Comprehensive Privacy Notice
- Instrument
- Comprehensive privacy notice
- Version
- 2.2
- Effective date
- September 14, 2026
- Legal basis
- Articles 14, 15 and 16 of the Mexican Federal Law on Protection of Personal Data Held by Private Parties
- Authoritative language
- Spanish
- Supervisory authority
- Ministry of Anti-Corruption and Good Governance
This privacy notice is issued in compliance with Articles 14, 15 and 16 of the Mexican Federal Law on Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on 20 March 2025 and in force as of 21 March 2025 (the «Law»), and is made available to the data subject from the moment their personal data is collected.
IIDENTITY AND ADDRESS OF THE DATA CONTROLLER
1.1The party responsible for processing your personal data (the «Controller») is the commercial owner of the Billarisa brand.
1.2The Controller's name or corporate name, Federal Taxpayer Registry number and tax domicile are those stated in the Digital Tax Receipt issued for the purchase transaction and shall be communicated in writing to any data subject exercising the rights set out in this notice.
1.3The designated contact channels are the email address billarisaoficial@gmail.com and the website https://www.billarisa.com.
IIPERSONAL DATA DEPARTMENT
2.1Pursuant to Article 29 of the Law, the Controller designates as its personal data department the contact area reachable at billarisaoficial@gmail.com, which shall handle data subject requests.
IIIPERSONAL DATA PROCESSED
3.1Depending on the contact channel and the transaction involved, the Controller may process the following categories of data:
- a)Identification and contact data: name, email address, telephone number or instant messaging identifier.
- b)Establishment data: country, locality, number of tables and any other operational information provided by the data subject.
- c)Content of communications addressed by the data subject to the Controller through any enabled channel.
- d)Machine code or fingerprint (
machine_hash) of the device on which the Software is installed, which is indispensable for issuing and reissuing the license file. - e)Billing and payment data: that required by tax law or by the payment provider to process the transaction and issue the corresponding receipt.
3.2No sensitive personal data is collected. The Controller does not create databases containing data of that nature. Should an exceptional case require it, the express written consent required by Article 8 of the Law would be obtained.
3.3The financial or asset data referred to in section 3.1(e) is processed with the data subject's express consent, pursuant to Article 7 of the Law, unless one of the exceptions set out in Articles 9 and 36 applies.
IVSOURCE OF THE DATA
4.1Personal data is obtained directly from the data subject when they complete the contact form on the Website, write by email or instant messaging, place an order or request technical support.
4.2The Controller does not acquire third-party databases for prospecting purposes.
VPRIMARY PROCESSING PURPOSES
5.1Personal data is processed for the following purposes, which are necessary for the existence, maintenance and performance of the legal or pre-contractual relationship and therefore require no additional consent under Article 9, section IV, of the Law:
- a)to handle requests for demonstrations, quotes, information and technical support;
- b)to issue, reissue and keep records and control of the licenses granted;
- c)to verify compliance with the licensing conditions associated with the authorized device;
- d)to collect the price and, where applicable, issue the tax receipt;
- e)to comply with legal, accounting and tax obligations and to respond to requests from competent authorities;
- f)where applicable, to conduct the legal defense of the Controller's rights.
VISECONDARY PURPOSES AND OPT-OUT MECHANISM
6.1Additionally, and provided the data subject does not object, the Controller may process their data to send commercial information about products, versions, modules and promotions.
6.2This purpose is not necessary for the legal relationship. The data subject may object from this moment, or at any time thereafter, by sending a message to billarisaoficial@gmail.com with the subject line «Objection to secondary purposes».
6.3Objecting to secondary purposes shall not be grounds for refusing to handle requests or to provide the contracted services.
VIIPROCESSING OF THE ESTABLISHMENT'S DATABASE
7.1The operating database of the establishment (billar.db) resides on the data subject's device and is not systematically collected by the Controller.
7.2Access to that database shall occur solely at the data subject's express request, for backup or diagnostic purposes, and shall be limited to what is strictly necessary to handle the request.
7.3With respect to the personal data of customers and staff recorded by the establishment in that database, the owner of the establishment acts as data controller towards those persons and is responsible for issuing its own privacy notice and complying with the obligations imposed on it by the Law.
VIIITRANSFERS AND REMITTANCES
8.1The Controller may disclose personal data, strictly to the extent necessary, to the following recipients:
| Recipient | Purpose | Consent required |
|---|---|---|
| Website hosting and infrastructure providers | Technical operation of the site and its forms | No. They act as processors, not third parties |
| Financial institutions and payment processors | To process payment of the price | No. Article 36, section IV, of the Law |
| The Controller's accountant and professional advisors | Compliance with tax and accounting obligations | No. Article 36, section IV, of the Law |
| Competent authorities | Compliance with duly grounded requests | No. Article 36, section III, of the Law |
8.2Disclosures to processors constitute remittances rather than transfers and therefore require no consent from the data subject. Such processors are contractually bound to process the data solely on the Controller's instructions and to maintain confidentiality.
8.3The Controller does not sell, rent or assign its contact database.
8.4Apart from the cases listed above, no transfer shall be made without the data subject's consent. Should a different transfer be contemplated, the data subject shall be informed in advance through an update to this notice and their consent shall be obtained, communicating this notice and the purposes to which the data subject subjected the processing to the recipient, pursuant to Article 35 of the Law. If you do not wish your data to be transferred in such cases, you may say so at billarisaoficial@gmail.com.
8.5Processing outside Mexican territory. Some of the processors listed in section 8.1, in particular hosting and infrastructure providers and payment processors, may store or process the data on servers located outside the United Mexican States. In such cases the Controller undertakes to engage only providers that assume in writing the duty to process the data on its instructions, to maintain confidentiality and to keep security measures equivalent to those required by the Law. Such disclosure retains the character of a remittance rather than a transfer. The data subject may request from billarisaoficial@gmail.com the current list of these processors and the country in which they operate.
IXOPTIONS AND MEANS TO LIMIT USE OR DISCLOSURE
9.1The data subject may limit the use or disclosure of their personal data by the following means:
- a)a request to billarisaoficial@gmail.com, stating the scope of the limitation sought;
- b)a request to be included in the Controller's internal exclusion list, with the effect of no longer receiving commercial communications;
- c)for advertising telephone calls, registration with the Public Registry to Avoid Advertising maintained by the Federal Consumer Protection Agency.
9.2Such limitation shall not affect the primary purposes that are legally required or necessary for the performance of the legal relationship.
XEXERCISE OF ARCO RIGHTS
10.1The data subject, or their legal representative, has the right to access their personal data, to request its rectification where it is inaccurate or incomplete, its erasure where they consider it is not required for the stated purposes, and to object to its processing on legitimate grounds, pursuant to Articles 21 to 26 of the Law.
10.2Requests shall be sent to billarisaoficial@gmail.com and shall contain, pursuant to Article 28 of the Law:
- a)the data subject's name and the channel or address for communicating the response;
- b)documents evidencing their identity or, where applicable, legal representation;
- c)a clear and precise description of the personal data in respect of which the right is exercised, except in the case of the right of access;
- d)any other element facilitating the location of the personal data;
- e)in the case of rectification, the amendments to be made and supporting documentation.
10.3The Controller shall communicate its determination within a maximum period of twenty (20) days from receipt of the request. Where the request is granted, it shall be given effect within the fifteen (15) days following communication of the response, pursuant to Article 31 of the Law.
10.4The response shall be communicated through the same channel used to submit the request, unless the data subject designates a different one.
10.5The exercise of ARCO rights is free of charge. Only justified reproduction, copying or shipping costs may be charged, pursuant to Article 34 of the Law.
10.6The Controller may refuse the exercise of ARCO rights in the cases set out in Article 33 of the Law, stating in all cases the grounds for its determination.
XIWITHDRAWAL OF CONSENT
11.1The data subject may at any time withdraw the consent given for the processing of their personal data, by sending a request to billarisaoficial@gmail.com with the subject line «Withdrawal of consent», following the same procedure and timeframes set out in section X.
11.2Withdrawal shall have no retroactive effect and shall not apply where processing is necessary to comply with a legal obligation or to perform the existing legal relationship between the parties.
XIIAUTOMATED DECISION-MAKING
12.1The Controller does not subject personal data to automated processing producing legal effects for the data subject or intended to evaluate or predict their behavior, reliability or performance.
12.2Should such processing be implemented, prior notice shall be given through an update to this notice and the right to object recognized by the Law shall be made known.
XIIISECURITY MEASURES AND BREACHES
13.1The Controller has adopted and maintains reasonable administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access or processing, pursuant to Article 18 of the Law.
13.2Persons involved in any stage of the processing are bound to maintain confidentiality with respect to the personal data, an obligation that survives the end of their relationship with the Controller.
13.3Should a security breach occur that significantly affects the data subject's economic or moral rights, the Controller shall inform them immediately, pursuant to Article 19 of the Law, so that they may take appropriate steps to defend their rights.
XIVRETENTION PERIOD
14.1Personal data shall be retained for as long as necessary to fulfill the stated purposes, to comply with applicable legal, accounting and tax obligations, and to bring or defend legal actions.
14.2Once those purposes and retention periods have concluded, the data shall be erased following prior blocking, pursuant to Article 10 of the Law.
14.3Messages hosted on third-party messaging platforms are additionally subject to those platforms' retention policies.
XVCOOKIES AND STORAGE TECHNOLOGIES
15.1The Website uses local storage and technical cookies to retain user preferences, such as display language and currency. These technologies are not used to personally identify the user.
15.2As of the effective date of this notice, the Website does not use advertising or third-party tracking cookies.
15.3Should analytics or advertising tools be incorporated, this notice shall be updated and the corresponding information and consent mechanisms shall be implemented.
15.4Users may disable or delete local storage and cookies through their browser settings, with the consequence that certain preferences will no longer be retained.
XVIDATA OF MINORS
16.1The Controller's services are directed at adults with legal capacity to contract. The Controller does not knowingly collect personal data from minors. Should it become aware that such data has been collected, it shall be erased.
XVIICHANGES TO THIS PRIVACY NOTICE
17.1This notice may be amended as a result of legal reforms, requirements of the authority, or changes in the Controller's business model or privacy practices.
17.2Any amendment shall be published at https://www.billarisa.com/en/legal/privacidad, stating the version number and effective date; it is the data subject's responsibility to consult the version in force.
17.3In the case of substantial changes, such as new purposes requiring consent or new transfers, the Controller shall give notice through the last contact channel on record and, where applicable, shall obtain consent again.
XVIIISUPERVISORY AUTHORITY
18.1A data subject who considers that their right to the protection of personal data has been infringed may file a data protection request with the Ministry of Anti-Corruption and Good Governance, within fifteen (15) days following the date on which the Controller's response is communicated, pursuant to Article 40 of the Law.
18.2Before approaching the authority, the data subject is invited to raise the matter at billarisaoficial@gmail.com so that a direct solution may be sought.
XIXACCEPTANCE
19.1Once this notice has been made available, if the data subject does not object, they shall be deemed to have given tacit consent to the processing of their personal data for the purposes described herein, pursuant to Article 7 of the Law, except with respect to data and transfers that require express consent under the Law.
19.2Where data is collected through the Website form, a simplified notice referring to this comprehensive notice is made available, pursuant to Article 16, section II, of the Law.