Legal

Privacy notice (LFPDPPP)

Last updated: May 15, 2026. Per Mexico's Federal Personal Data Protection Law (LFPDPPP). This is an informational translation; the Spanish version at /privacidad is the legally authoritative text.

1. Data controller

Fundación Corazón Raíz, A.C. ("FCR" or "the Foundation"), with Mexican Tax ID FCR220804IL9, fiscal address at Calle Teocelo 29, Col. Roma Sur, Cuauhtémoc, CDMX 06760, Mexico, is the controller of personal data collected through fundacionhd.org. Privacy contact: privacidad@fundacionhd.org.

2. Personal data we process

  • Identification data: name, email address, optional phone number, optional organization.
  • Voluntary contact data submitted via forms.
  • Fiscal data (Mexican RFC, business name, address, ZIP code, CFDI use code) when you request a Mexican deductible receipt.
  • Donation transaction data (amount, date, method) processed by Stripe.
  • Browsing data: IP, device type, page views (via cookieless privacy-first analytics).

3. Sensitive data

The Foundation does not collect sensitive personal data (race, health, sexual life, ideology, religion, political opinions, or preferences). Card data is handled directly by Stripe and never reaches our servers.

4. Purposes

4.1 Necessary purposes

  • Respond to information, contact, volunteer, or partnership requests.
  • Process donations and issue the corresponding Mexican CFDI tax receipt.
  • Comply with Mexican tax obligations (Income Tax Law Art. 27) and transparency duties (Art. 82.VI).
  • Maintain operational records.

4.2 Secondary purposes (you may opt out)

  • Send the quarterly newsletter with program updates, cohorts, and partners.
  • Invite you to events, annual report presentations, and hub visits.
  • Publicly recognize your donation (sponsor lists, hub walls) — always with prior express consent.

To opt out of any secondary purpose, write to privacidad@fundacionhd.org with your name, email, and the specific purposes. Processed within 5 business days.

5. Refusal mechanisms

Each form includes an explicit consent checkbox. Each newsletter email includes a one-click unsubscribe link. For specific opt-outs, write to the privacy email above. Refusal does not condition access to public site information.

6. Third-party data transfers

Data may be transferred to the following providers strictly for site operation. None use it for purposes other than contracted:

  • Stripe Payments Inc. (USA) — donation processing and payment receipts. Privacy policy.
  • Buttondown (USA) — newsletter management with double opt-in. Privacy policy.
  • Resend Technologies (USA) — transactional emails. Privacy policy.
  • Netlify (USA) — hosting, CDN, serverless functions. Privacy policy.
  • Plausible Insights OÜ (Estonia, EU) — privacy-first analytics without individual tracking cookies. Privacy policy.
  • Facturama (Mexico) — Mexican CFDI issuance via SAT-authorized PAC.

The Foundation does not sell or share personal data for external marketing. Aggregated, anonymized data may be reported to strategic partners in impact reports.

7. ARCO rights (Access, Rectification, Cancellation, Opposition)

You have the right to Access, Rectify, Cancel, or Oppose the processing of your data. To exercise: email privacidad@fundacionhd.org with:

  • Full name and email associated with your account or donation.
  • Identity document (national ID or passport) — scanned attachment.
  • Clear, precise description of the right exercised and data involved.
  • For rectification: documents proving the correct information.

We respond within 20 business days. If granted, the change executes within the next 15 business days. If denied, we provide written justification.

8. Consent revocation

You can revoke consent at any time using the same ARCO mechanism. Revocation is not retroactive on already-completed processing or legal obligations (e.g., 5-year CFDI retention).

9. Use limitations

You can specifically request not appearing on public sponsor lists, not being photographed during hub visits, or not receiving public recognition. These options are also handled via the privacy email.

10. Cookies and tracking

fundacionhd.org uses the minimum possible:

  • Strictly necessary cookies — language preference, cookie banner dismissal. Required; no consent needed.
  • Privacy-first analytics (Plausible) — aggregated page-view metrics with no per-person identifiers, no third-party cookies, no fingerprinting. LFPDPPP-compliant by design.
  • We do not use remarketing, advertising, or cross-site tracking cookies.

To disable cookies anytime, configure your browser. Site core functionality is not affected.

11. Updates to this notice

When this notice changes, the new version is published at this URL with an updated date. Substantive changes (new purposes or transfers) are notified by email to active newsletter subscribers at least 15 calendar days before they take effect.

12. Last updated

Effective from: 2026-05-15.

Supervisory authority. Since March 20, 2025, private-sector data protection in Mexico is supervised by the Secretaría Anticorrupción y Buen Gobierno (SABG); INAI no longer holds this competence. The substantive law (LFPDPPP) remains in force.