd. Popotla 3009, Playa Encantada, Playas de Rosarito, Baja California, C.P. 22713, México.

For anything about your personal data, write to privacidad@galarza.mx. The firm's Personal Data Department, headed by Lic. Pati Claudia Galarza herself, handles requests from data subjects (article 29 of the Law).

2. Personal data we process

Depending on the service you ask for, we may process the following data, about you and about the people you name:

• Identification: name, nationality, date and place of birth, signature, photograph and copy of your official ID or passport, immigration documents, RFC and CURP.
• Contact: address, email, phone and WhatsApp.
• Marital status and family: marital status, marital property regime, place and date of marriage, details of your spouse or partner, and of the beneficiaries and substitute beneficiaries you designate.
• Property and financial: property data (deeds, clave catastral, appraisals, predial), transaction values, payment information, bank accounts you give us to send or receive payments, and tax data.
• About your matter: facts, documents, contracts, court or administrative files and communications related to the matter you entrust to us.
• Communications: emails, messages, call and voicemail recordings with the firm (we tell you at the start of a call when it is recorded).
• Browsing: IP address, device and browser type, and pages visited, as described in section 8.

Sensitive data. To verify your identity we ask for a photo of your face, which is compared with the photo on your ID. We treat it as sensitive personal data and only receive it with your express written consent, which you give by ticking the specific box before uploading it (article 8 of the Law). If a matter needs other sensitive data (for example, health data in a lawsuit), we will ask for the same kind of consent.

Data about other people. If you give us data about your spouse, relatives, beneficiaries, employees or counterparties, you confirm that you told them about this notice and have their consent where the Law requires it.

We do not process data about minors except what a matter requires (for example, a minor named as a substitute beneficiary), and always through the person who holds parental authority or guardianship.

3. What we use your data for

Purposes needed for the service you ask for (they do not require your consent because they are needed for our legal relationship with you):

• Answering your inquiry, scheduling appointments and following up.
• Providing the legal services engaged: analysing your matter, preparing contracts, filings and documents, and handling procedures before trust banks, the Secretaría de Relaciones Exteriores, notaries, the Public Registry of Property and Commerce, catastro offices, courts and other authorities.
• Verifying your identity and knowing our client, and meeting the firm's duties under Mexico's anti-money-laundering law (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita) when the service is a regulated activity (articles 17 fr. XI and 18 of that law).
• Preparing services agreements, collecting signatures (including electronic signatures), invoicing, collecting fees and issuing tax receipts.
• Giving you access to the client portal and keeping you informed about your matter.
• Meeting legal and tax obligations, and establishing, exercising or defending the firm's or your rights.

Secondary purposes (not needed for the service):

• Asking you to share your opinion or a review of our service. A review is published only with your express permission for that publication.
• Sending you information about legal changes or firm services that may interest you.

If you do not want us to use your data for the secondary purposes, write to privacidad@galarza.mx saying "No secondary purposes". You can do so at any time; if you gave us your data online, you can do it now and within the following 5 business days, before we use it for that purpose. Saying no does not affect the service you asked for.

Use of artificial intelligence. The firm uses an artificial-intelligence tool ("SI") to help its staff read, summarise and search the documents of your matter. The tool makes no decisions about you: a person at the firm reviews every result before it is used. You may object to this processing as described in section 5.

4. Transfers

We only share your data when it is needed to provide the service you asked for or when the law requires it; those transfers do not require your consent (article 36 of the Law). The firm does not sell or rent your data and makes no transfers that require your consent; if one were ever needed, we would ask you first and you could accept it or not (article 35 of the Law).

5. Your ARCO rights and how to exercise them

You have the right to know what data we hold and what we use it for (Access), to have it corrected if it is inaccurate or incomplete (Rectification), to ask us to delete it (Cancellation) and to object to its use for specific purposes (Opposition), including automated processing that has unwanted legal effects on you (article 26 fr. II of the Law).

Send your request to privacidad@galarza.mx or hand it in at our Playas de Rosarito office. It must contain (article 28 of the Law):

• Your name and an address or email to receive the answer.
• A copy of your official ID or, if a representative acts for you, the document proving the representation and both IDs.
• A clear description of the data concerned (except for an access request).
• The right you wish to exercise or what you are asking for.
• Anything that helps us find your data (for example, your client or matter number).

We will give you our answer within 20 business days of receiving your request and, if it is granted, carry it out within the following 15 business days; each period may be extended once by an equal period when the case justifies it (article 31 of the Law). The procedure is free; only reproduction or shipping costs may be charged (article 34 of the Law). We deliver the information by email as a digital file unless you ask for another means.

Some data cannot be cancelled while it is needed to perform our contract with you or a legal obligation, for example records the anti-money-laundering or tax laws require us to keep (article 25 of the Law). When data is cancelled it is blocked —kept without being used, only to meet liabilities arising from the relationship— for the applicable limitation period, and then deleted; we will tell you when the cancellation is done (article 24 of the Law).

6. How to withdraw your consent

You may withdraw the consent you gave us at any time, without retroactive effect (article 7 of the Law), by writing to privacidad@galarza.mx with the same requirements as in section 5. Withdrawal may prevent us from continuing the service when the data is needed for it, and does not apply to data the law requires us to keep.

7. How to limit the use or disclosure of your data

You may ask us to stop using your data for the secondary purposes or to limit its disclosure by writing to privacidad@galarza.mx; we will add you to our exclusion list. You can also register your phone and email with the Registro Público para Evitar Publicidad of Mexico's Federal Consumer Protection Agency (PROFECO).

8. Cookies and similar technologies

Our sites use:

• A session cookie, only when you sign in to the client portal or staff sign in to the system; it lasts at most 24 hours.
• Your browser's local storage, to remember your language and other display preferences.
• The payment processor's technical cookies, only on the payment page, to prevent fraud.
• Cookie-free visit measurement on some of our sites, which counts page views without identifying you.

They collect browsing data (IP address, browser, device, pages visited and date and time). We do not use advertising or third-party tracking cookies. You can delete or block cookies and local storage in your browser settings; if you block the session cookie you will not be able to sign in to the portal.

9. How long we keep your data

We keep your data only as long as needed for the purposes in this notice and for the periods the law requires, as set out in our Document Retention Policy. When that period ends the data is blocked and then deleted (article 10 of the Law).

10. Security

We protect your data with administrative, technical and physical measures: encrypted connections, encryption of stored documents, access limited to the staff handling your matter, passwords and access logs. If a security breach significantly affected your rights, we would tell you immediately (article 19 of the Law).

All firm staff are bound by professional secrecy over the information of your matter.

11. Changes to this notice

Any change to this notice will be published on this page with its date and version number. If a change adds purposes that need your consent, we will ask for it before using your data for them (article 11 of the Law).

12. Authority

If you believe your right to the protection of your personal data was violated, you may go to the Secretaría Anticorrupción y Buen Gobierno, the authority that enforces the Law. A data-protection request is filed within 15 business days after we give you our answer, or from the end of the response period if you did not receive one (article 40 of the Law).

13. Your consent

By ticking the acceptance box on our forms, or by signing the services agreement, you state that you read this notice and consent to the processing of your data as described here, including the property and financial data your matter needs. Consent for sensitive data is given separately, expressly and in writing, with its own box. The firm keeps a record of the notice version accepted, the date and the means.