Full privacy notice

1. Identity and address of the data controller

Chenet Marcel Carreño, an individual engaged in business and professional activities, is responsible for processing personal data collected under the trade name Tlacati.

• Address: Calle Lotería Nacional 1, Interior 3, Colonia Tabacalera, Alcaldía Cuauhtémoc, C.P. 06030, Ciudad de México.
• Email for privacy and ARCO rights: gestantes@tlacatisurrogacy.mx.
• Website: tlacatisurrogacy.mx.

2. Personal data we may process

Depending on the channel you use and what you choose to share, Tlacati may process the following categories:

Identification and contact

• Name, age or date of birth.
• Phone number, email address, city and state of residence.
• Profile name, account identifier, profile photo and conversation content on WhatsApp, Facebook or Instagram.
• Mexican nationality, naturalization or self-declared permanent residency status, when necessary to explain a program's general requirements.

Follow-up information

• Availability, contact preferences and questions about the process.
• Permission to prepare or share a descriptive profile with a specific agency, clinic or program operator.
• Follow-up notes and conversation status.

Sensitive personal data

A conversation may include general information about previous pregnancies, reproductive experience or health. These data are sensitive. Tlacati limits processing to what is strictly necessary and, before using such data to prepare or share a profile, will request express written consent, including through an electronic means that allows consent to be attributed to the data subject.

Technical website data

To understand which parts of the site are useful, we count clicks on WhatsApp, email, calls and guide downloads in aggregate, together with the originating public page and day. We also count how often a page-not-found response is displayed, without storing the failed address. These first-party counters do not use cookies or identifiers, do not store IP addresses, message content or URL parameters, and are not sent to advertising platforms. Totals are retained for up to 90 days. We respect your browser's Do Not Track and Global Privacy Control signals by omitting this measurement.

When you visit the site, the infrastructure may generate minimal technical logs, such as IP address, date and time, requested path, browser type and security events. These are used to serve content, prevent abuse and diagnose faults. These logs cannot be disabled because they are necessary to deliver and protect the site. The site has no forms, does not create user accounts and does not incorporate personalized advertising.

3. Purposes of processing

Primary purposes

• Answer questions and provide general information about the usual stages and requirements of surrogacy.
• Continue the conversation through the chosen channel and record follow-up items.
• Consider, on a preliminary and non-clinical basis, whether exploring a program with an independent third party makes sense.
• Prepare a minimal descriptive profile when the data subject asks to proceed.
• Share that profile with the agency, clinic or program operator expressly authorized by the data subject.
• Handle privacy requests, complaints, security incidents and legal obligations.
• Maintain the security, availability and technical operation of the site and contact channels.

Tlacati does not use this information to make diagnoses, medical assessments, clinical decisions or legal evaluations. Acceptance and each program's conditions are the responsibility of the third party operating it.

Secondary purposes

With permission, Tlacati may send educational information or request brief feedback to improve its guidance. You may decline from the outset or ask for this to stop at any time by writing to gestantes@tlacatisurrogacy.mx. Declining does not affect the handling of your main request.

Consent for sensitive data

Publishing this notice does not replace the express consent required to process sensitive data. If someone voluntarily sends sensitive information before giving consent, Tlacati will limit its handling to protecting the message, replying with instructions and, where appropriate, deleting or blocking it. It will not be used to prepare or share a profile until valid consent has been obtained.

4. Data transfers, processing by service providers and third-party services

Transfers requiring permission

Tlacati only transfers a profile or contact details to a specific agency, clinic or program operator when the data subject asks to proceed and expressly authorizes that disclosure. Before sharing, we explain who will receive the data and for what purpose. The data subject may refuse the transfer at no cost.

Transfers permitted by law

Information may be provided to a competent authority when there is a legal obligation or duly grounded order, or when necessary for the recognition, exercise or defense of a right.

Technology providers

To operate the site and contact channels, we use providers that may process information on behalf of the data controller, including:

• Meta Platforms: WhatsApp Business, Facebook and Instagram.
• Google Workspace and Google Cloud: email, storage, follow-up spreadsheets and infrastructure.
• Cloudflare: DNS, security, website delivery and email routing.

These providers operate under their own terms and may host or process data outside Mexico. Tlacati applies data minimization and restricted access measures. It does not sell personal data.

External links open third-party services. Their privacy notices govern processing carried out directly on their platforms.

5. How to limit use or withdraw consent

You may request at any time:

• To stop receiving educational messages or non-essential follow-up messages.
• To withdraw permission to share your profile, provided the transfer has not yet occurred.
• To withdraw consent for future processing of sensitive data.
• To limit the contact channel or hours.

Send your request to gestantes@tlacatisurrogacy.mx. Withdrawal is not retroactive and may be subject to legal retention obligations.

6. ARCO rights

The data subject may exercise the rights of Access, Rectification, Cancellation and Opposition (ARCO), as well as withdraw consent.

How to submit a request

1. Write to gestantes@tlacatisurrogacy.mx with the subject line "Derechos ARCO".
2. Include your name, the right you wish to exercise, the data involved, a clear description of your request and how you would like to receive a response.
3. Do not attach official identification to your first email. Tlacati will reply with a secure and proportionate way to establish identity or representation.

The decision will be communicated within 20 business days after receipt of the complete request. If granted, it will be implemented within the following 15 business days. These periods may be extended once when circumstances justify it, in accordance with the law.

The procedure is free, except for justified reproduction or delivery costs in a non-digital format. If you disagree with the response, you may contact the competent personal data protection authority.

7. Retention, security and incidents

Data are retained only as long as needed to handle the conversation, provide authorized follow-up and meet obligations or defend rights. Once these purposes end, data are deleted, de-identified or blocked for the applicable legal period.

Tlacati uses reasonable administrative and technical controls, including restricted access, authentication, data minimization and storage in business services. No system is infallible. If a breach significantly affects a data subject's rights, they will be informed promptly about the nature of the incident, the data affected and recommended measures.

8. Minors

Tlacati's guidance is intended for adults. We do not intentionally collect data from minors. If we discover that a minor has shared information, follow-up will stop and the information will be deleted or blocked as appropriate.

9. Changes to this notice

The current version will always be available at tlacatisurrogacy.mx/en/privacy/. Minor changes take effect upon publication. If a change substantially modifies purposes, sensitive data processing or transfers requiring consent, a new notice will be made available before that processing begins, and the relevant consent will be requested.

10. Contact

For any questions about this notice or the processing of personal data, write to gestantes@tlacatisurrogacy.mx.