Full Privacy Notice
BRAMBILABS
1. Identity and address of the Data Controller
In accordance with applicable legislation on the protection of personal data held by private parties, Alfredo Brambila Arias, responsible for operating BRAMBILABS, with an address at Calle 64 B #586, Caucel, Mérida, Yucatán, México, is responsible for processing and protecting the personal data collected through this website.
For any matter concerning privacy, personal data protection, or the exercise of ARCO rights, you may contact the Data Controller at:
2. Personal data we collect
Through the BRAMBILABS contact form, we may collect the following data:
Name, company, email address, project type or need, description and context of the request, and optionally, estimated project timing.
The system may also generate technical information strictly necessary to manage the request, such as an internal identifier, date received, internal follow-up status, idempotency identifier, request source, and the version of the Privacy Notice in effect when it was submitted.
When a person chooses to schedule a conversation through /book, the information they provide directly to the external booking service will be processed to coordinate the requested appointment.
BRAMBILABS does not request sensitive personal data, banking information, passwords, official documents, CURP, RFC, or medical information through this form.
If the data subject voluntarily includes unnecessary or sensitive information in a free-text field, efforts will be made to avoid processing it when it is not needed to handle the request.
3. Purposes of processing
Personal data will be processed exclusively for necessary purposes related to the request made to BRAMBILABS.
These purposes are to receive and record the request; understand the problem, need, or proposed project; assess whether BRAMBILABS can address it; request additional information when necessary; contact the data subject; prepare discovery, scope, or proposal discussions; follow up on the business relationship initiated by the data subject; and retain operational evidence of the request and its follow-up.
When the data subject uses the booking channel, processing is limited to scheduling the requested introductory or discovery conversation, managing the appointment, and communicating the information needed to hold it.
BRAMBILABS currently does not use data submitted through this form for secondary purposes, such as newsletters, automated promotional campaigns, the sale of databases, or automatic enrollment in marketing lists.
If secondary purposes are introduced in the future, the Privacy Notice will be updated and the corresponding mechanisms implemented before such processing takes place.
4. Use and disclosure of data
BRAMBILABS does not sell or rent personal data collected through the form.
Contact form
Contact form data may be processed through technology providers that supply services necessary to operate the website, store information, and manage operational communications on behalf of the Data Controller. The current infrastructure includes Vercel for application execution and hosting; Supabase for the PostgreSQL infrastructure where requests are stored; and, when internal email notifications are enabled, Resend to deliver those notifications and Google/Gmail as the mailbox service used to receive them.
Internal email notifications may contain request information necessary to review it and follow up on the contact initiated by the data subject.
Booking through Cal.com
The booking channel is separate from the Contact form. When a person chooses /book, they leave the BRAMBILABS website and interact directly with Cal.com, the external service used to schedule the initial call. Information provided during that interaction will be processed by Cal.com to coordinate the requested appointment, and BRAMBILABS may receive the booking information needed to manage it. Direct interaction with Cal.com may also be subject to its own terms and privacy notices.
Other disclosures
Data may also be disclosed where there is a legal obligation, a request from a competent authority, or another circumstance permitted by applicable legislation.
BRAMBILABS will not transfer data to third parties for their own marketing or commercial exploitation purposes without first informing the data subject and obtaining the consent required.
5. Options to limit use or disclosure
The data subject may request a limitation on the use or disclosure of their personal data at any time, where legally applicable, by sending a request to:
The request must allow the data subject to be identified and clearly specify the processing they wish to limit.
6. ARCO rights
The data subject may exercise their rights of Access, Rectification, Cancellation, and Opposition (ARCO) concerning their personal data.
To exercise an ARCO right, send a request to:
The request must include the data subject’s name, a means of communicating the response, a sufficiently clear description of the right they wish to exercise, and, where necessary, information establishing their identity or authority to act on another person’s behalf.
BRAMBILABS will handle requests in accordance with the procedures and time limits established by applicable legislation.
7. Withdrawal of consent and opposition
Where legally applicable, the data subject may request withdrawal of their consent or object to the processing of their data by sending a request to:
Withdrawal or cancellation may be subject to applicable legal or contractual obligations or data-blocking periods.
8. Data retention
When a request does not lead to a business or contractual relationship, data associated with the prospective client will be retained for a maximum of 12 months from the last substantive interaction, unless a legitimate reason or legal obligation requires a different retention period.
After the applicable period, data will be deleted, anonymized, or, where legally applicable, blocked for the period needed to address potential liabilities.
When a request leads to a contractual or business relationship, the necessary data may be subject to the retention periods applicable to that relationship.
9. Security and confidentiality
The Data Controller will implement reasonable administrative, technical, and physical measures to protect personal data against unauthorized access, loss, alteration, disclosure, or improper processing.
People involved in processing must maintain the confidentiality of the information in accordance with applicable obligations.
Where a security breach must be communicated to the data subject under applicable legislation, the corresponding obligations will be followed.
10. Changes to the Privacy Notice
BRAMBILABS may modify or update this Privacy Notice following legal, operational, technological, or service-related changes.
The current version will be available in the Privacy Notice section of this website at:
/privacy
Significant changes may also be communicated through the email address provided by the data subject, where appropriate.
11. Contact
Data Controller: Alfredo Brambila Arias
Address: Calle 64 B #586, Caucel, Mérida, Yucatán, México
Email for privacy and ARCO rights: