Privacy notice

Who is responsible

Club Shriners de Mexicali is responsible for processing your personal data. Its legal name, tax ID, and registered address are published on the legal information page.

TODO: Club contact email and phone number for privacy matters.

What data we collect

Contact details: full name, email address, and phone number if you provide one.

Tax details, only if you request a receipt (CFDI): tax ID (RFC), legal name, tax regime, and the postal code of your registered address.

Account details, if you register: email, encrypted password, and — if you sign in with Google, Facebook, or Apple — the identifier and email that provider shares with us.

Donation details: amount, campaign, payment method, date, payment status, and the gateway reference.

We do not store your card data. The card number, expiration date, and security code are captured and held by the payment gateway; the Club only keeps the brand and the last four digits so you can recognize the charge.

Purchase data, if you buy tickets or products: which items and how many, for which event, amount, VAT, order status and the payment gateway reference.

Cart preferences: while you choose what to buy, your browser stores the items and quantities in your cart in session storage — never prices or personal data. It is cleared when you close the tab and is not sent to any third party.

What we use it for

Processing your donation and confirming that it was charged.

Issuing and sending your tax receipt (CFDI) when you request one.

Sending you emails related to your donation: confirmation, receipt, notices about your recurring subscription, and an annual summary of what you gave.

Answering your questions and handling clarifications.

Meeting the tax, accounting, and transparency obligations the law imposes on the Club.

Process your ticket or product purchase, hold your spot and get you what you bought.

Who we share it with

We share strictly what is necessary with the providers that make the platform work: Conekta and PayPal (payment processing), Facturama (filing the CFDI with the Mexican tax authority), Resend (email delivery), Supabase (database), and Vercel (site hosting).

With the Mexican tax authority (SAT) when we issue a CFDI in your name, and with any authority that requires it from us by law.

We do not sell, rent, or trade your data with anyone else, and never for advertising purposes.

How long we keep it

Data about your donations and the CFDIs we issue is kept for as long as Mexican tax law requires, which is at least five years.

Your account data is kept while your account remains open. If you close it, the data is deleted except for what we are required to keep for tax purposes.

Orders are kept for the same period as donations, under the same accounting and tax obligations.

How to exercise your ARCO rights

You may request access to your data, its correction when inaccurate, its deletion when you believe it is no longer necessary, and object to our using it for a given purpose. You may also withdraw the consent you gave us.

Without writing to us, you can correct your contact and tax details from your account and unsubscribe from courtesy emails. Emails about charges and receipts cannot be turned off while you have an active subscription: you have a right to know what you are being charged.

For everything else, write to the Club's contact address. TODO: address where ARCO requests are handled and the response time.

Changes to this notice

If we change this notice, we will publish the new version at this same address and update the date shown above.