Privacy notice: what your website must include

If your website has a contact form, a WhatsApp button, a chat widget or simply uses cookies, you are collecting personal data — and Mexican law requires you to disclose it properly through a privacy notice.

What is a privacy notice?

It is the document through which you tell people what data you collect, what you use it for, who you share it with and how they can exercise their rights over it. It is not decorative text: it is a legal obligation for anyone processing personal data in Mexico.

The elements that cannot be missing

Although every business needs a tailored document, a complete privacy notice generally includes:

• Identity and address of the controller — who is collecting the data.
• Data collected — contact details, browsing data, financial data, and so on.
• Purposes of processing — separating the necessary ones from secondary purposes such as marketing.
• Transfers — whether the data is shared with third parties, and why.
• Means to exercise ARCO rights — access, rectification, cancellation and objection.
• Use of cookies and tracking technologies — what they collect and how to disable them.
• Changes to the notice — how they will be communicated.

Full, simplified and short versions

Not all notices are the same: there are full versions (the complete document, typically on the website), simplified and short versions, depending on the channel through which the data is collected. A well-built website usually combines more than one.

Common mistakes we see

1. Copying another business’s notice — the purposes and transfers never match, and a notice that does not reflect your actual operation offers you no protection.
2. Publishing it and forgetting it — if you change suppliers, tools or purposes, the notice must be updated.
3. Ignoring cookies — advertising tracking is data processing too.
4. Having no real channel for ARCO rights — the email address you list must exist and be monitored.

Does your site comply? At SPL we draft privacy notices, terms and conditions and cookie policies tailored to your digital business model. Get in touch and we will review it together.