At Faya & Associates, we work with information entrusted to us by our clients. Protecting it is not just a formality: it's part of our responsibility. This notice explains, clearly and simply, what personal data we process, what we use it for, who we share it with, and how you can make decisions about it.
1. Who is responsible for your data
Faya & Associates, SC (hereinafter, the Firm), with address at Av. Homero 136-Piso 4, Polanco, Miguel Hidalgo, 11560, Mexico City, is responsible for the processing of the personal data that you provide to us or that we obtain as a result of our professional relationship.
This notice is issued in accordance with articles 14 to 17 of the Federal Law on the Protection of Personal Data Held by Individuals, published in the Official Gazette of the Federation on March 20, 2025.
2. Who is it addressed to?
This notice applies to individuals whose data we process in connection with the professional relationship:
-
Clients who contract our services.
-
Prospects: people who contact us to explore a matter, including those who write through our website form.
-
Representatives, agents, advisors, officers and contact persons designated by clients that are legal entities.
An important clarification regarding our practice: much of the information we handle pertains to legal entities—market figures, corporate structures, business documents—and does not constitute personal data. This notice applies only to information concerning identified or identifiable natural persons.
3. What data do we process
Depending on the type of relationship and the issue at hand, we can address the following categories:
-
Identification and contact: name, signature, position, email, telephone and address.
-
Professional information: company or institution, position, area, career relevant to the matter.
-
Tax and billing information: RFC, tax status certificate, tax address and account details from which payments are made.
-
Financial or asset information: only when the matter requires it—for example, shareholdings, income, operating figures, or information about a transaction. This information requires your explicit consent.
-
Data contained in the file: the information you provide to us and that which is generated during the handling of the matter, including communications, documents and actions before authorities.
SENSITIVE DATA
As a rule, we do not collect or process sensitive personal data. If a matter were to require it, we would inform you and obtain your express written consent, through a handwritten signature, electronic signature, or the corresponding authentication mechanism, in accordance with Article 8 of the Law.
4. What we use your data for
FINALIDADES NECESARIAS
Sin estas finalidades no podemos prestarte el servicio ni cumplir nuestras obligaciones legales:
-
Evaluar, aceptar y prestar los servicios jurídicos y de consultoría contratados, incluida la representación ante autoridades administrativas y tribunales.
-
Verificar tu identidad y revisar conflictos de interés antes de aceptar un asunto.
-
Integrar, conservar y resguardar el expediente del asunto.
-
Facturar, cobrar y llevar la contabilidad de la Firma.
-
Cumplir obligaciones legales a cargo de la Firma, incluidas las fiscales, la atención de requerimientos de autoridad competente y, cuando el servicio encuadre en la fracción XI del artículo 17 de la Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita, las obligaciones de identificación y presentación de avisos que ese ordenamiento impone.
-
Atender tu solicitud de contacto y responder consultas preliminares, incluso si la relación profesional no llega a formalizarse.
-
Atender, ejercer y defender reclamaciones vinculadas a nuestros servicios.
FINALIDADES ADICIONALES
No son necesarias para la relación profesional. Puedes negarte a ellas sin que eso afecte en nada el servicio que recibes:
-
Enviarte nuestras publicaciones, columnas, análisis y alertas regulatorias.
-
Invitarte a eventos, seminarios y sesiones de trabajo de la Firma.
-
Conocer tu opinión sobre la calidad del servicio.
-
Referir el asunto en las credenciales de la Firma y en procesos de evaluación de directorios jurídicos, respecto de información que no sea pública y previo tu consentimiento específico.
How to opt out. Write to us at informes@faya.associates with the subject line "Additional Purposes," or use the unsubscribe link included in each email. You can do this at any time, before or after the professional relationship begins.
5. On what legal basis do we process your data
Tacit consent. As a general rule, if we make this notice available to you and you do not state otherwise, we understand that you consent to the processing described (Article 7 of the Law).
Express consent. Financial or asset data requires that you express your will: verbally, in writing, electronically, or through unambiguous signs.
Express written consent is required for sensitive data, under the terms already indicated.
Processing without consent. We do not need your consent when a legal provision so provides, when the data is contained in publicly accessible sources, when it is subject to a prior dissociation procedure, when it is required to exercise a right or fulfill obligations arising from the legal relationship with you, or when there is a court order or a reasoned mandate from a competent authority (Article 9 of the Law).
Revocation. You may revoke your consent at any time, without retroactive effect, through the same procedure established for ARCO rights. Revocation does not apply to data that is essential to complete an ongoing order or to data that we are legally required to retain.
6. Confidentiality and professional secrecy
The protection of your data is in addition to—not a substitute for—the professional secrecy that governs the practice of law. Every professional is obligated to strictly maintain the confidentiality of matters entrusted to them by their clients, except for reports that are mandatory under the law (Article 36 of the Regulatory Law of Article 5 of the Constitution, relating to the practice of professions in Mexico City).
Regarding personal data, the Firm maintains administrative, technical, and physical security measures to protect your information against damage, loss, alteration, destruction, or unauthorized access, and establishes controls to ensure that everyone involved in any phase of processing—partners, lawyers, advisors, administrative staff, and suppliers—maintains confidentiality (Articles 18 and 20 of the Law). If a security breach occurs that significantly affects your property or moral rights, we will inform you immediately.
7. Who we share your data with
SUPPLIERS WHO PROCESS DATA ON OUR BEHALF
We use email, cloud storage, billing, and IT security providers who process data on our instructions and under contractual confidentiality obligations. These transfers do not require your consent because these providers do not act on their own behalf.
TRANSFERS
We may transfer your data, to the extent that the matter requires, to:
-
Firm advisors, external lawyers, correspondents in Mexico or abroad, economists, experts and notaries who intervene in your case.
-
Competent administrative and judicial authorities, when necessary for the handling of the matter or when there is a duly founded and motivated request.
-
Accountants and auditors, for the fulfillment of the Firm's tax and accounting obligations.
Most of these transfers fall under the provisions of Article 36 of the Law—fulfillment of a legal relationship with you, a contract entered into in your interest, defense of a right in legal proceedings, or a legal requirement—and therefore do not require your consent. For those that do require your consent, you have the option to deny it.
8. Your rights regarding your data
You may exercise your rights of access, rectification, cancellation, and objection (ARCO Rights) at any time:
-
Access: To know what personal data we hold about you and the conditions under which we process it.
-
Rectification: To correct your personal data when it is inaccurate, incomplete, or outdated.
-
Cancellation: To request that your personal data be removed from our possession, subject to the applicable prior blocking period.
-
Objection: To object to the processing of your personal data on legitimate grounds, or when your data is subject to automated decision-making that produces unwanted legal effects or significantly affects your interests.
HOW TO EXERCISE YOUR RIGHTS
Send your request to informes@faya.associates. Your request must include:
-
Your name and address, or any other means by which you can receive our response.
-
Documents proving your identity or, where applicable, the identity and legal authority of your representative.
-
A clear and precise description of the personal data to which your request relates, unless you are exercising your right of access.
-
The right you wish to exercise or the specific action you are requesting.
-
Any information or documentation that may help us locate your personal data.
If you are requesting rectification, you must also specify the changes to be made and provide supporting documentation for your request.
TIMEFRAMES AND COSTS
We will inform you of our decision within twenty business days following receipt of your request. If your request is granted, we will implement the decision within the following fifteen business days. Both timeframes may be extended once for an equal period when justified by the circumstances of the case. We will notify you of any such extension.
Exercising these rights is free of charge. We may only charge for the costs of reproduction, copies, or delivery. If you provide the means to reproduce the data, delivery will be free of charge.
We may deny your request to exercise these rights in the circumstances provided for by law, including, among others, when your identity has not been duly verified, when the personal data is not in our possession, when granting the request would infringe upon the rights of a third party, when a legal impediment exists, or when the request has already been addressed. In all cases, we will inform you of the reasons for our decision.
9. How long do we keep your data
Conservamos tus datos durante la vigencia del encargo y, una vez concluido, por el plazo necesario para atender las responsabilidades derivadas de la relación profesional y para cumplir las obligaciones de conservación que impone la legislación fiscal y contable, que actualmente es de cinco años. [Plazo por confirmar.]
Cumplida la finalidad y agotados esos plazos, los datos se suprimen previo bloqueo. Durante el bloqueo, los datos se conservan únicamente para determinar posibles responsabilidades relacionadas con su tratamiento y no son objeto de tratamiento alguno.
10. Sitio web, cookies y comunicaciones electrónicas
Our website www.faya.associates uses cookies and similar technologies. Strictly necessary cookies allow the site to function; measurement cookies help us understand which content is useful. You can disable them in your browser settings, but please note that some features may stop working.
When you write to us through the contact form or subscribe to our publications, we process the data you provide to respond to your message and, if you authorize it, to send you content from the Firm.
11. Changes to this notice
We may modify this notice to reflect changes to our services, practices, or applicable law. The current version will always be available at faya.associates/privacy-notice, along with the date of the last update. When the change is substantial—such as a new purpose or a different type of data transfer—we will notify active customers and those who have provided their email address to us.
12. Competent Authority
If you believe your right to personal data protection has been violated, or that the processing of your data violates the law, you can contact the Secretariat of Anti-Corruption and Good Governance, the authority responsible for ensuring compliance. Before doing so, we would appreciate it if you would allow us to address your concern directly.