Privacy Notice
Last updated: July 13, 2026
In compliance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and the Privacy Notice Guidelines, Ecommex makes this Privacy Notice available to you.
Identity and address of the controller
AYT DISTRIBUCIONES, S.A. DE C.V., trading under the commercial name ECOMMEX (hereinafter, "the Controller"), with offices at Calle San Juan 1570, Col. Ciudad Granja, 45010 Zapopan, Jalisco, Mexico, is responsible for the processing of your personal data. For any matter related to this notice or to your personal data, you can reach us at privacidad@ecommex.com.mx or +52 33 5195 2601.
Personal data we collect
We collect identification and contact data that you voluntarily provide when filling out quote forms, subscribing to the newsletter, or requesting information through WhatsApp, email, or phone. The data may include: name, email, phone, company, and message. We do not collect sensitive personal data.
Personal data of shipment end recipients
In the course of our warehousing, fulfillment, and distribution services, we process personal data of the end recipients of shipments —full name, delivery address, phone, and email—, provided by our clients (brands and sellers) or received from the sales platforms integrated with our operation (for example, Shopify and TikTok Shop). This data is used exclusively to prepare and dispatch shipments, track and confirm delivery, manage returns and incidents, and handle order-related inquiries. It is not used for any other purposes, nor for commercial or advertising purposes. With respect to this data, Ecommex acts as a processor on behalf of our clients (the sellers).
Purposes of processing
Your personal data is processed for the following primary purposes: responding to your quote or information request, providing commercial follow-up on the quoted service, maintaining operational communication during the commercial relationship, and issuing invoicing when applicable. As secondary purposes: sending marketing communications related to our services and producing internal statistics. If you do not want your data to be processed for secondary purposes, you can let us know by emailing privacidad@ecommex.com.mx.
Data transfers
Your data may be processed by providers acting as processors on Ecommex's behalf, strictly to operate the service: Supabase (managed database on AWS) and Vercel (application platform), both in the United States; Envia.com and the contracted parcel and last-mile carriers (name, address, and phone, to deliver shipments); Anthropic (in-app AI assistant that can only access the operational data the requesting user is already authorized to see); and Google Workspace (corporate email). Order data originating from marketplaces is exchanged with the originating marketplace to operate the order (for example, order status and tracking numbers back to TikTok Shop or Shopify). By using services hosted in the United States, your data is transferred from México to these providers as described in this notice. Data travels encrypted (TLS 1.2 or higher) and is stored encrypted (AES-256). All third parties are bound to process your data under strict confidentiality clauses and solely for the purposes described herein. We do not sell your personal data and, outside the cases described here and those legally applicable, we do not perform transfers that require your consent under article 37 of the LFPDPPP.
ARCO Rights
You have the right to Access, Rectify, Cancel, or Oppose the processing of your personal data (ARCO Rights), as well as to revoke any consent you have granted us. To exercise these rights, send a request to privacidad@ecommex.com.mx with your full name, official ID, a clear description of the right you wish to exercise, and contact details. We will respond to your request within 20 business days. If your purchase was made through a seller or marketplace, you may also exercise your rights before them; Ecommex will handle such requests as processor.
Data retention
Order data is kept for the duration of the service relationship with the seller plus up to 12 additional months to support returns and claims, unless the seller instructs earlier deletion. When a client relationship ends, personal data is deleted or irreversibly anonymized within 30 days, except for records we are legally required to keep (tax or commercial), which are retained in isolation for the corresponding statutory period.
Security measures
We implement technical, administrative, and physical security measures in accordance with the LFPDPPP and its Regulations: tenant-isolated data at the database level (row-level security), least-privilege access and multi-factor authentication (MFA) for staff, encryption of data in transit and at rest, and a documented incident-response process with notification to affected parties without undue delay (target: within 72 hours of confirming a breach).
Use of cookies and similar technologies
Our site uses cookies and tracking technologies (Google Tag Manager, web analytics) to improve experience and measure site performance. For more detail, see our Cookies Policy.
Changes to the privacy notice
Ecommex reserves the right to modify this Privacy Notice at any time. Modifications will be published on this same page, indicating the last updated date at the top. We recommend reviewing this document periodically.
Competent authority
If you believe your right to personal data protection has been violated, you may contact the National Institute for Transparency, Access to Information and Personal Data Protection (INAI) at www.inai.org.mx.