Privacy Notice

Last updated: 9 October 2026

Language note. This English version is provided for the convenience of our international clients. The Spanish version is the legally governing text and prevails in the event of any discrepancy, as required under Mexican consumer and data protection law.

This Privacy Notice is issued in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP"), its Regulations and applicable guidelines.

1. Identity and address of the data controller

STARVAV, S.A. de C.V. (hereinafter "GesMexa", "we" or "the Controller"), Mexican tax ID (RFC) STA2508139S7, with registered address at Calle Tehuacan Sur 60, Interior 1006, Colonia La Paz, postal code 72160, Heroica Puebla de Zaragoza, Puebla, Mexico, is responsible for the processing of your personal data under this Notice.

Email: hola@gesmexa.com
WhatsApp: +52 983 300 0510 · WhatsApp
Website: gesmexa.com

2. Personal data we collect

For the purposes described below, we may collect the following categories of personal data:

Identification data: full name, date of birth, nationality, CURP, RFC, official identification documents.
Contact data: telephone number, email address, postal address.
Tax data: tax regime, standing before the SAT, electronic signature (e.firma), SAT password, tax returns, invoices issued and received, compliance opinions.
Financial and asset data: income, expenses, bank statements, tax assessments, liens and seizures.
Employment and professional data: occupation, line of business, headcount.
Immigration data (where applicable): passport, migration forms, residency status, history of stay in Mexico.
WhatsApp communications data (when you message us there): your phone number, your profile name and the content of the messages and files you send us. These conversations are kept in our client management system so we can follow up on your enquiry.

We do not collect data classified as sensitive under the LFPDPPP, save for those strictly necessary to deliver the service (tax and asset data), which receive reinforced protection.

3. Purposes of processing

Primary purposes (necessary for the service):

Providing the contracted tax defence, accounting, company formation, immigration and nationality services.
Monitoring your Buzón Tributario (the SAT's electronic mailbox) and representing you before tax and judicial authorities.
Preparing tax assessments of your situation, administrative appeals, amparo claims and other legal filings.
Invoicing, collection and accounting administration.
Complying with legal obligations under the LFPDPPP, the Federal Tax Code, anti-money-laundering legislation and the Amparo Law.
Handling enquiries, complaints and requests.

Secondary purposes (not necessary for the service):

Sending commercial communications about new services, educational content and promotions.
Quality and service improvement surveys.
Producing anonymised internal statistics.

If you do not wish your data to be processed for secondary purposes, you may say so by writing to hola@gesmexa.com. Refusing secondary processing will not affect the services you have contracted.

4. Transfers of data

Your personal data may be transferred without requiring your consent in the cases contemplated by the LFPDPPP, namely:

To tax authorities (SAT), administrative courts (TFJA) or judicial authorities (the Federal Judiciary) where necessary for the legal representation you contracted.
To technology service providers (hosting, case management platforms, artificial intelligence tools) acting as data processors under confidentiality agreements.
To Meta Platforms, Inc. and WhatsApp LLC (United States), which provide the WhatsApp Business messaging service that carries the conversations you start with us on that channel.
To external collaborating attorneys assigned to your matter, bound by professional secrecy.
To competent authorities where legally required.

5. Your ARCO rights

Under Mexican law you have the right to Access your personal data, to have it Rectified where inaccurate or incomplete, to have it Cancelled where you consider it is not being processed in accordance with the law, and to Object to its processing for specific purposes. These are collectively known as ARCO rights.

To exercise them, send a request to hola@gesmexa.com including your name and contact details, a copy of an official identification document, a clear description of the data concerned and the right you wish to exercise, and any documents supporting your request. We will respond within the periods established by the LFPDPPP.

You may also revoke your consent to the processing of your data at any time, bearing in mind that in some cases revocation may end the provision of the contracted service, and that we may be required to retain certain data to comply with legal obligations.

6. Security of your data

Your information is transmitted over an encrypted connection (HTTPS/TLS) and stored with encryption at rest. Only personnel assigned to your matter have access, subject to a professional duty of confidentiality.

Your electronic signature and SAT passwords are stored with end-to-end encryption and can be revoked at any time.

7. Cookies and tracking technologies

Our website uses cookies and similar technologies that are strictly necessary for its operation (session and preference cookies) and, with your consent, analytics cookies that help us understand how the site is used so we can improve it. You can disable cookies from your browser settings, although some functions may then stop working correctly.

8. Changes to this Privacy Notice

GesMexa reserves the right to amend this Privacy Notice. Any change will be published on this page with the date of the latest update. For material changes we will notify you by email at least 30 days before they take effect.

9. Data protection authority

If you consider that your right to the protection of personal data has been infringed, you may approach Mexico's federal data protection authority, the Secretaría Anticorrupción y Buen Gobierno. Details are published in the Spanish version of this Notice, which is kept current.

10. Related documents

See also our Legal Notice and our Terms and Conditions.

By using our services or the gesmexa.com website you confirm that you have read, understood and accepted the terms of this Privacy Notice.