Updates:At this time, in-person appointments are being held at Monte Elbruz 124, Polanco. Read more

PRIVACY NOTICE

📅 Date of issue: March 21, 2026 📋 Version: 2.1 ⚖️ In accordance with the LFPDPPP effective as of March 21, 2025

At Migralaw SAPI de CV, we deeply value your privacy and trust. This Privacy Notice is issued in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), originally published on July 5, 2010, and amended by a decree published in the Official Gazette of the Federation on March 20, 2025, effective as of March 21, 2025, as well as its Regulations and other applicable provisions issued by the competent authority on personal data protection.

We will maintain the confidentiality of the information provided at all times and act in accordance with the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality, and accountability established by the Law.

Data Controller

Migralaw SAPI de CV, operating under the trade name MIGRALAW, with Tax ID No. (RFC): MIG220126DC3, is the data controller responsible for processing your personal data, with its registered office at:

124 Monte Elbruz, 2nd Floor, Lomas de Chapultepec Neighborhood, Miguel Hidalgo Borough, ZIP Code 11520, Mexico City.

Website: migralaw.com | migralaw.com.mx

Privacy email: admin@migralaw.com

Personal Information We Collect

Migralaw may collect the following categories of personal data:

Identification and contact information:

Full name
Date and place of birth
Nationality and country of origin
Phone number and email address
Current address and place of residence
Name and contact information for your company or organization
Employment and Occupation Information

Migration and documentation data:

Passport number and official identification documents
Current immigration status in Mexico or abroad
Immigration Form Number (FMM), visa, or residence permit
History of entries into and exits from the country
Documents issued by the INM or other immigration authorities
Birth, marriage, and divorce certificates, or other civil status documents
Academic degrees, certificates, and transcripts

Financial and asset information (requires express consent):

Banking information for payment processing
Proof of income or financial stability
Tax returns, when required by the procedure

⚠️ Sensitive Data: In the context of immigration proceedings, MIGRALAW may process data considered sensitive under Article 3, Section VI of the LFPDPPP, including: racial or ethnic origin, health status, vulnerable immigration status, religious beliefs when relevant to the proceedings, and, where applicable, biometric data. The processing of this data will require your express written consent, which will be requested in a separate document at the time of contracting the service.

If you do not provide the information marked as required, MIGRALAW will be unable to begin or continue providing the immigration or corporate services you have contracted.

Purposes of the Processing

Primary purposes (necessary for the provision of the service):

Provision of immigration and corporate services: To manage, process, and monitor procedures before the National Institute of Migration (INM), the Ministry of Foreign Affairs (SRE), and other relevant authorities.

Preparation of legal documents: To draft legal briefs, petitions, powers of attorney, contracts, and any other legal documents necessary for the handling of your case.

Compliance with legal obligations: To comply with the requirements of competent authorities in Mexico and abroad, in accordance with applicable immigration, tax, and corporate laws.

Communication regarding your case: To inform you of the status of your case, appointment dates, decisions, and any relevant updates regarding your case.

Payment Processing: To process the fees and service charges associated with the contracted services using the available payment methods.

Customer Service: To respond to inquiries, complaints, requests for clarification, and other requests related to the services provided.

Creation and management of your file: To create and maintain your file in our management systems throughout the term of the contractual relationship and for the period required by law.

Secondary purposes (you may object to these without affecting the service):

Marketing and business communications: To send you information about new services, relevant immigration updates, legal newsletters, and content of interest.

Statistical analysis: To evaluate the quality of our services, improve internal processes, and develop new legal products.

Event invitations: To keep you informed about webinars, workshops, conferences, and other activities related to global mobility and immigration.

If you do not wish for your data to be used for secondary purposes, you may indicate this by sending an email to admin@migralaw.com at any time.

Use of Technology Tools and New Data Processors

MIGRALAW is a law firm with a legaltech model that uses advanced technological tools to manage, automate, and communicate regarding its clients’ legal proceedings. Pursuant to Article 50 of the LFPDPPP Regulations, the following providers act as Data Processors, meaning they process your personal data on behalf of and in the name of MIGRALAW, under strict instructions and subject to confidentiality obligations:

Airtable (Formagrid Inc.) Case and customer database. Servers located in the U.S.

N8N (n8n GmbH) Workflow automation and notifications. Servers in Germany and the U.S.

Notion Labs Inc. Internal process management and documentation. Servers located in the U.S.

Typeform S.L. Data collection and customer acquisition forms. Servers located in the EU and the U.S.

Telegram Messenger Internal team notifications regarding file updates. Servers located in the US/EU.

Carbone.io Automated generation of legal documents and receipts. Servers located in France.

Stripe / PayPal / CLIP Online payment processing. Subject to their own privacy policies.

Google Workspace Email, calendar, and document storage. Servers located in the U.S.

Anthropic / OpenAI AI tools for legal drafting and analysis. Servers located in the U.S.

MIGRALAW's Own Servers Private infrastructure with end-to-end encryption for the secure storage of case files, documents, and internal databases. Location: Mexico / private cloud.

MIGRALAW undertakes to enter into legal agreements with each of these suppliers to ensure that their data is processed in accordance with the LFPDPPP and its Regulations, including obligations regarding confidentiality, security, and the deletion of data upon termination of the relationship.

⚠️ Use of Artificial Intelligence: MIGRALAW uses artificial intelligence tools to assist with document drafting, case analysis, and customer service. Under no circumstances will legal decisions be made solely through automated processes without human intervention. A licensed attorney will always supervise and validate any action that affects your rights or your immigration process.

Domestic and International Data Transfers New

Due to the nature of immigration services and the use of technological tools with servers located abroad, your personal data may be transferred to:

Domestic transfers:

National Institute of Migration (INM): For the processing of immigration procedures, which is essential for the provision of the service.
Ministry of Foreign Affairs (SRE): For naturalization procedures, apostilles, and consular documents.
Notaries Public and Notaries: When the procedure requires notarization.
Other Mexican immigration or consular authorities: When required by the procedure.

International transfers:

Foreign consulates and embassies in Mexico: When the service requires coordination with authorities in the client’s home country.
Foreign immigration authorities: Only when the client expressly requests it as part of the service.
Technology providers with servers located abroad: As indicated in the section on Data Processors.

Transfers to government authorities are necessary for the provision of the service and do not require your additional consent. Transfers to international technology providers are made under contracts that guarantee levels of protection equivalent to those required by Mexican law.

Consent and New Revocation Mechanism

The processing of your personal data for primary purposes will be subject to implied consent, except in the following cases, which require express consent:

Processing of sensitive data (ethnic origin, health status, vulnerable immigration status)
Processing of financial or asset data
Data transfers to third parties for purposes other than the primary ones
Use of your data for automated profiling using artificial intelligence

Withdrawal of consent: You may withdraw your consent to the processing of your data at any time, without retroactive effect, by sending your request to:

Email: admin@migralaw.com
Subject: "Withdrawal of consent — [your name]"
Response time: 20 business days

Note: Withdrawing consent for primary purposes may make it impossible to continue providing the contracted service.

Data Storage and Preservation

MIGRALAW will retain your personal data for the following periods:

Long-term immigration procedures (permanent residency, naturalization): up to 5 years after the completion of the process, in anticipation of future renewals or procedures.
Short-term immigration procedures (temporary visas, permits): up to 2 years after the completion of the process.
Financial and billing data: up to 5 years, in accordance with the tax obligations set forth in the Federal Tax Code.
Marketing contact information: until you exercise your right to opt out or object.

Once these time limits have expired, MIGRALAW will securely delete or anonymize your personal data.

Data Protection and Security

MIGRALAW implements the following security measures to protect your personal data, in line with best practices in the legal and technology sectors:

Technical specifications:

End-to-end encryption (E2E): All data in transit and at rest is protected using AES-256 and SSL/TLS encryption protocols, both on our own servers and in third-party tools.
Role-based access control and mandatory two-factor authentication (2FA) for all staff
Our own infrastructure with secure servers for storing highly sensitive files and documents
Automated regular backups in encrypted and geographically redundant environments
Continuous monitoring of unauthorized access and intrusion attempts
Exclusive use of secure HTTPS connections on all MIGRALAW websites and digital applications

Principle of the minimum necessary:

🔒 Commitment to Minimal Disclosure: MIGRALAW shares your personal data solely and exclusively to the extent strictly necessary for the provision of the contracted service. We do not share, sell, or transfer your information to third parties for our own commercial purposes. Every data transfer is justified, documented, and limited to the minimum necessary in accordance with the principle of proportionality under the LFPDPPP.

Administrative measures:

Non-disclosure agreements with all employees, contractors, and service providers
Regular training on data protection and cybersecurity for the MIGRALAW team
Internal access policies based on the principle of strict necessity
Documented and auditable procedures for exercising ARCO rights
Annual review of security measures in accordance with legal industry standards

Physical measurements:

Access control for facilities where physical information is stored
Storage of original documents in a secure archive with restricted access
Certified destruction of physical documents when necessary

⚠️ Security Incident Notification: In the event of a security breach that significantly affects your economic or moral rights, MIGRALAW will immediately notify you via the contact information on file so that you may take the necessary steps to protect your interests, in accordance with Article 20 of the LFPDPPP.

ARCO Rights and the Right to Object to Automated Processing

Under the LFPDPPP, you have the right to access, correct, delete, or object to the processing of your personal data (ARCO rights). Additionally, legislation in effect since 2025 recognizes the right to object to automated decisions that significantly affect you.

To exercise any of these rights, please send a request to admin@migralaw.com with the subject line "Exercise of ARCO Rights, " including:

Full name and email address or mailing address where you would like to receive a reply.
A copy of a valid government-issued ID proving your identity, or, if applicable, proof of legal representation for the person acting on your behalf.
A clear and precise description of the personal data regarding which you wish to exercise your right.
Specify whether the request is for access, correction, deletion, or objection.
The reason for the request and, if you are requesting a correction, the changes you wish to make.
Any document or item that helps locate your data.
If you object to automated decisions: a description of the automated process that affects you and the consequences you wish to avoid.

MIGRALAW will notify you of its decision within 20 business days of receiving your request. If the request is approved, the changes will be made within the following 15 business days. In complex cases, these deadlines may be extended once for an equal period, and you will be notified in a timely manner.

You may also file a complaint or report with the competent data protection authority if you believe that your request was not handled in accordance with the law.

Special Considerations: New Migration Data

Since MIGRALAW provides specialized services in the field of immigration, the processing of data involves certain specific aspects that the data subject should be aware of:

Obligation to Provide Accurate Information: The data subject agrees to provide accurate and up-to-date information. Providing false information may result in legal consequences with immigration authorities, for which the data subject bears sole responsibility.

Sharing with authorities: Immigration data will be shared with the INM, the SRE, and other competent authorities only to the extent necessary for processing the application; this constitutes a transfer permitted by law that does not require additional consent.

Confidentiality of Client Files: MIGRALAW treats the contents of your immigration file with the strictest professional confidentiality, in accordance with the ethical standards applicable to the legal profession in Mexico.

Third parties involved in the process: If your application involves the personal information of third parties (spouse, children, employees), you hereby declare that you have obtained the consent of those third parties to provide their personal information to MIGRALAW.

Retention of Copies: MIGRALAW will retain copies of the documents submitted for the period specified in the “Storage” section, in accordance with best practices in immigration case management.

Cookies and Tracking Technologies

The websites migralaw.com and migralaw.com.mx use cookies, web beacons, and similar technologies to:

Improve the browsing experience and personalize content
Analyze traffic and user behavior (Google Analytics)
Deliver relevant ads on third-party platforms
Remember your language and navigation preferences

The data collected through cookies includes: IP address, browser type, pages visited, session duration, and traffic source. You can manage or disable cookies in your browser settings without affecting the site’s core functionality.

Legal Disclaimer as a New Legaltech Firm

MIGRALAW recognizes its dual nature as both a law firm and a legal technology (legaltech) company. Accordingly, it is committed to:

Mandatory human oversight: No legal decision affecting the client’s immigration rights will be made solely through automated means. A licensed attorney will review and sign all relevant legal documents.

Data Separation in AI Tools: When using artificial intelligence tools for drafting assistance or analysis, MIGRALAW will avoid including data that identifies the data subject in prompts or queries sent to third-party platforms, using anonymized or pseudonymized data where appropriate.

Ongoing technological updates: As new technological tools are introduced, MIGRALAW will update this notice and inform data subjects at least 30 days in advance if such tools involve new processing of personal data.

Contractors: All technology providers acting as data processors will be subject to a legal agreement setting forth their obligations regarding confidentiality, security, and the return or destruction of data upon termination of the relationship.

Update to the Privacy Notice

MIGRALAW reserves the right to modify this Privacy Notice to comply with legislative changes, rulings by the competent authority, changes in our practices, or the introduction of new technological tools. Any modifications will be posted at least 30 days in advance on migralaw.com and migralaw.com.mx.

Your continued use of our services following the publication of any changes will constitute your acceptance of such changes, unless you indicate otherwise within the specified time frame.

Version history:

Version	Date	Key changes
1.0	January 2022	Original publication of the Privacy Notice in accordance with the LFPDPPP 2010.
2.0	January 2026	Inclusion of provisions regarding legaltech, data processors, sensitive migration data, international data transfers, and opt-out mechanisms. Update to the LFPDPPP as amended on March 20, 2025.
2.1	March 21, 2026	Incorporation of Typeform as a data processor. Address update. Addition of our own servers with end-to-end encryption. Strengthening of the principle of data minimization. Incorporation of version history.

Contact Information for the Privacy Officer

If you have any questions, requests, or concerns regarding the processing of your personal data, please contact our Corporate Privacy Officer:

Jesús Eduardo García Ríos
Corporate Privacy Officer — MIGRALAW

📧 admin@migralaw.com

📍 124 Monte Elbruz, 2nd Floor, Lomas de Chapultepec Neighborhood, Miguel Hidalgo Borough, ZIP Code 11520, Mexico City, Mexico.

📞 (55) 4169 1400

Business hours: Monday through Friday, 9:00 a.m. to 6:00 p.m. (Mexico City time)

WhatsApp (Info)

+52 55 4631 3626