Legal

Privacy notice (LFPDPPP)

Last updated: August 28, 2026. Per Mexico's Federal Personal Data Protection Law (LFPDPPP). This is an informational translation; the Spanish version at /privacidad is the legally authoritative text.

1. Data controller

Fundación Corazón Raíz, A.C. ("FCR" or "the Foundation"), with Mexican Tax ID FCR220804IL9, fiscal address at Calle Teocelo 29, Col. Roma Sur, Cuauhtémoc, CDMX 06760, Mexico, is the controller of personal data collected through fundacionhd.org. Privacy contact: privacidad@fundacionhd.org.

2. Personal data we process

  • Identification data: name, email address, optional phone number, optional organization.
  • Voluntary contact data submitted via forms.
  • Fiscal data (Mexican RFC, business name, address, ZIP code, CFDI use code) when you request a Mexican deductible receipt.
  • Donation transaction data (amount, date, method) processed by Stripe.
  • Subscription data when the donation is monthly: amount, frequency, next charge date and status, administered by Stripe.
  • Browsing data: IP, device type, page views (via cookieless privacy-first analytics).

3. Sensitive data

The Foundation does not collect sensitive personal data (race, health, sexual life, ideology, religion, political opinions, or preferences). Card data is handled directly by Stripe and never reaches our servers.

4. Purposes

4.1 Necessary purposes

  • Respond to information, contact, volunteer, or partnership requests.
  • Process donations and issue the corresponding Mexican CFDI tax receipt.
  • Comply with Mexican tax obligations (Income Tax Law Art. 27) and transparency duties (Art. 82.VI).
  • Administer the monthly donation while it stays active: run each charge, record the renewal, and handle its cancellation.
  • Maintain operational records.

4.2 Secondary purposes (you may opt out)

  • Send the quarterly newsletter with program updates, cohorts, and partners.
  • Invite you to events, annual report presentations, and hub visits.
  • Publicly recognize your donation (sponsor lists, hub walls), always with prior express consent.

To opt out of any secondary purpose, write to privacidad@fundacionhd.org with your name, email, and the specific purposes. Processed within 5 business days.

5. Refusal mechanisms

Each form includes an explicit consent checkbox. Each newsletter email includes a one-click unsubscribe link. For specific opt-outs, write to the privacy email above. Refusal does not condition access to public site information.

6. Third-party data transfers

Data may be transferred to the following providers strictly for site operation. None use it for purposes other than contracted:

  • Stripe Payments Inc. (USA) · donation processing and payment receipts. For monthly donations it also retains your payment method while the subscription is active, which is what makes each month's charge possible. Privacy policy.
  • Buttondown (USA) · newsletter management with double opt-in. Privacy policy.
  • Resend Technologies (USA) · transactional emails. Privacy policy.
  • Netlify (USA) · hosting, CDN, serverless functions. Privacy policy.
  • Umami Software, Inc. (United States) · web analytics with no cookies, no per-person identifiers and no cross-site tracking. As with any third-party request, your IP address reaches their servers; it is not used to identify you or to build a profile. Privacy policy.
  • Facturama (Mexico) · Mexican CFDI issuance via SAT-authorized PAC.

The Foundation does not sell or share personal data for external marketing. Aggregated, anonymized data may be reported to strategic partners in impact reports.

7. ARCO rights (Access, Rectification, Cancellation, Opposition)

You have the right to Access, Rectify, Cancel, or Oppose the processing of your data. To exercise: email privacidad@fundacionhd.org with:

  • Full name and email associated with your account or donation.
  • Identity document (national ID or passport): scanned attachment.
  • Clear, precise description of the right exercised and data involved.
  • For rectification: documents proving the correct information.

We respond within 20 business days. If granted, the change executes within the next 15 business days. If denied, we provide written justification.

8. Consent revocation

You can revoke consent at any time using the same ARCO mechanism. Revocation is not retroactive on already-completed processing or legal obligations (e.g., 5-year CFDI retention).

9. Recurring monthly donations

A monthly donation is not a single charge. Stripe retains your payment method and runs a charge every month until you cancel it, so while the subscription is active your data is processed continuously rather than at a single point in time.

Concretely:

  • Stripe stores your payment method and the subscription data (amount, frequency, next charge date and status) for as long as it is active.
  • Each monthly charge creates a transaction record and an internal alert to the donations team with your name, your email and the amount.
  • The Foundation never stores your payment method.

How to cancel. Reply to your donation confirmation email, or write to donaciones@fundacionhd.org. No reason required. We cancel the subscription in Stripe and charges stop from that moment; charges already made are not reversed automatically, and if something went wrong, write to us and we will look into it.

Cancelling stops the charges and the processing tied to them. The record of donations already received is retained under the tax obligation described in the previous section.

10. Use limitations

You can specifically request not appearing on public sponsor lists, not being photographed during hub visits, or not receiving public recognition. These options are also handled via the privacy email.

11. Cookies and tracking

fundacionhd.org uses the minimum possible:

  • Strictly necessary cookies · language preference, cookie banner dismissal. Required; no consent needed.
  • Cookieless analytics (Umami) · aggregated page views, country and visit duration, with no per-person identifiers, no third-party cookies and no fingerprinting. Since nothing is stored on your device, it does not require your consent.
  • We do not use remarketing, advertising, or cross-site tracking cookies.

To disable cookies anytime, configure your browser. Site core functionality is not affected.

12. Updates to this notice

When this notice changes, the new version is published at this URL with an updated date. Substantive changes (new purposes or transfers) are notified by email to active newsletter subscribers at least 15 calendar days before they take effect.

13. Last updated

Effective from: 2026-08-28.

Supervisory authority. Since March 20, 2025, private-sector data protection in Mexico is supervised by the Secretaría Anticorrupción y Buen Gobierno (SABG); INAI no longer holds this competence. The substantive law (LFPDPPP) remains in force.