This English version is provided for convenience. In the event of any inconsistency, the Spanish version shall prevail, unless applicable law requires otherwise.
Comprehensive Privacy Notice
This Privacy Notice is issued under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and other applicable Mexican regulations. It explains which personal data we process when you use GALD Empresa, GALD PyME, or our contact channels, what we use it for, who we share it with, and how you can exercise your rights.
01Data controller#
Grupo Amodio Garza, S.A. de C.V. (“GALD Partners”, “we”, or the “Controller”), a company incorporated under the laws of the United Mexican States and domiciled in San Pedro Garza García, Nuevo León, Mexico, is responsible for the processing, use, and protection of the personal data we collect through the GALD platform (the “Platform”) and any other contact channel.
For any matter related to the protection of your personal data, write to hello@galdpartners.com or use the channels described in the Privacy office section of this Notice.
02Personal data we collect#
For the purposes described in this Notice, we may collect the following categories of personal data:
- Identification and contact
- Full name, email address, phone number, and job title within the company.
- Tax and business
- Tax ID (RFC or equivalent), economic sector, industry, country, tax regime, and number of employees.
- Financial and asset
- Your company’s revenue, outflows, costs, expenses, debt, cash, assets, liabilities, equity, and cash flow.
- Payment
- Billing information handled by our payment processors. We do not receive or store your full payment card numbers.
- Browsing
- IP address, browser type, operating system, session dates and duration, and language preference.
- Interaction
- Questions asked to the AI CFO and GALD AI, files you upload, reports generated, and account settings.
- If you turn on that channel: your phone number and the content of the alerts, signals, and messages exchanged with GALD.
Financial and asset data
We process your company’s financial and asset data, for which we request your express consent when you accept this Notice at registration. We apply reinforced security measures to protect it.
We do not collect sensitive personal data such as racial or ethnic origin, health status, genetic information, religious, philosophical, or moral beliefs, union membership, political opinions, or sexual preference.
03Purposes of processing#
Primary purposes (necessary for our legal relationship and to provide the service)
- Create, authenticate, and maintain your user account on the Platform.
- Generate financial diagnoses, the Score G, signals, and analysis based on the data you enter.
- Produce executive reports, valuations, scenarios, and personalized recommendations.
- Answer the questions you ask the AI CFO and GALD AI.
- Send you alerts, signals, and support messages over WhatsApp, when you turn on that channel or request it.
- Process payments, issue tax receipts, and manage your subscription.
- Handle technical support requests, questions, and complaints.
- Comply with applicable legal, tax, and contractual obligations.
- Detect, prevent, and investigate fraud, abuse, and violations of our Terms and Conditions.
Secondary purposes (not essential; they require your consent, and you may object without affecting your access to the service)
- Send you marketing communications, product news, and educational content.
- Carry out aggregated, anonymous statistical analysis to improve the Platform.
- Invite you to surveys, beta tests, events, and pilot programs.
Informational automated decisions
The Score G, agent signals, and the recommendations of the AI CFO and GALD AI are generated through automated processes. These assessments are informational: they have no binding legal effect, do not execute transactions, and do not replace specialized professional advice. You may request human review of any result by writing to hello@galdpartners.com.
04How to limit use or disclosure#
You may limit the use or disclosure of your personal data at any time through the following means:
- Changing your communication preferences from your user panel on the Platform.
- Using the unsubscribe link included at the bottom of every marketing email.
- To stop receiving WhatsApp messages, writing to hello@galdpartners.com with the phone number you want to remove.
- Sending your request to hello@galdpartners.com with your identification details and the scope of the limitation.
We will respond to your request within 20 business days at most.
05Processors, providers, and transfers#
GALD Partners does not sell or trade your personal data. To provide the service we rely on the following processors, which handle data on behalf of GALD Partners and only for the stated purpose:
- Amazon Web Services (AWS) — Platform hosting, database, account authentication, and storage of the files you upload, including your profile photo and your company logo.
- Anthropic — operation of the AI CFO, GALD AI, and assisted document reading. It receives the question you type and the financial data of your company that forms the context of the analysis; when you use assisted extraction, it also receives the content of the files you upload. It does not receive your credentials or payment data.
- Stripe and PayPal — payment processing and subscription management. They receive your email address and the payment details you enter directly in their forms.
- Resend — delivery of Platform emails. It receives the recipient address and the message content, which for executive reports includes your company’s financial figures.
- Meta Platforms, through the WhatsApp Business Platform — delivery of alerts, signals, and support messages over WhatsApp. It receives your phone number and the content of each message. This processing only happens if you turn on that channel or write to us on WhatsApp.
We may also transfer data to:
- Competent authorities, when there is a duly founded and reasoned request.
- Professional advisors (accountants, auditors, lawyers) under a strict duty of confidentiality.
- Legal successors in the event of a merger, spin-off, or acquisition of the company, subject to the terms of this Notice.
Processing outside your country
Some providers may process and store data in facilities located outside the country where you are, including outside Mexico. These transfers are made to fulfill the legal relationship between you and GALD Partners, and our providers are contractually bound to protect the information.
06ARCO rights#
You have the right to Access, Rectify, and Cancel your personal data, and to Object to its processing (ARCO rights):
- Access
- Know what personal data we hold about you, the purposes of processing, and the conditions of use.
- Rectification
- Request the correction of inaccurate, incomplete, or outdated personal data.
- Cancellation
- Request the deletion of your data when you consider it unnecessary or improperly processed.
- Objection
- Object to the processing of your data for specific purposes when there is a legitimate reason.
Procedure
- Send your request to hello@galdpartners.com with the subject “ARCO request”.
- Include: (i) your full name and a way to send you our reply; (ii) a copy of a current official ID; (iii) a clear description of the right you are exercising; (iv) the personal data the request concerns.
- If you act on behalf of someone else, you must prove your authority to represent them under applicable law.
We will respond within 20 business days of receiving your request. If the request is granted, the corresponding measures will be carried out within the following 15 business days.
Limitations
The exercise of ARCO rights may be limited when there is a legal obligation to retain your data, when it would obstruct ongoing judicial or administrative proceedings, or when necessary to protect the rights of third parties.
Rights under local law
Depending on the country where you are located, you may have additional rights under applicable local law. You can exercise them by writing to hello@galdpartners.com.
07Withdrawal of consent#
You may withdraw the consent you have given us for the processing of your personal data at any time, using the same procedure described for exercising ARCO rights.
Please note that withdrawing consent for primary purposes may mean closing your account and being unable to keep using the Platform, since processing the data is essential to provide the service. Withdrawal has no retroactive effect.
09Security measures#
We have implemented administrative, technical, and physical measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing:
- Encryption in transit via HTTPS/TLS 1.3 for all communications.
- Encryption at rest (AES-256) for databases and backups.
- Session authentication with AWS Cognito and cryptographic password hashing.
- Role-based access control and least privilege for authorized staff.
- Audit logs of access to sensitive data.
- Automatic backups with geographic redundancy.
- Periodic security testing and incident response.
- Staff training on data protection.
No security system is infallible. If we detect a security breach that affects your personal data, we will notify you without undue delay, as required by law. See also our Security page.
10Minors’ data#
The Platform is not intended for anyone under 18, and we do not knowingly collect personal data from minors. By using GALD you confirm that you are of legal age and have the legal capacity to enter into contracts.
If you become aware that a minor has provided personal data through the Platform, please let us know at hello@galdpartners.com so we can delete it.
11Changes to this Privacy Notice#
GALD Partners may modify, update, or supplement this Notice to reflect legal changes, best practices, new service requirements, or internal policies. Any material change will be notified through:
- A prominent notice on the Platform when you sign in.
- An email to the address we have on file.
- Publication of the updated version on this page, stating its version number and last-updated date.
We recommend reviewing this Notice periodically. It is published in Spanish and English; the Spanish version prevails.
12Privacy office#
For any question, inquiry, complaint, or request to exercise your data protection rights, you can reach us through the following channels:
- Location
- San Pedro Garza García, Nuevo León, Mexico
- Legal name
- Grupo Amodio Garza, S.A. de C.V.
- Response time
- 20 business days at most
If you believe your right to the protection of your personal data has been violated, you may contact the competent data protection authority.