1. Who is responsible for your data
The data controller (responsable) is ARCII México, Inc. (“Grupo ARCII”), a company organized under the laws of the United Mexican States (Mexico), domiciled at Av. Javier Barros Sierra 495, Santa Fe, Álvaro Obregón, 01219 Ciudad de México, CDMX, Mexico (phone +52 (55) 5815 5456), operating the BitPixel and BitOne brands (“we”, “us”). Contact for any privacy matter, including exercising your rights: [email protected].
This policy is designed to meet the requirements of, among others, Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, published on March 20, 2025), the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA) and other U.S. state privacy laws, Brazil’s LGPD, Canada’s PIPEDA and the data-protection laws of Colombia, Peru, Chile, Argentina and Ecuador, to the extent each applies to us.
2. Scope — and data we process for our customers
This policy covers personal data we process for our own purposes: website visitors, prospects, BitOne account holders and their Authorized Users, people who contact us, and clients of our Professional Services.
It does not cover the data our customers store in BitOne about their own customers, suppliers, employees or document signers (“Customer Data”). For that information our customer is the controller and we act only as a processor (encargado) following their instructions under our Data Processing Addendum. If you are, for example, an employee of a BitOne customer or someone who received a document to sign, please contact that organization to exercise your rights; we will assist them.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identification and contact | Name, job title, company, business email, phone | You (forms, email, sign-up) |
| Account data | Username, hashed password, roles, branch, language preference, company legal name and tax ID | You and your administrator |
| Billing data | Plan, billing period, amount, currency, payment status and method type, transaction ID | You and Mercado Pago (we never receive full card numbers) |
| Technical and usage data | IP address, browser and device type, pages visited, timestamps, security and error logs | Automatically, from your device |
| Communications | Messages and support requests you send us | You |
| Professional Services data | Project requirements, credentials or test-environment access you provide | You |
We do not intentionally collect sensitive personal data (datos personales sensibles / special categories) for our own purposes. Please do not send it to us unless necessary.
4. Why we use your data and on what legal basis
Primary purposes — necessary for the relationship you have with us (finalidades primarias):
- Create and manage your BitOne account, provide the Services and customer support — performance of a contract.
- Process payments, issue receipts and keep accounting and tax records — contract and legal obligation.
- Keep the Services secure, prevent fraud and abuse, debug and maintain logs — legitimate interest and legal obligation.
- Send service communications (security alerts, renewal reminders, changes to terms) — contract.
- Answer requests and prepare proposals for Professional Services — pre-contractual steps.
- Comply with law, respond to authorities and defend legal claims — legal obligation and legitimate interest.
Secondary purposes — not necessary for the Services (finalidades secundarias):
- Send news, product updates and offers about BitPixel and BitOne — consent or, for existing customers where permitted, legitimate interest.
- Anonymous, aggregated statistics to improve our products — legitimate interest.
You can refuse or withdraw consent for secondary purposes at any time, without affecting the Services, by writing to [email protected] or using the unsubscribe link in our emails. We do not use automated decision-making that produces legal or similarly significant effects on you.
6. International transfers
We are based in Mexico, and our providers may process data in Mexico, the United States and other countries. When we transfer personal data from the EU/EEA, the UK or other jurisdictions with transfer restrictions, we rely on adequacy decisions where available or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), and we require recipients to protect the data to a standard equivalent to this policy.
7. How long we keep data
- Account data: while your account is active and for 90 days after cancellation, then deleted or anonymized.
- Billing and tax records: for the period required by tax and commercial law (in Mexico, generally 5 years; longer where another applicable law requires it).
- Security logs: up to 12 months, unless needed to investigate an incident.
- Prospects and contact requests: up to 24 months after our last interaction.
- Marketing: until you unsubscribe or withdraw consent.
When data is no longer needed it is deleted or anonymized; where Mexican law requires, it is first blocked (bloqueo) only to address potential liabilities during the applicable limitation period.
8. How we protect data
We apply administrative, technical and physical safeguards appropriate to the risk, including encryption in transit (HTTPS/TLS), hashed passwords, strict logical isolation between customer companies, role-based access controls, least-privilege access for our personnel, logging and backups. No system is completely secure; if a security breach significantly affects your rights, we will notify you and the competent authorities as required by applicable law.
9. Your rights
Depending on where you live, you may have the right to access your data, rectify it, delete it, object to or restrict certain processing, receive a portable copy, and withdraw consent at any time (without affecting prior processing).
How to make a request
Email [email protected] with the subject “Privacy request” and include: your name and contact details for our reply; a document proving your identity (or, for a representative, proof of representation); a clear description of the data and the right you wish to exercise; and any information that helps us locate the data. We will respond within the time limits set by the applicable law and may ask for additional information to verify your identity. Requests are free of charge, except for reasonable shipping or copying costs where the law allows.
Mexico
You may exercise your rights of Access, Rectification, Cancellation and Opposition (ARCO rights), revoke your consent and limit the use or disclosure of your data under the LFPDPPP. If you believe your rights have been violated, you may file a complaint with the competent data-protection authority (currently the Secretaría Anticorrupción y Buen Gobierno).
European Union, EEA and United Kingdom
In addition to the rights above, you have the right not to be subject to decisions based solely on automated processing and to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office).
California and other U.S. states
To the extent the CCPA or similar state laws (for example in Virginia, Colorado, Connecticut, Utah or Texas) apply, you have the right to know what personal information we collect and how we use and disclose it, to delete and correct it, and to opt out of its sale or sharing — which we do not do. We do not use sensitive personal information to infer characteristics. You may use an authorized agent, and we will not discriminate against you for exercising your rights. In the past 12 months we have collected the categories listed in Section 3 for the purposes in Section 4, and disclosed them only as described in Section 5.
Brazil, Canada and Latin America
Residents of Brazil (LGPD), Canada (PIPEDA), Colombia (Law 1581 of 2012), Peru (Law 29733), Chile (Law 19.628, as amended), Argentina (Law 25.326) and Ecuador (Organic Law on Personal Data Protection) may exercise the rights those laws grant and lodge complaints with their national data-protection authority.
10. Children
Our Services are intended for businesses and are not directed to anyone under 18. We do not knowingly collect personal data from minors; if you believe we have, contact us and we will delete it.
12. Changes to this policy
We may update this policy to reflect changes in our practices or the law. We will post the new version on this page with its effective date and, for material changes, notify account holders by email or within BitOne before they take effect.
13. Contact
Privacy requests and questions:
ARCII México, Inc.
Av. Javier Barros Sierra 495, Santa Fe, Álvaro Obregón, 01219 Ciudad de México, CDMX, Mexico
Phone: +52 (55) 5815 5456
Email: [email protected]