This English version is provided for convenience. In the event of any discrepancy, the Spanish version of this notice (Aviso de Privacidad) shall prevail.
1. Identity and address of the data controller
Keystone Labs ("Keystone Labs" or the "Controller"), with its address for receiving notices in Mexico City, Mexico, and website https://keystonelabs.dev, is responsible for the processing of your personal data under the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (the "Law"), its Regulations and the Privacy Notice Guidelines.
For any matter related to this Privacy Notice, you may contact us at contact@keystonelabs.dev, handled by the team responsible for personal data protection at Keystone Labs.
2. Personal data we collect
We may collect the following categories of personal data, either directly (when you provide it to us by email, forms or while contracting our services) or indirectly (through our website):
- Identification and contact data: full name, company or organization, job title, email address and phone number.
- Commercial and billing data: legal name, tax ID (RFC), tax address, CFDI usage and data required to issue tax receipts.
- Technical browsing data: IP address, browser type, operating system, pages visited and date and time of access, collected through server logs and similar technologies.
- Information contained in communications: the content of the messages you send us, including reports addressed to security@keystonelabs.dev.
Keystone Labs does not collect sensitive personal data (ethnic origin, health status, religious beliefs, union membership, sexual preference, among others) through its website, nor does it request such data to provide its services. Please refrain from sending us data of this nature.
3. Purposes of processing
Primary purposes (necessary for the legal relationship)
- Responding to your requests for information, quotes or contact.
- Entering into, performing and fulfilling software development, maintenance and support service agreements.
- Issuing invoices and tax receipts, and carrying out the corresponding collection.
- Managing access to systems, environments and deliverables during project execution.
- Handling security reports, incidents and requests related to personal data protection.
- Complying with legal, tax and regulatory obligations applicable to the Controller.
Secondary purposes
- Sending you information about Keystone Labs services, news and commercial communications.
- Preparing internal statistics and service quality studies.
If you do not wish your personal data to be processed for the secondary purposes, you may state so at any time by sending an email to contact@keystonelabs.dev with the subject line "Opt-out of secondary purposes". Refusal will not be grounds for denying you the services you request or contract with us.
4. Transfers of personal data
Your personal data will not be transferred to third parties without your consent, except in the cases provided for in Article 37 of the Law, including:
- Where the transfer is required by competent authorities, in exercise of their powers and duly founded and motivated.
- Where it is necessary to fulfill obligations arising from a legal relationship between you and the Controller.
- Where it involves companies of the same corporate group as the Controller operating under the same privacy policies.
Keystone Labs hosts information in a data center located on Mexican territory. Where data processors are engaged (vendors processing data on behalf of the Controller), they are contractually bound to maintain confidentiality and to process the data solely in accordance with Keystone Labs' instructions and the provisions of the Law.
5. Security measures
Keystone Labs has implemented administrative, technical and physical security measures aligned with the international standard ISO/IEC 27001 to protect your personal data against damage, loss, alteration, destruction or unauthorized use, access or processing, including but not limited to: encryption of information in transit and at rest, least-privilege access control, audit logs, periodic backups and continuous staff training.
6. ARCO rights and how to exercise them
You have the right to Access your personal data, Rectify it when it is inaccurate or incomplete, Cancel it when you consider it is not required for any of the purposes stated, and Object to its processing for specific purposes ("ARCO" rights), as well as to revoke the consent you have granted us.
To exercise these rights, send a request to contact@keystonelabs.dev with the subject line "ARCO Request", containing:
- The data subject's full name and an email or physical address to receive the response.
- A document proving your identity (valid official ID) or, where applicable, the legal representation of the data subject.
- A clear and precise description of the personal data regarding which you seek to exercise any of the ARCO rights.
- Any element or document that facilitates locating the personal data.
We will respond within a maximum of 20 business days from receipt of your request and, if applicable, will make it effective within the following 15 business days after communicating our response, in accordance with the timeframes set forth in the Law.
7. Revocation of consent and limitation of use or disclosure
You may revoke the consent you have granted us for the processing of your personal data, and request the limitation of its use or disclosure, through the same procedure described in the previous section. Please note that we may not be able to fulfill your request immediately in all cases, as certain legal obligations may require us to continue processing your personal data.
8. Use of cookies and similar technologies
Our website uses only strictly necessary technical cookies for its operation and server logs for security and statistical purposes. We do not use third-party advertising cookies or tracking technologies for commercial purposes. You may disable cookies in your browser settings; doing so does not prevent you from browsing the site.
9. Changes to this Privacy Notice
This Privacy Notice may be modified, changed or updated as a result of new legal requirements, our own needs regarding the services we offer, our privacy practices or other causes. We are committed to keeping you informed through this same page: https://keystonelabs.dev/en/privacy-notice.html, indicating the date of last update at all times.
10. Data protection authority
If you believe your right to personal data protection has been infringed by any conduct or omission on our part, or you presume any violation of the provisions of the Law, its Regulations and other applicable rules, you may file a complaint before the Mexican guarantor authority for personal data protection. For more information, please visit its official website.
11. Consent
By providing your personal data through any of our contact channels, you acknowledge that you have read and understood this Privacy Notice and consent to the processing of your personal data for the purposes described herein.