LEGAL

Privacy Notice

Data controller. Whalora LLC, a limited liability company organized under the laws of the State of Florida, United States of America (document number L23000353151), operating in Mexico, is responsible for the processing of the personal data you provide through this site. Its domicile for the purposes of this notice is the State of Florida, United States of America, and the channel to reach it is the contact form on this site.

Last updated: August 31, 2026. This version supersedes any earlier one.

1. Personal data we collect

This site collects only the data you choose to provide in the contact form:

• Name.
• Company or organization name.
• The message you write.
• The contact methods you add: telephone numbers and email addresses, together with your preferred contact mechanism (call, WhatsApp, iMessage or Telegram) and which one you prefer.

No field is required except your name and at least one contact method. We do not collect sensitive personal data, nor financial, asset or health data, nor biometric data, nor precise geolocation.

Minors. This site is addressed to adults acting in a professional capacity. We do not knowingly collect data from children under thirteen, in line with the Children's Online Privacy Protection Act, nor from minors under Mexican law. If we find that we have received a minor's data, we delete it. If you are a parent or guardian and believe a minor sent us data, ask us to delete it through the channel in section 8 and we will do so without further formality.

The site also automatically records technical browsing data described in section 6.

2. Purposes of processing

Primary purposes, necessary for our relationship with you:

• Responding to your contact request through the method you chose.
• Assessing whether we can address the matter you raise and, where appropriate, preparing a service proposal.
• Following up on the communication you initiated.

Secondary purposes, which are not necessary and which you may object to:

• Internal statistics on the origin and type of requests received.

If you prefer that your data not be used for secondary purposes, say so in your message or request it later through the channel in section 8. Your refusal does not prevent us from handling your request and does not lead to different treatment.

We do not use your data for targeted advertising, for profiling that produces legal or similarly significant effects, or for automated decision-making. No reply to your request is generated automatically without human involvement.

3. Processors and transfers

We do not sell personal data and we do not share it with third parties for their advertising or direct marketing. Specifically, for the purposes of California Civil Code § 1798.83 (Shine the Light), we do not disclose personal data to third parties for those third parties' own direct marketing purposes.

Processors. The following providers process data on behalf of and under the instruction of Whalora LLC. Under Mexican law, passing data to a processor is not a transfer and does not require your consent:

• Hostinger International Ltd. — site and corporate email hosting. Form data is stored on this infrastructure.
• Microsoft Corporation — email service through which the notice of your request is received.

Transfers. The following third parties receive data and process it under their own policies:

• CallMeBot — service that delivers a WhatsApp notification to the controller when a request arrives. The notice of a new request is transmitted to this service, together with the minimum data needed to identify it.
• Google LLC — site audience measurement and font delivery, as described in section 6.

Right to refuse a transfer. If you do not want your data transferred to the third parties named above, say so at the start of your message with the phrase “I do not authorize transfers”, or request it later through the channel in section 8. We will handle your request through a channel that does not involve those third parties.

International transfer. As Whalora LLC is established in the United States, your data is processed and stored in that country and, depending on the provider, in other jurisdictions whose protection framework may differ from that of your country of residence. By submitting the form you consent to that international transfer. No additional consent is required in the cases provided for by applicable law, such as compliance with a legal obligation or a request from a competent authority.

4. Data retention

Contact request data is kept while there is a reasonable interest in the communication and, in any case, for a maximum of twenty-four months from the last contact, unless the relationship leads to a service engagement, in which case it is kept for the duration of that relationship and any applicable statutory retention periods. After those periods, the data is deleted. Aggregate audience records are kept for the period set by the measurement provider.

5. Security

The site runs over an encrypted connection (HTTPS). Access to the request log is restricted to the controller through credentials. Reasonable administrative, technical and physical safeguards are applied to protect data against loss, misuse, unauthorized access, disclosure or alteration. No security measure is infallible and absolute security of information transmitted over the internet cannot be guaranteed.

If a security breach were to occur that significantly affects your property or moral rights, we will notify you without delay so that you can take the measures you consider appropriate.

6. Cookies and tracking technologies

This site uses the following technologies:

• Language cookie (pll_language) — remembers whether you browse the site in Spanish or English. It is necessary for the site to work and cannot be disabled from the site.
• Google Analytics, by Google LLC — measures visits and browsing behavior in aggregate form. It sets its own cookies and records your IP address, device and browser type, pages viewed and traffic source.
• Google Fonts, by Google LLC — delivers the site typefaces. Requesting those typefaces transmits your IP address to Google.

Third-party tracking across sites. Google Analytics may collect information about your online activities over time and across third-party websites other than this one. Whalora LLC does not allow any other third party to carry out such tracking on this site.

Browser signals. This site does not currently respond to Do Not Track signals, as no uniform standard exists for their interpretation. It also does not process the Global Privacy Control signal: none is needed, because we do not sell or share personal data within the meaning given to those terms by United States state privacy laws, so there is no processing to opt out of.

You may block or delete cookies through your browser settings, and you may install the Google Analytics opt-out add-on. Blocking the language cookie may affect how the site is displayed.

7. Your rights

If you are in Mexico. You have the right to know what personal data we hold, what we use it for and the conditions of that use (access); to request correction when your information is outdated, inaccurate or incomplete (rectification); to ask that it be removed from our records when you consider it is not being used in accordance with applicable principles and duties (cancellation); and to object to the use of your data for specific purposes (objection). These are the ARCO rights. You may also withdraw your consent at any time and limit the use or disclosure of your data.

If you reside in the United States, and depending on your state law, you may have the right to know the categories of personal data collected, the sources they come from and the purposes of their use; to obtain a copy of that data; to request its correction or deletion; to opt out of sale or sharing and of targeted advertising; to limit the use of sensitive personal data; and not to be discriminated against for exercising these rights.

Whalora LLC does not sell or share personal data within the meaning given to those terms by state privacy laws, does not engage in targeted advertising or in profiling with legal effects, and does not collect sensitive personal data. Accordingly, the opt-out and limitation rights have nothing to operate on in this site.

We will handle your request free of charge. We may ask for reasonable information to verify your identity before responding. If you act through a representative or authorized agent, we will ask for proof of that authority.

8. How to exercise your rights

Send your request through the contact form available on this site, starting your message with “privacy request” and clearly describing which right you wish to exercise and over which data.

Deadlines. For requests under Mexican law, we respond within a maximum of twenty business days and, where the request is well founded, we give it effect within the following fifteen business days; both periods may be extended once for an equal period where the complexity of the request warrants it, which we will tell you. For requests under United States state laws, we respond within forty-five calendar days, extendable by a further forty-five with prior notice.

If you disagree. You may ask us to reconsider our response through the same channel. If you believe your data protection rights have been infringed, you may turn to the competent federal data protection authority in Mexico, or to the relevant state authority in the United States, including the California Attorney General for residents of that state.

9. Changes to this notice

This notice may be amended to reflect changes in our services, in the providers we use or in applicable law. Any amendment is published at this same address, with the last updated date shown at the top; material changes are flagged prominently for at least thirty days. We review this notice at least once every twelve months. We recommend reviewing it periodically.

10. Legal framework

This notice was drafted to comply simultaneously with the following bodies of law, to the extent each one applies:

• Mexico — Federal Law on the Protection of Personal Data Held by Private Parties and its Regulations, together with the privacy notice guidelines issued by the competent authority.
• California — California Online Privacy Protection Act (Cal. Bus. & Prof. Code §§ 22575-22579); California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.), whose application thresholds Whalora LLC does not meet and whose rights are acknowledged here as a reference; and Cal. Civ. Code § 1798.83 (Shine the Light).
• United States, federal — Children's Online Privacy Protection Act (15 U.S.C. §§ 6501-6506) and section 5 of the Federal Trade Commission Act, on deceptive practices.
• Florida — Florida Digital Bill of Rights. Whalora LLC does not meet the revenue threshold that makes it enforceable, so it does not apply; its principles are observed regardless.

This site is not directed at residents of the European Economic Area or the United Kingdom, and Whalora LLC does not offer goods or services in those territories nor monitor the behavior of their residents. If you are located there and wish to exercise rights over your data, write to us through the channel in section 8 and we will handle your request.

Where two frameworks grant different protections on the same point, we apply the one more protective of you.

← Back to the whalora.com home page