Privacy notice

Summary

• We are Kitxer, S.A.S. de C.V. ("Kitxer"), a Mexican software company, based at Av. Lic. Adolfo López Mateos 107, Bo. San Martín, 54600 Tepotzotlán, Estado de México, México. We are the controller (responsable) of the personal data described in this notice. This website only presents the company.
• The site has no forms, accounts, tracking, advertising or third-party embeds. It counts visits in aggregate with Cloudflare Web Analytics, a measurement that uses no cookies, does not follow people across sites and is not loaded for visitors from the European Union. Only if you use the appearance switch does it keep one cookie in your browser, with your choice of a light or dark background, and nothing else. We keep no server logs of visits.
• Cloudflare, Inc. serves the site. To deliver pages and protect the site from attacks, it processes technical connection data (such as your IP address) under its own privacy policy. This may take place in the United States and other countries where Cloudflare operates.
• The only personal data we receive is what you choose to send by email to contact@kitxer.com: your email address, your name if you give it, your message and anything you attach. We use it only to read and answer your message and to follow up the conversation it starts.
• We do not sell your data, and we do not share it for advertising. We send no marketing or newsletters, we do not profile you and we make no automated decisions about you.
• To exercise your rights of access, rectification, cancellation or opposition (ARCO), to withdraw your consent or to ask us to limit the use or disclosure of your data, write to contact@kitxer.com. It is free.
• This summary is our simplified privacy notice. The integral notice follows.

1. Who we are

This website is operated by Kitxer, S.A.S. de C.V., a Mexican sociedad por acciones simplificada. We are the responsable (controller) of the personal data described in this notice, under Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (the "Law").

This notice covers only this website, at kitxer.com (English) and es.kitxer.com (Spanish). They are the same site in two languages. It does not cover the third-party sites this site links to (section 5) or Kitxer's products, which have their own notice. Our registered details are at the end of this notice.

2. The data we collect and where it lives

We collect only the data described here. This is the integral notice (aviso de privacidad integral).

What we do not collect. We do not ask for sensitive personal data (health, beliefs, ethnicity, sexual orientation, biometrics or similar). If you send us some on your own, we use it only to deal with your message. We do not use profiling, and we make no automated decisions about you. Our fonts and all other files are served from our own domain. The one exception is the visit measurement of Cloudflare Web Analytics, whose script loads from static.cloudflareinsights.com, a Cloudflare domain (Cloudflare is also the provider that serves the site), and which is not loaded for visitors from the European Union.

Providing data is your choice. You do not have to give us any personal data to read this site. If you write to us, we need your email address to reply; the rest is optional.

3. Why we use your data

Necessary purposes

The data described in this notice is used only for these purposes:

• Reading your message and answering it.
• Following up the conversation your message starts.
• Handling the privacy requests you make.
• Delivering this site to you and protecting it from attacks, using the technical connection data that Cloudflare processes.
• Establishing, exercising or defending our rights, for example against a claim.
• Meeting any legal obligation that applies to us.

Your consent. It is your choice whether to write to us. Because this notice is available to you before you do, we understand that by writing to us you consent to your data being used for these purposes, which need no other consent. You can withdraw it at any time (section 7).

Secondary purposes

One secondary purpose: measuring visits. With Cloudflare Web Analytics we measure, in aggregate, how many people visit the site, from which country, with which type of device and browser, which pages they view and how long they take to load, to understand how the site is used and to improve it. It is not necessary for you to read the site or for us to deal with your message, and it does not let us identify you. We do not use your data for marketing, newsletters, profiling or advertising, and we make no automated decisions about you.

How to limit the use or disclosure of your data

We use your data for nothing beyond the above, and we do not disclose it beyond what this notice says. Because we send no marketing, there is no opt-out list to join. To refuse the measurement of visits, block the script of static.cloudflareinsights.com with a content blocker or your browser's tracking protection: the site works the same. If you want us to limit the use or disclosure of your data further, write to us as section 7 explains.

4. Cookies and browser storage

This site sets no analytics, tracking or advertising cookies and uses no localStorage or other browser storage. The visit measurement of Cloudflare Web Analytics does not use cookies or browser storage either, and does not follow people across sites. There is no tracking, advertising or third-party embed, so there is no cookie banner.

One cookie of ours, and only if you ask for it. The footer has an appearance switch (system, light or dark). As long as you do not use it, the site stores nothing in your browser. If you pick light or dark, the site keeps that choice in a cookie named theme, with the value light or dark, so that it shows you the same background on your next visit and in the site's other language (kitxer.com and es.kitxer.com). The cookie lasts one year, holds no personal data or identifier, and we use it for nothing else. Like every cookie, your browser sends it back to the site with each request; we neither read nor record it. If you pick "system", we delete it. You can also delete it from your browser at any time, and the site works the same without it.

There is also one possible cookie that is not ours: if Cloudflare has to check that a request is not an automated attack, it may set a strictly necessary security cookie for that check, under its own privacy policy.

5. Who receives your data, and where it goes

We share personal data only with the providers below, or where the law requires it. We do not sell it, and we do not share it for advertising.

The messages you send to contact@kitxer.com are stored by an email provider that holds our mailbox. The providers are:

• Cloudflare, Inc. serves this site and protects it from attacks. It processes technical connection data (your IP address, your browser's user agent and the address you request) under its own privacy policy. Through Cloudflare Web Analytics, it also processes the visit statistics described in section 2.
• Zoho Corporation holds our mailbox and sends our email.
• Amazon Web Services (Amazon SES) also sends our email.

They are processors (encargados): they handle the data on our behalf, to provide us with their service, under each provider's terms. We do not transfer your data to third parties for their own purposes.

When we change a provider

We may replace a provider on this list with another that does the same work for us, with the same protections. We update this section before the new provider receives personal data. A change that would send your data to a recipient that uses it for its own purposes is a material change, and we tell you as section 10 says.

Links to other sites

This site links to other sites, such as our organization's pages on GitHub and Instagram. When you follow a link you leave this site: the other site handles your data under its own privacy policy, and we receive nothing from that visit.

Transfers and international processing

Your data may be processed in Mexico, in the United States and in other countries where our providers operate, under their own privacy policies.

From Mexico. Sending your data to a processor is a remisión (a disclosure to a processor), not a transfer that needs your consent.

From the EU, the EEA and the UK to the United States and other countries. Where the law requires it, the providers cover those transfers with the standard contractual clauses, with their certification under the EU-US Data Privacy Framework where they have one, or with both.

6. How long we keep your data

You can ask us at any time to cancel your correspondence, as section 7 explains. The backup copies of our email providers are overwritten under their own policies.

7. Your rights

Wherever you live, you can ask us to:

• confirm whether we process your data and give you access to it, with a copy in an electronic document;
• correct or complete it;
• cancel it. Cancellation brings a blocking period, during which we keep the data only for the responsibilities that arise from the processing, and then we delete it. We will tell you when it is cancelled;
• stop using it (objection) or limit its use or disclosure, including processing based on our legitimate interests;
• treat any consent you gave as withdrawn, which does not undo what was done before and may mean we can no longer continue the conversation you started.

We keep what the law requires and what we need to establish, exercise or defend a right.

How to ask. Requests are handled by the person Kitxer designates for that. There are no accounts on this site, so you exercise every right by email.

• Write to contact@kitxer.com with the subject "Privacy request".
• Tell us your name and a way to reply (the email address you write from is enough), the right you are exercising and a clear description of the data it concerns (for access, this is not needed). To rectify, also tell us the corrections and send what supports them. Anything that helps us find your messages, such as the date or the address you wrote from, speeds up the answer.
• We must be able to verify your identity. If you write from the address you first contacted us from, that is normally enough; if not, we may ask for an official ID. If you act for someone else, we need a document that proves your authority.
• It is free. We could only charge the cost of reproduction, copies or postage, and by email there is none.
• We answer without delay and within the time the applicable law sets. In Mexico, we tell you our decision within 20 business days of receiving your request and, if we grant it, it takes effect within 15 business days after we tell you; those periods can be extended once by an equal period if the circumstances justify it, and if so we will tell you. In the EU, the EEA and the UK, we answer within one month.
• If we cannot act on your request, we tell you why.

If you are not satisfied, write to us first and we will try to resolve it. You can also go to the data-protection authority named below.

What the law where you live adds

• Mexico. Under the Law, these are your ARCO rights (access, rectification, cancellation and opposition), together with the rights to withdraw your consent and to limit the use or disclosure of your data. If you believe we have not handled your request correctly, or we did not answer in time, you can file a data-protection request (solicitud de protección de datos) with the Secretaría Anticorrupción y Buen Gobierno, the federal data-protection authority in Mexico.
• The EU, the EEA and the UK. The GDPR and the UK GDPR give you these rights. The authority is the supervisory authority of the country where you live or work, or where the issue happened. Legal bases: we process your data for our legitimate interests (Art. 6(1)(f) GDPR): answering whoever writes to us and protecting the site from attacks. When you write to ask about a possible agreement with us, the processing also serves that request (Art. 6(1)(b)). We also meet the legal obligations that apply to us (Art. 6(1)(c)). You can object at any time to processing based on our legitimate interests.
• The United States. Privacy laws in some states give you similar rights. We do not sell personal information or share it for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.

8. Children

This site is not directed to children, and we do not knowingly collect their data. If you think a child has written to us, email contact@kitxer.com and ask us to delete the message.

9. Security

We protect your data with:

• TLS for every page of this site;
• access to the mailbox limited to the people who answer it.

If a security breach significantly affected your property or moral rights, we would tell you without delay, as the law requires.

No system is perfect. Please do not send us sensitive personal data by email unless your request needs it. If you find a security problem on this site, tell us at contact@kitxer.com.

10. Changes to this notice

If we change this notice, we publish the updated version on this page, with its version number and effective date. We keep earlier versions and send them to anyone who asks at contact@kitxer.com. We will not use your data for a new purpose without first updating this notice and, where the law requires it, without your consent.

The site has no accounts, so we cannot notify visitors individually. Anyone in an active conversation with us will hear by email before a material change takes effect.

11. Language

This notice is published in English and Spanish. If you live in a country where Spanish is an official language, such as Mexico, the Spanish version prevails. Elsewhere, the English version prevails. The Spanish version is at es.kitxer.com/privacidad.

12. Contact and company details

• Privacy requests (ARCO, GDPR or UK GDPR) and any other privacy question: contact@kitxer.com
• Registered name: Kitxer, S.A.S. de C.V.
• RFC: KIT261014FC4
• Registered address: Av. Lic. Adolfo López Mateos 107, Bo. San Martín, 54600 Tepotzotlán, Estado de México, México
• Telephone: +525594356100

Our legal index is at /legal.