Comprehensive privacy notice

Last updated: publication date of the notice

This comprehensive privacy notice (aviso de privacidad integral) is issued under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP), published in the Diario Oficial de la Federación (DOF), Mexico’s official gazette, on March 20, 2025, and other applicable rules. It explains how we handle personal data received through castrodefense.com, its contact, quote and case-evaluation forms, email and WhatsApp. This English version is provided for convenience; if there is any discrepancy, the Spanish version prevails.

1. Who is responsible for your data?

CASTRO DEFENSE Sociedad por Acciones Simplificada de Capital Variable (“Castro Defense”), with its address at street and number, postal code postal code, Santiago de Querétaro, Querétaro, Mexico, is the data controller responsible for your personal data.

• Email for privacy matters: contacto@castrodefense.com
• Data protection officer or department: name of the person or area designated to handle requests

2. What personal data do we process?

Contact form, email and WhatsApp

• Identification and contact data: name, email address, phone number, city or state.
• The content of your message and any information you choose to share.
• On WhatsApp, also: your phone number, profile name and the messages, files or voice notes you send.

Quote form

• Name, position, email and phone number.
• Details of the agency or company you represent and of the project.
• Information about the legal authorization to acquire and operate the equipment requested.

Case evaluation form

• Identification and contact data.
• A description of your matter and any documents you choose to send for review, such as contracts, pay slips, bank statements, deeds, rulings or certificates.
• Depending on the matter, employment, financial or property data. Financial and property data require your express consent (LFPDPPP, art. 7), which is collected in the form itself. confirm the express-consent mechanism in the form
• If you engage a service: the data needed for the contract and, where applicable, for electronic signature of documents.

Browsing the site

• IP address, browser and device type, pages visited, date and time of the visit and referring site, obtained through cookies and similar technologies (section 8).

Sensitive personal data

We do not ask for sensitive personal data in the contact or quote forms. Some legal matters may require it, for example health information in a retirement or pension claim. In that case we will request it separately and only with your express written consent, given by handwritten or electronic signature (LFPDPPP, art. 8). Please do not send such data by WhatsApp or through the forms unless we have asked for it.

Third-party data

If you give us data about other people, for example when describing your matter, you are responsible for having the authority to share it.

3. What do we use your data for?

Purposes needed to handle your request

These purposes arise from the relationship you initiate with us and do not require additional consent (LFPDPPP, art. 9, section IV):

1. Answering your messages, inquiries and requests for quotes or case evaluations.
2. Assessing whether we can provide the service requested, including verifying the legal authorization of anyone requesting counter-drone equipment and carrying out a preliminary review of case documents.
3. Preparing quotes, proposals and contracts, and formalizing the engagement, including electronic signature of contracts and powers of representation.
4. Providing the contracted service and keeping you informed about your matter.
5. Complying with legal obligations and with duly grounded requests from competent authorities.
6. Protecting the security of the site and its forms against fraud and abuse.

Purposes that require your consent

7. Sending you information about Castro Defense services, articles or events. confirm whether this purpose will be used
8. Measuring site usage statistically through analytics cookies.

If you do not want your data used for purposes 7 and 8, email contacto@castrodefense.com with the subject line “Secondary purposes”, or disable analytics cookies as explained in section 8. Refusing does not affect how we handle your request or any services you engage.

4. Who do we share your data with?

We do not make any transfers of personal data that require your consent. We share data only where the law allows it without consent (LFPDPPP, art. 36), for example:

• When a law requires it or a competent authority orders it.
• When it is necessary for the administration of justice, or to establish, exercise or defend a right in court, such as filing your case with a court or authority on your instructions.
• When it is necessary under a contract entered into in your interest, such as submitting your application to SEDENA (Mexico’s Ministry of National Defense) as part of the paperwork service.

Our website hosting, email, electronic signature and analytics providers process data on Castro Defense’s behalf as processors and may not use it for their own purposes. Providers and server locations: hosting, email, electronic signature and analytics providers, and where their servers are located.

WhatsApp is a third-party service: messages you send us that way are also subject to that provider’s terms and privacy policy.

5. How can you limit the use or disclosure of your data?

• By emailing contacto@castrodefense.com with the subject line “Limit use of data”.
• Through the unsubscribe link included in any informational message we send.
• By setting your browser to block or delete cookies.

6. How to exercise your ARCO rights or withdraw consent

Under Mexican law you have the right to access your personal data, rectify it if it is inaccurate or incomplete, cancel it and object to its processing (known as ARCO rights), and to withdraw any consent you have given (LFPDPPP, arts. 7 and 21 to 26).

How to submit a request. Email contacto@castrodefense.com with the subject line “ARCO rights”. Your request must include (art. 28):

1. Your name and an address or email for our reply.
2. Documents proving your identity or, where applicable, the identity and authority of your representative.
3. A clear description of the data concerned, except for access requests.
4. The right you wish to exercise or what you are requesting.
5. Any other information that helps locate your data.

For a rectification, state the changes and attach supporting documents (art. 30).

Deadlines. We will reply within a maximum of 20 business days from receipt of your request. If the request is granted, it will take effect within 15 business days after our reply. Each deadline may be extended once for an equal period when justified (art. 31).

Delivery and cost. Access is provided by making your data available to you or delivering electronic documents or plain copies (art. 32). Exercising ARCO rights is free; only reproduction, copying or shipping costs may be charged (art. 34).

Cancellation. Cancellation starts a blocking period, after which the data is deleted; during that period it is kept only to address liabilities arising from the processing (art. 24). The law lists cases in which cancellation does not apply, such as when the data is needed to perform a contract or meet a legal obligation (art. 25).

If you disagree with our reply or do not receive it in time, you may file a data protection request with Mexico’s Secretariat for Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) within 15 business days after our reply, or once the reply deadline has passed (art. 40).

7. How long do we keep your data and how do we protect it?

We keep your data only for as long as needed for the purposes in this notice and to meet legal obligations. It is then blocked and deleted (LFPDPPP, arts. 10 and 24). Retention period for inquiries and quotes that do not lead to an engagement: retention period.

We apply administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing (art. 18).

8. Cookies and similar technologies

Cookies are small files the site stores in your browser.

• Necessary cookies: enable the site’s basic functions, protect the forms and remember your language. They cannot be turned off from the site.
• Analytics cookies: statistically measure how many people visit the site and which pages they view. Tool used: analytics tool and whether it uses first- or third-party cookies.

You can block or delete cookies in your browser settings. The site keeps working without analytics cookies.

Links to third-party sites, such as gob.mx or WhatsApp, are governed by those sites’ privacy policies.

9. Minors

This site is not directed at minors. If you are under 18, please do not send us personal data without the involvement of a parent or guardian.

10. Changes to this privacy notice

Any change to this notice will be posted on this page with its update date. When a change affects the purposes of processing, we will also inform you through the contact details you gave us.

11. Data protection authority

The authority that oversees compliance with the LFPDPPP is Mexico’s Secretariat for Anti-Corruption and Good Governance (LFPDPPP, arts. 2 and 38).

Official sources

• Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), arts. 2, 7, 8, 9, 10, 15, 18, 21 to 36, 38 and 40. Chamber of Deputies, current text (DOF March 20, 2025; last amended November 14, 2025) (Spanish).