Privacy notice

Simplified privacy notice

O'Malley Studio (the "Controller") processes your personal data to handle your requests, quote, provide the services you hire, bill you and support you. We may share it with providers that help us deliver the service (WhatsApp, hosting, storage and AI tools, among others). You can exercise your ARCO rights and withdraw your consent on WhatsApp at +52 446 101 3238. The full notice is below and on this page.

1. Who is the controller

The controller of your personal data is O'Malley Studio. Its identification details and the address for notices are given in the service contract, when the work begins. For personal data matters, message us on WhatsApp at +52 446 101 3238.

2. What data we collect

We collect only what's needed, depending on how you interact with us:

• When you message us on WhatsApp: your name (your profile name or the one you give us), your phone number and the content of your messages. If you use the site's message box, what you type (name, business, project description) is only used to build the WhatsApp link: the site doesn't store it or send it to any server.
• When you hire us: contact details, business name, project information and materials (logos, photos, videos, text, account access) and payment receipts.
• If you request an invoice: tax details (legal or personal name, RFC, tax regime, tax address and CFDI use).
• In your browser: the site saves your theme and language preference on your device (localStorage). They aren't personal data and aren't sent to anyone. See the Cookies and local storage.
• Server technical logs: the hosting provider may log your IP address and basic visit data for security and operation.

We don't ask for sensitive personal data. Please don't send us sensitive data (health, beliefs, ethnic origin, sexual orientation, biometric or financial data such as card numbers or passwords). We will never ask for your passwords.

3. What we use your data for

Necessary purposes (without them we can't provide the service):

• Reply to your messages and handle your information requests.
• Prepare quotes and enter into the service contract.
• Produce, review and deliver the hired work.
• Collect payment, issue receipts and meet tax and accounting obligations.
• Provide follow-up support and handle claims.

Secondary purposes (you can refuse without affecting the service):

• Show the work done for you in our portfolio and socials. If you prefer confidentiality, tell us in writing before delivery.
• Improve our services internally with aggregated information that doesn't identify you.

To refuse the secondary purposes, message us on WhatsApp at +52 446 101 3238 when hiring or at any time.

4. Transfers and third parties

We don't sell or rent your data. To provide the service we rely on third parties who may receive or process it on our behalf, some outside Mexico:

• WhatsApp and Meta Platforms: the channel you message us through. Their processing is governed by their own notices and terms.
• The site's hosting provider and network security services.
• Cloud storage and file-transfer services to receive your materials and deliver the final ones.
• Artificial intelligence tools, only when they process material from your project, under human supervision and under the rules of the Intellectual property, licenses and use of AI policy. You can ask us in writing not to process your material with third-party AI.
• Banks, payment processors and accountants, to collect payment and meet tax obligations.
• Printers, suppliers and other collaborators you hire or we approve with you for your project.
• Authorities, when a law or ruling requires it.

Transfers needed to carry out our relationship don't require extra consent under the law. If you want to limit one, write to us and we'll weigh options; some may affect timing or costs.

5. How long we keep it

We keep your data while the relationship lasts and up to 5 years afterward, for tax obligations and to defend ourselves against claims. Your project materials stay in our files during follow-up support and are then deleted or returned to you, unless you ask us to keep them. WhatsApp messages stay on our devices until we delete them. After that, we delete or anonymize them.

6. Your ARCO rights and how to exercise them

You have the right to know what data we hold about you and what we use it for (Access), to ask us to correct it if it's inaccurate or incomplete (Rectification), to ask us to delete it when you consider it's no longer needed (Cancellation) and to object to our using it for certain purposes (Objection).

To exercise them, send your request on WhatsApp at +52 446 101 3238 stating: your name and a way to reply, a clear description of the right you want to exercise and the data involved, and a document with which we can verify your identity. We'll reply with a decision within 20 business days and, if it's granted, make it effective within the following 15 business days. These periods can be extended once when the law allows.

There are cases where the law requires us to keep data (for example, tax data), and in those we can't cancel it until the obligation ends.

7. Withdrawing consent and limiting use

You can withdraw the consent you gave us or ask us to limit the use of your data by messaging us on WhatsApp at +52 446 101 3238. We'll stop using it for the purposes you indicate, except those the law requires us to keep. Withdrawing consent for necessary purposes may prevent us from continuing to provide the service.

8. Minors

The site and services are for adults. We don't knowingly collect data from minors. If minors appear in a project's materials, the client must have authorization from whoever holds parental authority or guardianship.

9. How we protect your data

We apply reasonable administrative, technical and physical measures: encrypted connections (HTTPS) on the site, restricted access to project files, accounts with passwords and two-step verification where the service allows. No system is infallible. If a breach occurs that significantly affects your rights, we'll tell you.

10. Cookies and local storage

This site doesn't use tracking cookies or analytics or advertising tools. It only uses your browser's local storage to remember your theme (light or dark) and language. Details are in the Cookies and local storage.

11. Changes to this notice

We may update this notice because of legal changes or changes to our services. We'll publish the current version on this page with its update date. If a change materially affects how we use your data, we'll let you know via WhatsApp.

12. Authority and legal framework

This notice is issued under the Federal Law on the Protection of Personal Data Held by Private Parties currently in force (published in the Official Gazette on March 20, 2025). The competent authority is the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), which took over the functions of the now-dissolved INAI. If you believe your right to personal data protection has been violated, you can turn to it after raising your request with us.