Toldo full privacy notice (Mexico)

Last updated: November 15, 2026. Version 2026-11-15.

This English version is a courtesy translation. If it differs from the Spanish version, the Spanish version prevails. Read the Spanish version

Some details in this document are still pending. They're marked like this: .

In this document

This notice explains what personal data we process on the https://toldo.io website, especially in the application for the founding-partner program; what we use it for; who we share it with; and how you can exercise your rights. We issue it under the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), published in the Official Gazette of the Federation (Diario Oficial de la Federación) on March 20, 2025 (the "Law").

1. Who is responsible for your data

[Company legal name and legal form] ("Toldo" or "we"), with its address for receiving notices (domicilio para oír y recibir notificaciones) at [Company address], is the controller (responsable) of your personal data.

Our personal data department handles any privacy matter, including your ARCO rights (acceso, rectificación, cancelación y oposición), at [Privacy email address].

2. What personal data we process

What you give us in the application:

  • Identification and contact: your name and your email address.
  • Data about your business: your Mercado Libre seller username, your Shopify store's web address (if you give it to us), your monthly order range, the tool you use today to connect Mercado Libre with Shopify, and what you'd like to solve first.
  • Your choices: that you accepted this notice, with its version and the date, and whether or not you checked the news checkbox described in section 3.
  • How you got here: the campaign or link that brought you, when the page's web address shows it (the "utm_source" or "ref" parameter).

Technical data:

  • A code derived from your IP address, calculated with a cryptographic function and a secret key. We don't store your IP address. We use the code only to limit abuse of the form, and we delete it after 7 days.
  • Hosting logs: our hosting provider may record connection data, such as the IP address, to run and protect the service.

If you write to us by email or WhatsApp, we also process what you share with us in those messages, to reply to you.

We don't ask you for sensitive personal data, or for bank or card details. Your monthly order range is data about your business that could be considered financial data (dato patrimonial); that's why we ask for your express consent with the checkbox on the form.

3. What we use your data for

Necessary purposes. These are the purposes that let us handle your application. You give us your consent for them when you send the application with the checkbox for this notice checked:

  1. Evaluate your application for the founding-partner program.
  2. Contact you about your application and about the program.
  3. If you join the program, coordinate with you on Toldo's setup, the direct WhatsApp line and the follow-up calls.
  4. Analyze the applications as a whole, for example how many there are in each order range, to plan Toldo's rollout.
  5. Protect the form against abuse.
  6. Comply with legal obligations and respond to requests from competent authorities.

Secondary purposes. These aren't necessary to handle your application and require your separate consent, which you give us only if you check the news checkbox on the form:

  • Send you news about Toldo's general launch, its new features and its plans.
  • Invite you to short surveys or interviews outside the program.

If you don't check that box, we don't use your data for these purposes, and refusing doesn't affect your application. If you checked it, you can withdraw your consent at any time by writing to [Privacy email address] or by replying to any of those messages.

4. Who we share your data with

We don't sell or rent your personal data.

Providers that process your data on our behalf. To run the site we use providers (data processors, or personas encargadas, as defined in the Law) that process your data only to provide their service to us, following our instructions and with confidentiality and security obligations:

  • Hosting and database: [Hosting provider and location].
  • Email: [Email provider].

These providers may be outside Mexico, for example in the United States, so your data may be stored or processed outside the country.

Transfers. We don't transfer your data to third parties for them to use for their own purposes. We would only disclose it in the cases in which Article 36 of the Law allows us to do so without your consent:

  • when a law or a treaty provides for it, or a competent authority requires it;
  • to a company in the same group that operates Toldo, which will process it for the same purposes and under the same privacy policies;
  • when it's necessary to establish, exercise or defend a right in court proceedings.

Because these cases don't require your consent, this notice doesn't include a clause for accepting transfers.

5. Your ARCO rights

You have the right to:

  • Access: know what data about you we have and how we use it.
  • Rectification: correct it if it's inaccurate or incomplete.
  • Cancellation: ask us to delete it.
  • Objection: object to our using it for specific purposes.

How to exercise them. Send your request to [Privacy email address], preferably from the email address you used in your program application, with the following:

  • your name and an email address or other means to receive our answer;
  • a copy of your valid official ID or, if you act through a representative, their ID and the document that proves the representation;
  • a clear description of the data your request is about (not needed for the right of access);
  • the right you want to exercise or what you're asking us for; for a rectification, the correct data;
  • anything else that helps us locate your data.

Deadlines. We'll send you our answer within a maximum of 20 business days from when we receive your request. If it's granted, we'll carry it out within the 15 business days after our answer. When circumstances justify it, we may extend each deadline only once, by an equal period, and we'll tell you.

Cost. Exercising your rights is free. Only reproduction, copying or shipping costs could be charged; if you give us an electronic means to receive your data, there's no cost.

You can revoke the consent you gave us at any time, through the same channel as for ARCO rights and with the same information. Revocation has no retroactive effect. If you revoke your consent for the necessary purposes, we'll no longer be able to consider your application for the program.

7. How to limit the use or disclosure of your data

Besides refusing the secondary purposes, you can ask us at [Privacy email address] to stop sending you any communication that isn't about your application. We'll add you to our internal exclusion list at no cost and confirm it to you by email.

8. Cookies and tracking technologies

The public pages of https://toldo.io don't use cookies, web beacons, pixels, analytics tools or other tracking technologies, whether ours or third parties', and don't store information in your browser. If this changes, we'll update this notice first.

9. How long we keep your data

  • Your application: [How long applications are kept]. After that we delete it, unless you become a Toldo customer or the law requires us to keep some data.
  • If you opted in to news: we keep your name and your email address to send you news until you withdraw your consent.
  • The code derived from your IP: 7 days.

When we must keep some data for legal reasons, we'll block it: we'll keep it without using it, only to deal with possible liabilities, for the period the law sets, and then we'll erase it.

10. Changes to this notice

We'll publish any change at https://toldo.io/en/legal/privacy-notice-mexico, with the date of the last update at the top. If a change affects how we use your data, for example a new purpose, we'll also let you know by email before applying it, and we'll ask for your consent when the Law requires it.

11. Authority

The authority in charge of protecting personal data held by private parties is the Ministry of Anti-Corruption and Good Government (Secretaría Anticorrupción y Buen Gobierno, www.gob.mx/buengobierno). If you're not satisfied with our answer to an ARCO rights request, you can file a data protection request (solicitud de protección de datos) with the Ministry within the 15 business days after we send you our answer. If we don't answer you, you can file it as soon as the deadline we have to answer runs out.

12. The Toldo app

This notice covers the https://toldo.io website and the program application. When you install the Toldo app on your Shopify store, the data the app processes (for example, data about your store, your Mercado Libre account, your orders and your invoices) is governed by the app's privacy policy.