Privacy Notice
Operator and Privacy Contact
Confirmalia is operated by CHAMBITA LAB S.A.P.I de C.V., located at Calle Doctor José Luna Ayala Número 120, Interior C3, Colonia San Jerónimo, Monterrey, Nuevo León, C.P. 64640, Mexico. This Notice covers the personal data processed through our website, applications and event features, including data provided by Organizers and guests. The operator is responsible for account data and processing for its own purposes; its role for guest data processed on an Organizer's behalf is described below.
For privacy matters or data-subject requests, contact [email protected].
1 Personal Data We Process
We may collect the following categories of personal data:
- Organizer identification and contact information: name, email address, telephone number, access credentials, and organization (if applicable).
- Billing and transaction data: legal business name (if applicable), RFC tax ID (optional for invoicing), tax address (if applicable), and payment-method references through external processors.
- Service usage: event settings, invitations, contact lists, messages, notices and reminders, delivery and reading status, RSVP status, answers to questions, QR passes, check-in records, tables or groups and information in guest portals.
- Guest data (uploaded by Organizers): names, WhatsApp or telephone numbers, email addresses when provided, companions, assigned places, custom fields, notes and responses. Guests may also provide information directly through messages, forms or their portal. When the album is enabled, photographs, uploader information and technical file metadata may be processed.
- Technical data: IP address, approximate location derived from technical signals, device and browser information, usage and error logs, identifiers for notifications, cookies and local storage, campaign attribution and registration or purchase events.
Event questions or free-text responses may reveal sensitive data, such as allergies, health conditions or religious beliefs. Organizers must collect only what is needed, explain the purpose to guests and obtain the express consent, including written consent where required, of the data subject or authorized representative. Do not provide unnecessary sensitive information, identity documents or full payment credentials.
2 Purposes of Processing
We will process your personal data for the following purposes:
- Primary: providing the requested event features; creating and managing accounts; authentication, security and abuse prevention; sending authorized communications through available channels; recording confirmations, responses and check-in; operating portals and albums; sending service notifications; support; payments, credit purchases, billing and compliance with legal obligations.
- Secondary: product improvement, usage analytics, advertising attribution and measurement of registration and purchase conversions, satisfaction surveys and promotional communications to account holders with the consent required by law. Refusing these purposes does not prevent access to the basic event service.
You may opt out of secondary purposes at any time by writing to [email protected] .
Confirmalia does not sell guest contact details or use guest lists for its own unrelated marketing or to contact guests for purposes unrelated to the authorized event service. This does not prevent the necessary processing by messaging and other service providers described below, or disclosures required by law.
Some features use automated processing, including artificial-intelligence services, to classify event questions and identify relevant information in responses, such as place adjustments or dietary restrictions. The question and response text may be processed by providers of these features and may contain personal data written by the guest. Results support the Organizer's review and may be incorrect; they are not a medical assessment or a substitute for checking the original response with the guest.
3 Consent Basis and Organizer Responsibility
The Organizer determines the event purposes and must have a lawful basis, provide the required notices and obtain the permissions needed to process guest data and send messages. Confirmalia acts as a data processor with respect to guest data uploaded by Organizers and as a data controller with respect to Organizer and account-holder data and processing for its own disclosed purposes. These roles do not exempt Confirmalia from its own confidentiality, security and data-protection obligations. Reading this Notice or receiving an invitation does not replace express consent where required.
4 Transfers and Data Processors (Service Providers)
We use service providers for hosting, storage and content delivery; WhatsApp and SMS messaging; email and push notifications; payments and app-store transactions; support; analytics and advertising measurement; and automated question and response processing. The data involved depends on the function: for example, messaging requires the recipient and message content, while payment processing concerns the purchaser and transaction. Service providers may act as processors or, for their own purposes, as independent controllers under their applicable terms.
Data may be processed through providers operating outside Mexico. Applicable data-protection requirements must be respected, including the consent or legal exception and international-transfer safeguards required in each case. The fact that processing is useful to the Service does not, by itself, replace a legally required consent. We may also disclose the necessary information in response to a legally valid request from a competent authority.
The Organizer and people with access authorized by the Organizer can consult guest information for the event. Guest links, QR passes, reports and album content may make information accessible to people holding the corresponding link or access. Take care when sharing them. Third-party links or embedded content, such as maps or videos, may also involve processing by the external provider under its own notice.
6 Security Measures
Confirmalia's security obligations include maintaining administrative, technical and physical measures appropriate to the nature of the data and the risks of processing, and confidentiality duties for people authorized to handle it. No system is completely infallible. In the event of an incident, the required protective measures and notices will be determined under applicable law. Organizers must protect their credentials and limit the access they grant to others.
7 Data Retention
Data shall be retained only for the period justified by the Service, the handling of requests, security and applicable legal obligations. When it is no longer necessary for those purposes, it shall be deleted or anonymized, following any legally required blocking period. Retention duties for billing, transactions or legal claims apply to the relevant records and do not authorize unrelated uses. The digital album is subject to the closing and retention conditions shown in the Service; download the photographs before its closing date.
Requests for account closure and cancellation of personal data will be handled through the privacy contact under the procedure below. The response shall identify the applicable scope, any legally justified retention and the measures required for data processed on Confirmalia's behalf by providers. Any retained backup data must remain restricted to its justified purpose and subject to the applicable retention and deletion rules. Messages and copies already received or downloaded by recipients remain outside Confirmalia's control; independent providers are also subject to their own applicable legal obligations.
8 ARCO Rights and Withdrawal of Consent
You may exercise your rights of Access, Rectification, Cancellation, or Objection (ARCO) and withdraw your consent by sending a request to [email protected] .
Include your name, a means to receive the response, the right you wish to exercise and enough information to locate the relevant account, event or data. For rectification, describe the correction and provide supporting information. We will request the information needed to verify your identity or representation through an appropriate channel; do not send unnecessary sensitive information. You do not need a Confirmalia account to make a request about your own guest data.
For ARCO requests under Mexican law, we will communicate our determination within a maximum of twenty days from receipt and, if the request is appropriate, implement it within fifteen days after communicating the response, subject to the legally permitted computation, requirements and extensions. Each period may be extended once for an equal period when the circumstances justify it. Where another mandatory regime provides a different applicable period or right, that regime will be respected. Requests to withdraw consent or limit secondary purposes may also be sent to the same contact; withdrawal has no retroactive effect and does not prevent legally required processing.
For data processed on an Organizer's behalf, we will coordinate with that Organizer when appropriate and explain who is responsible for handling the request. This does not prevent us from handling processing for which Confirmalia is responsible. We will communicate the outcome and, where applicable, the justified reason for a limitation or refusal. You retain the right to contact the competent data-protection authority.
9 Minors
Account contracting is directed to people with legal capacity to contract. Events may include minors as guests or in photographs; the Organizer must obtain the authorization of a parent, guardian or representative where required and limit the information collected. If you believe a minor's data was processed without the required authorization, contact us so we can investigate and take the appropriate measures.
10 Changes to This Privacy Notice
We may update this Notice to reflect changes to the Service, practices or legal requirements. We will publish the dated version on this page and communicate material changes through the Service or by email as applicable. New purposes or disclosures requiring consent will require that consent; publication of a new Notice does not replace it.
11 Acceptance and Terms
By using the Service, you acknowledge that you have read and understood this Privacy Notice. For more information about use of the Service, please review our Terms and Conditions.