Privacy and personal data
Privacy notice
This page explains what personal data Passway processes, why, who it is shared with, and how you stay in control. It follows Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). The Spanish version is the authoritative text.
Data controller
The controller of your personal data is Santos & Becker, Sociedad Civil, tax ID (RFC) BGM200515CN2, with registered address at Calle Prado Norte 135, offices 201 and 205, Lomas de Chapultepec III Sección, Miguel Hidalgo, Mexico City, ZIP 11000, Mexico.
Passway is the mobile application and website the controller provides so you can track the validity of your immigration and travel documents and receive reminders before they expire.
Personal data requests are handled by the Santos & Becker personal data team. You can write to osantos@santosbecker.com.
Personal data we process
We only process what you enter or what the service needs to work. We do not buy data sets and we do not enrich your profile from outside sources.
- Identification and contact: full name, email address, phone number, time zone, and application language.
- Document details: document type (passport, visa, travel insurance, or other), the title you give it, issuing country, document number, issue date, expiry date, and any notes you write.
- Images and files: photos or files of immigration documents you choose to upload. Uploading is optional.
- Secondary contact: the name and email of the person you designate to also receive expiry alerts. That person must confirm before receiving any notification.
- Operational data: push notification identifiers, device platform, a log of reminders sent, and document access audit records.
- Website form data: if you write to us from passway.com.mx, we process the name, email, phone, and message you send.
Immigration documents and sensitive data
The image of a passport, visa, or immigration document can reveal sensitive information such as nationality, place of birth, or immigration status.
That is why file storage is private, each account can read only its own records, and every query made by firm staff is written to an audit log.
Where processing this data requires express consent under article 9 of the LFPDPPP, the application asks for it before continuing. You can also use Passway by recording dates only, without uploading any image.
Primary purposes
These purposes are necessary to provide the service. If you object to them, we cannot operate your account.
- Create your account, authenticate you, and keep your session secure.
- Store your document expiry dates and show them ordered by urgency.
- Calculate and send reminders by push notification and email, with the lead time you configure.
- Store and display the document files you upload.
- Notify your secondary contact, when you designate one and that person confirms.
- Handle support requests, ARCO rights requests, and account deletion requests.
- Prevent unauthorized access, detect failures, and keep security and audit logs.
- Follow up on service requests you start with the firm from the application.
Secondary purposes
These purposes are not necessary for the service. You can refuse them and your account keeps working the same way.
- Measure in aggregate how the website is used, to improve the product.
- Send you information about new Passway features or about the firm's services.
How to refuse secondary purposes
On the website: decline analytics in the notice shown on your visit, or change your decision later from the site footer.
In the application: adjust your preferences in the privacy and consent section of your profile.
In writing: send your refusal to the address listed under ARCO rights. Refusing does not affect the service.
Legal basis
This notice is issued under Mexico's Federal Law on Protection of Personal Data Held by Private Parties, its Regulations, and the applicable Privacy Notice Guidelines.
Processing for primary purposes rests on the service relationship you request and, where the law requires it, on your express consent.
When you hire an immigration service from the firm, Santos & Becker additionally processes your identification data under the client-identification and record-retention duties that apply to it as a provider of legal services.
This notice is governed by the Federal Law on Protection of Personal Data Held by Private Parties published in the Official Gazette on March 20, 2025 and in force since March 21, 2025.
Providers that process data on our behalf
To operate Passway we use providers acting as processors: they handle data only on the controller's instructions and cannot use it for their own purposes.
- Supabase: authentication, database, and private storage of the files you upload.
- Resend: delivery of reminder emails.
- Expo: push notification service, which in turn relies on Apple and Google services to deliver the message to your device.
- Sentry: technical diagnostics for errors and crashes in the mobile application.
- PostHog: website analytics, only if you accept analytics.
- monday.com: record of contact requests sent from the website.
- Vercel: hosting for the public website.
Transfers
We do not sell, rent, or trade your personal data.
The providers above store and process information outside Mexico, mainly in the United States: the Passway database and files reside in Supabase's us-east-1 region. They are processors acting solely on behalf of Santos & Becker and under its instructions, under the terms of service and data processing agreements signed with each one; a remittance to a processor does not require your consent.
Beyond that transmission to processors, we do not transfer your data to third parties without your consent, except in the cases the LFPDPPP allows without it: when required by law or treaty, when a competent authority requires it, when necessary to address a medical emergency, or when necessary to perform a contract entered into in your interest.
Beyond the processors listed above, Santos & Becker does not transfer your personal data to third parties, except where required by law or by a competent authority. If the firm ever needs to transfer your data to a third party, it will inform you and obtain your consent where the law requires it.
Firm access to your documents
Firm staff cannot read your documents by default.
Each access requires your authorization from the application, either document by document or through a time-limited grant you can revoke at any moment.
Every authorized query is recorded with the date, the person who accessed it, and the reason. You can review that log from your account.
Retention
We keep your data while your account is active.
When you delete your account, the profile, expiry records, uploaded files, notification identifiers, and associated consents are deleted.
Some security and audit records may be retained where a legal obligation or record integrity requires it, limited to that purpose and period.
Access logs and client files are kept for 5 (five) years from the closing of the file or the deletion of your account, in line with the accounting and tax retention period set out in article 30 of the Federal Tax Code and the firm's professional obligations. After that period they are deleted or anonymized.
Security measures
We apply technical and administrative controls proportional to the risk: account authentication, strict per-user isolation of records in the database, private file storage, encryption in transit, and access logging.
No measure removes risk entirely. If a security breach significantly affects your rights, we will tell you without delay so you can act.
ARCO rights
You have the right to access your personal data, rectify it when inaccurate, cancel it when you consider it is not needed for the purposes in this notice, and object to its processing for a specific purpose.
To exercise them, send your request to osantos@santosbecker.com, or file it in writing at Calle Prado Norte 135, offices 201 and 205, Lomas de Chapultepec III Sección, Miguel Hidalgo, Mexico City, ZIP 11000, Mexico, on business days from 9:00 to 18:00, addressed to the Santos & Becker personal data team. Exercising these rights is free of charge.
Your request must include:
- Your name and how you want to receive the response.
- A copy of official identification or of the document proving legal representation.
- A clear description of the data the right is exercised over.
- Anything that helps locate your data, such as the email you registered with.
- For a rectification, the correction requested and supporting documentation.
Response deadlines
Unless the framework in force sets a different period, we will answer your request within 20 business days of receiving it and, if it is well founded, act on it within the following 15 business days.
Santos & Becker will communicate its decision within a maximum of 20 (twenty) business days from receiving your request and, where the request is well founded, will act on it within the following 15 (fifteen) business days. Both periods may be extended once for an equal period where the circumstances justify it. The response is delivered through the same channel you used to send the request.
You do not need a written request to delete your account: you can do it directly in the application.
Withdrawing consent
You can withdraw the consent you gave for the processing of your data at any time.
In the application you can revoke firm access to a document, turn off notification channels, remove your secondary contact, and delete your account.
For anything you cannot do in the application, write to us through the same channel listed for ARCO rights. We will confirm receipt and the effect of the withdrawal.
Withdrawal is not retroactive and may prevent us from continuing to provide the service; if so, we will tell you before acting on it.
Limiting use or disclosure
Beyond ARCO rights, you can ask us to limit the use or disclosure of your data, for example to stop receiving communications about the firm's services.
We record the request in an internal exclusion list and confirm in writing the date it takes effect.
Minors
Passway is designed for an adult to manage their own documents and, where applicable, their family's.
If you record a minor's document, you state that you hold parental authority or guardianship, or that you are authorized to do so.
Passway lets you register other people's documents, including minors, under your own account. In doing so you represent that you hold the authorization needed to process that data, or that you hold parental authority or guardianship over the minor, and you take on the duty to inform them of this notice. Santos & Becker does not create accounts in the name of minors.
Changes to this notice
We may update this notice for legal changes, new product features, or changes in our practices.
The version in force will always be published on this page with its last-updated date, and reachable from the legal section of the application.
If a change materially alters purposes or transfers, we will notify you by email and inside the application before it takes effect, and ask for your acceptance where the law requires it.
Data protection authority
If you believe your right to personal data protection has been violated, you may file a complaint with the competent supervisory authority in Mexico.
Since March 21, 2025 the supervisory authority for personal data held by private parties is the Secretaría Anticorrupción y Buen Gobierno, which took over the functions of the former INAI. You can consult the current procedure for filing a complaint on the Mexican government portal.
Contact
For questions about this notice: osantos@santosbecker.com.
For help with the application, see the support page.