Privacy and cookies notice
Comprehensive information about personal data, retention, rights and cookies at BYNOMIO.
Last updated: October 19, 2026 · Version 2026-10-19.1.
Identity and scope of processing
Diego Sandoval Nicanor and Ismael Jesús Terrazas Contreras are jointly responsible for processing and protecting personal data in the operation of BYNOMIO X, with an address for these purposes at Calle Niños Héroes de Chapultepec, número 17, colonia Josefa Ortiz de Domínguez, código postal 03430, alcaldía Benito Juárez, Ciudad de México, México.
Both share responsibility for information administration, custody and security, customer service, commercial processing, privacy requests, ARCO rights, and data retention and deletion. The email for exercising these rights is contacto@bynomiox.com.
Personal data that may be requested
Depending on the transaction, data processed may include name, phone number, email, delivery address, necessary tax information, order details and payment receipts. Logos, images, text, links and files needed to personalize cards may also be processed; these materials may contain personal data.
Only necessary information will be requested. Sensitive data, passwords, access codes and full bank card details are not requested through the website. The customer must have authorization to supply other people’s information or materials.
Primary purposes
Handling inquiries; confirming and managing purchases and payments; preparing proposals and authorized changes; recording design and link approval; producing and programming the card; coordinating delivery; issuing the corresponding CFDI; and handling warranties, claims, legal obligations and the defense of rights connected with the transaction.
Both controllers may access information necessary for these purposes and are subject to confidentiality duties. Financial or asset-related data will be processed with express consent where required or under the applicable legal exception for purchase obligations; unnecessary information is not requested.
Future business relationship and optional purposes
With a sufficient legal basis or customer authorization, minimal contact information and history may be retained to facilitate future purchases requested by the customer. This purpose must be separately disclosed and documented; the customer may object without affecting their purchase, invoicing or warranty.
Databases are not sold or traded. Promotional campaigns, advertising distribution or addition to marketing lists will not occur without compliance with applicable disclosure and consent rules. Permission to produce a design does not authorize publishing it as a testimonial or advertisement.
Service providers, disclosures and transfers
WhatsApp Business, administered by both controllers, is used for commercial communication; Cloudflare hosts and distributes the website; and business email is used for support and privacy requests. These services may process technical and communication data in Mexico or other countries according to their roles and policies.
DHL, FedEx or Estafeta may be used to deliver orders according to coverage, availability and shipment characteristics, without exclusivity or any claimed business partnership. Only recipient, contact and address details necessary for delivery will be shared. Invoicing is performed by the person responsible for each transaction using legally applicable tax mechanisms, without attributing it to specific software.
Providers acting on behalf of the controllers must follow their instructions and confidentiality duties. Disclosures to independent controllers necessary to fulfill the purchase, and to authorities, will have the applicable legal basis; for any other transfer requiring consent, the recipient and purpose will be disclosed and consent requested beforehand. Data is not sold or transferred for others’ advertising.
WhatsApp and other external services operate under their own policies. BYNOMIO does not control all copies on other people’s devices or platforms and cannot guarantee their deletion. BYNOMIO’s policy does not replace those services’ terms.
Retention according to purpose
Inquiries without a purchase will be reviewed for blocking or deletion 12 months after the last interaction. Minimal customer contact information and history, where there is a documented legitimate purpose or sufficient authorization for future purchases, will ordinarily be retained for up to 24 months after the last relevant commercial interaction. Unilateral advertising does not restart the period, and everything is not retained indefinitely.
Conversations are retained according to the purpose they evidence: an inquiry, active transaction or authorized minimal history. While an order, payment, warranty or claim is active, only what is necessary to handle it is kept. Review will take place at least every 12 months; any extension requires a specific reason, reviewable period and legal basis. There is no universal automatic deletion on the 91st day of inactivity.
Design files will ordinarily be retained for 90 calendar days after delivery. A minimal approval record or an item necessary for a claim or legal duty may be kept separately with restricted access; this does not authorize indefinite retention of all original files.
Tax documents and receipts subject to statutory retention duties will be retained for the applicable periods. Article 30 of the Código Fiscal de la Federación establishes general five-year rules and special cases; calculation depends on the relevant returns and legal effects, rather than a universal period starting at purchase. This does not justify retaining complete conversations unnecessarily.
These periods are operational limits subject to review and each record’s legal obligations, rather than automatic deletion functions. Both controllers will review records, separate documents subject to statutory retention and document the reason and duration of any additional retention. Once the purpose expires, data in chats, files and copies under their control will be blocked and deleted where appropriate.
To request deletion, write to contacto@bynomiox.com. After proportionate identity verification, chats, designs and files will be located; the response will explain what can be deleted and what must be retained for a legal duty or claim. Actions will be documented, linked devices and backups controlled by both operators reviewed, and the outcome communicated. Automatic deletion of copies held by WhatsApp, recipients or providers outside their control is not promised; appropriate requests to those providers will be pursued.
ARCO rights, withdrawal of consent and restrictions
You may request access, rectification, cancellation or objection concerning your data, withdraw consent where appropriate, or restrict its use or disclosure. Use the official email, WhatsApp or address below. State your name, a response channel, the relevant data and your specific request. Identity or representation will be verified proportionately and securely.
A decision on an ARCO request will be communicated within a maximum of twenty business days from receipt and, if approved, implemented within fifteen business days after the response, subject to justified extensions permitted by law. You will be informed if clarification or completion of the request is necessary under the applicable procedure. Exceptions to deletion or statutory retention will be explained; withdrawal of consent does not retroactively alter lawful acts or prevent fulfillment of existing obligations. Exercising these rights is free, except for legally permitted reproduction or delivery costs.
To object to the optional future-relationship purpose, you may state that you do not want your contact details retained for new purchases. This does not require deletion of information that must legally be kept for the current transaction.
Security, browsing and updates
Access controls, confidentiality and device and backup protection appropriate to the data must be applied. Breaches and related notifications will be handled as required by law. Invulnerability or an unimplemented technical measure is not promised.
This version does not include customer accounts, an order database or advertising analytics. Opening WhatsApp takes you to an external service; simply clicking a prepared link does not send a message. Cloudflare processes technical data, such as IP addresses, requests and browser information, necessary to deliver and protect the website under the contracted service and its privacy policy. BYNOMIO does not invent a uniform retention period for records managed by that provider.
Changes will be communicated on this page with its date and version and by direct notice where legally necessary. A new purpose requiring consent is not retroactively authorized by updating this text.
Privacy and ARCO rights contact
Persons equally responsible for administration and operation: Diego Sandoval Nicanor and Ismael Jesús Terrazas Contreras. Service and claims address for both: Calle Niños Héroes de Chapultepec, número 17, colonia Josefa Ortiz de Domínguez, código postal 03430, alcaldía Benito Juárez, Ciudad de México, México.
Official WhatsApp Business, administered by both: +52 55 3985 8462. Official email: contacto@bynomiox.com.
Service is available Monday through Saturday, from 9:00 a.m. to 7:00 p.m., central Mexico time (America/Mexico_City). Sundays and public holidays are not regular service days.
We aim to reply as soon as possible, no later than the business day following receipt of an inquiry or complaint. Messages received outside service hours will be handled starting on the next business day.
This timeframe applies only to the initial response, not necessarily to the final resolution of a complaint, return or warranty claim. It does not change applicable statutory deadlines or those for exercising privacy rights.
Both controllers handle privacy requests. State whether you seek access, rectification, cancellation, objection, withdrawal of consent or restriction of data use or disclosure.