01
Who we are
The data controller is XALA Studio, an independent digital design and development studio based in Tijuana, Baja California, Mexico.
Legal name
XALA Studio
Address
Tijuana, Baja California, Mexico
Email
Phone
+52 664 107 1133
This document explains what personal data we handle, why we use it, and how you can exercise your rights. We are a Mexican studio, governed by Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). Where you sit in the US or EU, we've drafted this to be transparent under CCPA and GDPR concepts too.
The data controller is XALA Studio, an independent digital design and development studio based in Tijuana, Baja California, Mexico.
We collect only what's needed to serve you. We do not collect sensitive data (race, health, beliefs, sexual life, biometric data, bank account numbers).
Categories we collect (CCPA framing): identifiers (name, email, phone, IP), commercial information (services purchased), internet activity (site usage), professional information (your role, company). Sources: directly from you (forms, email, calls) and automatically from your browser when you visit our site. Sale or share: we do not sell or share your personal information for cross-context behavioral advertising.
To opt out of any secondary purpose, email hola@xala.studio with subject "Opt out — secondary purposes". We action it within five business days.
Under Mexican law (LFPDPPP, March 20, 2025) we rely on your consent (express for secondary purposes, tacit-by-conduct for primary purposes) and on the necessity of processing to perform our contract with you.
For EU/UK clients reading this through a GDPR lens, our bases are: contract (Art. 6(1)(b)) for service delivery, legitimate interest (Art. 6(1)(f)) for security and limited analytics, legal obligation (Art. 6(1)(c)) for tax and accounting, and consent (Art. 6(1)(a)) for marketing.
We do not sell your data. We don't share it for commercial purposes outside the service. We do use service providers to operate, each acting under our instructions and their own privacy policies:
Under Mexican law (LFPDPPP) you have four ARCO rights — and equivalents under CCPA (California) and GDPR (EU/UK):
For US/EU clients we also honor the equivalent of data portability (a copy in a structured format) and non-discrimination for exercising any of these rights.
Email hola@xala.studio with subject "Privacy rights request". Include:
Response times: Mexican law gives us 20 business days to respond and 15 more to execute. We do our best to match or beat the equivalent CCPA (45 days) and GDPR (one month) windows. No fee, except justified shipping or reproduction costs.
You can withdraw consent at any time. Email hola@xala.studio with subject "Withdraw consent". Withdrawal is not retroactive and doesn't apply to primary purposes needed for an active contract or legal obligation.
To stop commercial communications, email hola@xala.studio with subject "Limit use". We add you to our internal suppression list within five business days. Every newsletter has a one-click unsubscribe link.
Our site uses cookies and similar technologies to function and to measure aggregate use.
You can block or delete cookies in your browser settings. If you do, parts of the site may not work.
We apply reasonable administrative, technical, and physical safeguards to protect your data — TLS in transit, repository access controls, two-factor authentication on critical accounts, encrypted backups.
Retention:
After that, data is deleted or anonymized.
We're based in Mexico. Most of our processors are in the United States. By engaging us, you understand that your data may be processed in Mexico, the United States, and (depending on the processor) other jurisdictions.
For EU/UK clients we rely on the processor's own transfer safeguards (Standard Contractual Clauses where applicable). For California clients, see the CCPA-framed disclosures throughout.
Our services are for businesses and professionals. They're not directed at children, and we don't knowingly collect data from anyone under 16. If you believe a child has submitted data, email us and we'll delete it.
We may update this notice. The current version always lives at xala.studio/privacy with the last-updated date at the top. Material changes get emailed to active clients and subscribers at least 30 days in advance.
The Mexican data protection authority is the Secretaría Anticorrupción y Buen Gobierno, which took over from the former INAI under the 2025 LFPDPPP reform.
If you think your privacy rights were violated, please contact us first. If we don't satisfy your request, you may file a complaint with the competent authority (or, for EU residents, your local supervisory authority; for California residents, the California Privacy Protection Agency).
Related documents: Terms of Service · Versión en español