1. Who is responsible for your data
2. What personal data we collect
We collect data you give us directly, data generated when you use our services and data collected automatically when you visit the site:
- Assessment, contact and quote forms: name, email, phone or WhatsApp, company, role, website, industry, the challenge or service you are interested in and the date and time you choose for a call.
- Newsletter and events: name, email and the event you register for.
- Black Spot Academy account: name, email, password (stored encrypted; nobody on the team can see it) and, optionally, WhatsApp and company. We also store your progress, notes, exercise and quiz answers, and the rating you give to courses.
- Course payments: payments are processed by Stripe. We do not receive or store your card details. We only keep the course, amount, method (card or OXXO), payment status and the identifiers Stripe gives us to confirm it.
- Job and internship applications: name, email, WhatsApp, city, area and role of interest, links to your CV and portfolio, expected monthly salary and what you tell us about yourself.
- Browsing: IP address, device and browser type, pages visited, source of the visit (for example, the ad or campaign you came from) and cookie identifiers, as described in section 6.
We do not collect sensitive personal data. Please do not include it in free-text fields. If it were necessary to process it while working with you, we will ask for your express written consent.
3. What we use your data for
Necessary purposes
These are the purposes that give rise to our relationship with you:
- Respond to your requests, schedule and run assessments, and send you proposals and quotes.
- Provide and follow up on the services you hire.
- Create and manage your Academy account, give you access to courses, save your progress and issue certificates.
- Process payments, confirm purchases and, where applicable, issue invoices.
- Register you for the events you choose and send you the information to attend.
- Evaluate your application, contact you during the hiring process and, if you move forward, start your hiring.
- Keep the site secure, prevent fraud and comply with legal obligations.
Additional purposes
These are not necessary for the service, but help us serve you better:
- Send you our newsletter, content, event invitations and course and service news.
- Measure and improve our campaigns, the site and the courses, including personalized advertising on other platforms.
- Invite you to satisfaction surveys.
4. Who we share your data with
We do not sell your personal data. To operate, we use providers that process data on our behalf and under our instructions (processors). Some may store it outside Mexico:
- Infrastructure and hosting for the site and our databases.
- Our CRM, where we log and follow up on requests, prospects and applications.
- Stripe, to process card and OXXO payments.
- Email and messaging services.
- Google and Meta, for analytics and campaign measurement, as described in section 6.
We will only share your data with third parties other than these providers when the law allows it without your consent (for example, at the request of a competent authority) or when you give us your consent.
5. How long we keep your data
6. Cookies and tracking technologies
We use cookies and similar technologies to make the site work, remember your Academy session, understand how the site is used and measure our campaigns. We may use Google Tag Manager, Google Analytics, Google Ads and the Meta pixel and Conversions API, which collect browsing data automatically.
You can block or delete cookies in your browser settings. If you block necessary cookies, some features, such as logging in to Academy, may not work.
7. Your ARCO rights
You have the right to know what data we hold and how we use it (access), to ask us to correct it if it is inaccurate or incomplete (rectification), to ask us to delete it when you believe it is not used lawfully (cancellation) and to object to its use for specific purposes (opposition).
See the requirements, timelines and the form to exercise them on our ARCO rights page.
8. Withdrawing consent or limiting the use of your data
You can withdraw the consent you gave us or ask us to limit the use or disclosure of your data through the same channel as ARCO rights. In some cases we may not be able to process your request immediately because a legal obligation requires us to keep processing your data, or withdrawal may mean we can no longer provide a service.
You can also register with the Public Registry to Avoid Advertising of Mexico's Federal Consumer Protection Agency (PROFECO).
9. Security
We apply administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing. For example: encrypted connections, encrypted passwords and access to the CMS and CRM only for authorized staff.
10. Minors
Our services are intended for adults. We do not knowingly collect data from minors. If you are a parent or guardian and believe a minor gave us their data, write to us to delete it.
11. Changes to this notice
We may update this notice due to changes in the law, our services or our practices. We will publish the current version on this page with its last updated date.