OwnCX Full Privacy Notice.

We process only the data you provide to us directly when you use this site, and the minimum technical data any server receives to answer a request. We use no cookies and the site analytics stays anonymous and aggregate, so we do not build an individual browsing profile.

In The Forge

The free text with which you describe your operation's challenge, capped at two thousand characters. This text is open and may contain whatever you type, for example details about your company. Along with the text we receive the intent you chose, the site language, and a session identifier generated in your browser that is not stored in any cookie or storage and disappears when you reload the page.

In the feedback signal

If you rate a diagnosis, we collect only the session identifier, the intent, and your verdict. This signal contains neither your name nor your email, and today it is not stored.

In contact and scheduling

The contact page collects nothing on the site. If you choose to open WhatsApp, Cal.com, or your email application, those services receive the data you type into them, on their own pages and under their own notices.

Sensitive data

OwnCX requires neither sensitive data nor financial or asset data to provide the service, and we ask you not to include them in The Forge free-text box. Sensitive data includes, for example, data about health, racial or ethnic origin, beliefs, political opinions, or sexual preference. Should you include sensitive or financial data anyway, we will process it solely for the purpose described in this notice and delete it as soon as that purpose is complete. We also ask you not to include personal data of third parties.

Primary purposes

These purposes originate and are necessary for our relationship with you, so they require no additional consent.

• Generate the preliminary diagnosis of your operation that you request in The Forge.
• Allow a senior partner to review, correct, and approve that diagnosis before it reaches you, the Hold.
• Attend to the contact channel you choose and, where applicable, coordinate a call.
• Operate, protect, and technically maintain the site.

Secondary purposes

These purposes are not necessary for the service, so you may decline them without any effect on the attention you receive.

• Follow up commercially on your request and send you communications about OwnCX services.
• Improve our materials and the site experience from aggregated signals.

If you do not wish your data to be processed for the secondary purposes, you may say so by writing to the contact below, within five days of learning of this notice. A lack of response within that period is understood as your consent for those purposes, and you may in any case revoke it later at any time.

The Forge processes the text you write with a language model to forge a preliminary diagnosis. That automated step never issues the final decision, because every diagnosis passes through the Hold, the review of a senior partner, before it reaches you.

Because of the way the site is built, this artificial-intelligence step may or may not occur. When the AI engine is active, the text is sent to our language-model provider to generate the draft. When that engine is not active, the text is processed only on the OwnCX server and stays there, without being sent to any third party and without being stored.

Your right regarding automated processing

You have the right to know whether your data is subject to automated processing and to object to it when it is carried out without human intervention and significantly affects your interests, rights, or freedoms, under Article 26, section II of the Law. At OwnCX no diagnosis is delivered without review by a senior partner, so the final assessment is never an automated act without human intervention. To exercise this right, write to the contact below.

To operate The Forge, the contact form, and scheduling, OwnCX relies on service providers that process data on OwnCX's behalf and in its name, under contract and bound to protect your data in accordance with the Law. These providers act as processors that handle your data on OwnCX's behalf and in its name, under Article 2, section XII of the Law, so they do not constitute a transfer to a third party and do not require your consent, and we still disclose them for transparency. The categories of processors that may take part are the following.

• Hosting and infrastructure services that receive the site's requests in order to answer them.
• A scheduling and appointment-booking service, only if you open the scheduler by your own action.
• A language-model provider that generates the diagnosis draft, when the artificial-intelligence engine is active.

The Forge diagnosis is generated with a language model. Depending on the site configuration at any given time, that processing may occur on OwnCX's own infrastructure within Mexico, or through a language-model provider that may be located outside Mexican territory. When a provider outside Mexico takes part, that international transfer occurs only where the provider contractually commits to a level of protection equivalent to the Law, and your text is processed solely to generate the diagnosis and is not retained beyond that purpose.

You may ask us to limit the use or disclosure of your personal data. To do so, write to the contact below and we will add you to an internal exclusion list, so that your data is not used for the secondary purposes. Where applicable, you may also register your number with PROFECO's Public Registry to Avoid Advertising.

You have the right to access your personal data, to rectify it when it is inaccurate, to cancel it when you consider it is not needed, and to object to its processing for specific purposes. These are the ARCO rights. Exercising them is free of charge.

How to submit your request

Send your request to the contact below. So that we can attend to it, your request must include the following.

• Your name and a means to receive the response.
• A document that proves your identity or the representation of whoever acts on your behalf.
• A clear description of the data over which you are exercising the right.
• Any element that helps locate your data.

We will respond within twenty days and, where the request proceeds, we will make the right effective within the following fifteen days.

You may revoke at any time the consent you have granted us to process your personal data. Revocation has no retroactive effect. To revoke it, write to the same contact as the ARCO rights, clearly stating the processing you wish to stop, and we will attend to your request through the same channel and within the same time frames.

We retain the text you enter in The Forge and the diagnosis generated only for the time needed to generate it, review it in the Hold, and deliver it to you, and we then block and delete it in accordance with the Law's retention duty. When the diagnosis is generated through a language-model provider, that provider processes your text only to produce the draft and in accordance with its contractual obligation not to retain it beyond that purpose.

The Forge text and diagnosis are not stored permanently, and they are deleted once the Hold and delivery are complete. Contact-form and scheduling data, such as your name and email, are retained for as long as the relationship you begin with us lasts and for the minimum period the law requires afterward, and then blocked and deleted.

OwnCX has implemented administrative, physical, and technical security measures to protect your personal data against damage, loss, alteration, destruction, and against unauthorized use, access, or processing, in accordance with the Law.

This site runs without cookies and without storing information in your browser. The Forge session identifier lives only in your browser's memory during your visit and disappears when you reload the page.

To understand how the site is used, OwnCX runs a privacy-first, cookieless analytics tool hosted on its own infrastructure. That tool measures only aggregate, anonymous traffic data, for example the total number of visits and the most consulted pages. It sets no cookie, builds no individual profile of you, and honors your browser's Do Not Track signal, so when that signal is on the tool skips your visit entirely. The analytics data stays on OwnCX's own infrastructure and is kept in aggregate form.

The server that hosts the site receives the minimum technical data inherent to any internet request, for example your IP address, for the sole purpose of answering and protecting the site. If in the future OwnCX were to add cookies or tracking technologies that do store information in your browser, we would update this notice, tell you what data they obtain and why, and give you the means to disable them.

If you visit us from the European Union or the United Kingdom, we also process your data in accordance with the General Data Protection Regulation. Where applicable, international transfers are covered by Standard Contractual Clauses, and the human Hold over every diagnosis is the assurance that no significant decision is made on a solely automated basis.

If you reside in California, you may exercise the rights granted to you under the CCPA and the CPRA, including the right to know, to delete, and not to have your data sold or shared. OwnCX does not sell your personal data. For any of these rights, write to the contact below.

OwnCX may update this notice to reflect changes in the law or in the way we process your data. We will publish each current version on this same page of the site, with its last-updated date at the top. We recommend that you consult it periodically, and when a change is substantial we will seek to notify you through whatever contact means we hold.

If you consider that your right to the protection of personal data has been infringed, you may turn to the competent authority on the matter, which under current legislation is the Secretaría Anticorrupción y Buen Gobierno and the guarantor authorities that the law designates.