Privacy Notice

Last updated: September 9, 2026

1. Data Controller Aranzazú Gamboa Andrade, an individual with business activity (PAQPAQ), RFC GAAA950818GD7, with domicile for notifications in Durango City, Durango. Contact: hola@paqpaq.mx / WhatsApp +52 614 277 8738.

2. Legal Framework This Notice is issued in accordance with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and other applicable provisions.

3. Personal Data We Collect We collect identification and contact data (name, email, phone, address), tax data (RFC, tax regime, CFDI usage), official identification data (INE), operational data (origin and destination addresses, declared content, weight, dimensions, shipping label history, and balance movements), and payment data processed through Stripe (PAQPAQ does not store complete card data).

3.1 Buyer Data Collected Indirectly (Ecommerce Integrations) When you make a purchase from an online store that uses PAQPAQ's services for its shipping logistics, we receive from that store's platform (Shopify, WooCommerce, Tiendanube, TikTok Shop, Wix, or others we may integrate) the following data about you: name, email address, phone number, delivery address, as well as the products purchased and the total of your order.

We use this data exclusively to: generate the shipping label corresponding to your purchase, print the shipping label, notify you of your package tracking, and mark your order as shipped in the store where you made your purchase. We do not use this data for marketing, advertising, or sales prospecting purposes, nor for any purpose other than those stated here.

We share this data only with the Logistics Operator responsible for the physical delivery of your package, to the extent necessary to complete the shipment you already requested when making your purchase. This transfer does not require your additional consent, as it is necessary to fulfill the service you yourself requested through the store where you made your purchase.

Some of our technology providers may process or store this data on servers outside Mexico, solely for the purposes described here.

Your data as a buyer is automatically deleted 90 calendar days after your order is received. After that period, we retain only the order number, products, total, date, and the link to the corresponding shipping label, which is retained in accordance with the period set out in Section 9 of this Notice.

If you are a buyer from a store that uses PAQPAQ and wish to exercise your ARCO rights (Access, Rectification, Cancellation, and Opposition) over this data, you may contact the store where you made your purchase or reach us directly at hola@paqpaq.mx, in accordance with the mechanism described in Section 11.

4. Sensitive Personal Data (Biometric) As part of identity verification, we collect a video taken at the time of registration, from which biometric data may be derived. This is sensitive personal data. Its processing requires your express and separate consent, which is requested during registration. Its sole purpose is to validate your identity and prevent fraud. You may decline to provide it, in which case verification cannot be completed.

5. Primary Purposes We use your data to: create and manage your account; verify your identity; quote, generate, and manage domestic shipping labels; process payments and top-ups; issue tax receipts; provide support; and comply with legal and tax obligations.

6. Secondary Purposes Additionally, and only if you do not object, we may use your data to send you communications about news, promotions, and quality surveys. You may opt out of these purposes by emailing hola@paqpaq.mx.

7. Transfers To provide the service, we share data with: the Logistics Operator ("the Provider") that carries out the transportation of the shipment (origin, destination, and package data); the third-party Provider that manages the "Protege tu envío" service (for claims evaluation); the payment processor Stripe; and electronic invoicing providers. We may also transfer data when required by a competent authority. Except for these cases and those provided by law, we do not transfer your data to third parties without your consent.

8. "Protege tu envío" (Shipment Protection) When you activate "Protege tu envío," the declared value of the package and shipment data are shared with the third-party Provider that manages such protection, for the purpose of administering coverage and, where applicable, evaluating claims.

9. Retention Periods We retain shipping label history and balance movements for 3 years. Data with tax implications (CFDI and related) is retained for 6 years, in accordance with the Federal Tax Code. Upon closing your account, we retain only the information necessary to comply with legal and tax obligations during the periods indicated, after which it is deleted or anonymized.

10. Security Measures We apply administrative, technical, and physical measures to protect your data, including encryption in transit and at rest, access controls, and audit logs. The platform offers a password change option in the Security section.

11. ARCO Rights You may exercise your rights of Access, Rectification, Cancellation, and Opposition (ARCO), as well as limit the use or disclosure of your data and revoke your consent. You can do this from My Account > Privacy, where you will find options to download your data in JSON format (portability) and request deletion of your account; or by sending your request to hola@paqpaq.mx. We will respond within the timeframes established by law.

12. Withdrawal of Consent You may withdraw your consent at any time, including consent related to biometric data. Withdrawal may mean we are unable to continue providing the service to you if such data is necessary for the relationship.

13. Data Portability From My Account > Privacy you can download your data in structured JSON format.

14. Use of Cookies and Technologies The platform may use cookies and similar technologies for its operation and improvement. You can configure these from your browser.

15. Minors The service is intended for adults. We do not intentionally collect data from minors.

16. Changes to This Notice Any changes will be posted on the platform, indicating the date of the last update.

17. Contact and Authority For questions about this Notice: hola@paqpaq.mx / WhatsApp +52 614 277 8738. If you believe your right to data protection has been violated, you may contact INAI (www.inai.org.mx).