Legal.

Comprehensive Privacy Notice

This notice is issued in compliance with Articles 14, 15 and 16 of the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette of the Federation on March 20, 2025, as last amended on November 14, 2025.

1.1 Identity and address of the data controller

Legal name: Plexia Institute, A.C.

Legal status: Mexican nonprofit civil association

Incorporation: August 5, 2026, before Notary Office No. 202 of Mexico City

Address: Monterrey 8, Roma Norte, Cuauhtémoc, CDMX, 06700, Mexico

Website: plexia.org

Personal data: legal@plexia.org

Requests to exercise rights and questions about this notice are handled by the person designated for personal data protection, under Article 29 of the LFPDPPP, through the email address above.

1.2 Personal data processed

The data vary according to each person’s relationship with the institute. They are listed by category, under Article 15, section II of the LFPDPPP.

Subscribers and prospective participants

Name; email address; collaboration interests and, where indicated, the program of interest; and the content of the free-text comments field, whose length is determined by the person submitting it.

People who contact us by email

Name; email address; and the content of the message and its attachments.

Participants in events, webinars and outreach activities

Name; email address; stated affiliation; and, where an activity is broadcast or recorded, the participant’s image and voice, with prior notice at the beginning of the session.

Authors and reviewers of publications

Name; affiliation where applicable; ORCID (Open Researcher and Contributor ID) where available; biography; portrait; academic contact email; and declarations of conflicts of interest and authorship contributions. Some of these data are published with the work, because attribution is a condition of open access.

Website visitors

IP (Internet Protocol) address, browser and device type, language, pages viewed, visit source and timestamps, collected automatically by the hosting platform and its analytics tools.

Sensitive personal data. In the processing covered by this notice, Plexia Institute does not collect sensitive personal data within the meaning of Article 2, section VI of the LFPDPPP. Activities that require such data are listed in section 2 and governed by their own notices and consents. If the institute processes sensitive data, it will obtain the data subject’s express written consent through a handwritten signature, electronic signature or other authentication mechanism, under the first paragraph of Article 8, and will create databases containing such data only where there is a legitimate, specific purpose consistent with its explicit aims, under the second paragraph of the same article.

People writing by email or in a form’s free-text field decide what information to include. Please do not provide health data, beliefs, political opinions or other sensitive information through these channels: the institute does not request it, and these channels are not designed to receive it.

1.3 Purposes of processing

The purposes are distinguished according to their relationship with the person’s request and the applicable choice. The basis for each type of processing is explained in section 1.4. Submitting the general form does not constitute a newsletter subscription.

Primary purposes necessary for the relationship

• Responding to messages, information requests and applications.
• Recording proposals and following up on agreed forms of collaboration.
• Registering participants and providing access to events, webinars and outreach activities, and issuing attendance certificates where applicable.
• Managing the editorial process: submission, review, correction, publication and attribution of authorship.
• Sending the newsletter and institutional communications to those who requested them.
• Meeting the legal, tax and accountability obligations of a civil association.
• Maintaining website security and preventing abusive or fraudulent use.

Secondary purposes requiring consent, which may be declined

• Inviting people to activities, calls and projects other than the one for which they registered.
• Producing aggregate audience and publication-reach statistics.
• Using images, voices or testimonials collected at an event in the institute’s communications materials.

Declining secondary purposes does not condition or affect the relationship with the institute. To do so, write to legal@plexia.org or use the unsubscribe link included in each newsletter.

1.4 Legal basis and consent

Processing is based on the data subject’s consent under Article 7 of the LFPDPPP and on the circumstances under Article 9 in which consent is not required, particularly where processing is necessary to fulfill obligations arising from a legal relationship.

The website form obtains consent through a specific acceptance checkbox, unchecked by default, which the person voluntarily selects before submitting their data. For electronic collection, a simplified privacy notice referring to this document is made available, under Article 16, section II.

1.5 Transfers and data processors

Transfer clause. Plexia Institute does not transfer personal data to third parties other than the processors listed below. If a future activity requires a transfer subject to consent under Article 35 of the LFPDPPP, prior, express and specific consent will be requested, and the data subject may refuse without any consequence for the existing relationship. To express refusal of any future transfer now, write to legal@plexia.org.

Processors handle data on behalf of the institute, under its instructions and without purposes of their own. As of the date of this notice, they are the following.

• Automattic Inc. (WordPress.com and Jetpack), United States of America: website hosting, forms, transactional email and audience analytics.
• Google LLC, United States of America: institutional email, office software and institutional collaboration tools.

The institute’s hosting and email operate on infrastructure located outside Mexico. When a new processor is engaged, this section will be updated under the procedure in section 1.12.

1.6 Options and means to limit use or disclosure

Anyone may request inclusion of their data in an internal exclusion list, preventing communications other than those strictly necessary for an ongoing relationship. Requests must be sent to legal@plexia.org and take effect within five business days of confirmation. Each newsletter includes an unsubscribe link with immediate effect.

1.7 ARCO rights, withdrawal of consent and procedure

ARCO rights are the rights of access, rectification, cancellation and objection recognized in Articles 22 to 26 of the LFPDPPP. Every data subject may learn which of their data the institute processes and for what purpose; request correction of inaccurate or incomplete data; request erasure where they consider the data unnecessary for the purposes of this notice; and object to particular processing or to the use of their data for automated decisions without human intervention.

Consent may be withdrawn at any time, without retroactive effect, under the final paragraph of Article 7. Withdrawal follows the same channel and procedure as ARCO rights.

How to exercise these rights

Email legal@plexia.org with the subject line “Derechos ARCO”. Under Article 28 of the LFPDPPP, the request must include the data subject’s name and an address or means of receiving a response; documents establishing identity or, where applicable, legal representation; a clear and precise description of the data concerned; and anything that facilitates locating them. For rectification, the requested change and supporting documents must also be provided, under Article 30.

Time limits

The institute will communicate its decision within twenty business days after receipt of the request and implement it within fifteen business days after that communication. Both periods may be extended once for an equal period where the circumstances justify it, with a reasoned notice to the data subject, under Article 31.

Cost

Exercising these rights is free. Only justified reproduction, certification or delivery expenses may be charged, and delivery is free when the person supplies the medium. If the same person repeats a request within less than twelve months, a charge of no more than three times the Unit of Measurement and Update (UMA) may apply, unless the privacy notice has undergone substantial changes, under Article 34.

If the response does not satisfy the data subject, or the institute does not respond within the time limit, a data protection application may be filed with the authority within the following fifteen business days, under Article 40.

1.8 Security measures and breaches

The institute adopts administrative, technical and physical measures to protect personal data against damage, loss, alteration, destruction or unauthorized use, access or processing under Article 18: encryption in transit, identity-based access control and two-step verification, least-privilege access, backups, and a duty of confidentiality that continues for everyone involved in processing even after their relationship with the institute ends, under Article 20.

Security breaches significantly affecting data subjects’ economic or non-economic rights will be reported to them immediately under Article 19, stating the nature of the incident, the compromised data, recommendations to protect their interests and the corrective actions taken.

1.9 Retention, blocking and erasure

Data are retained for as long as the purpose justifying them and the applicable legal periods remain in effect. When no longer necessary, they are erased after blocking, under Article 10. The blocking period corresponds to the limitation period for actions arising from the relevant legal relationship, under Article 24. As an operational reference: subscription data are kept until the person unsubscribes; unsuccessful application data for twenty-four months; event data for thirty-six months; and publication-related data indefinitely, because the public record of authorship is inseparable from the published work.

1.10 Cookies and tracking technologies

A cookie is a text file a website stores in a visitor’s browser. Plexia’s website uses technical cookies required by the hosting platform to function and maintain administrator sessions, and Jetpack audience-measurement cookies that produce aggregate visit statistics. Advertising or commercial profiling cookies are not used, and browsing data are not sold. Measurement can be disabled through browser settings, a do-not-track signal or blocking third-party cookies. The design’s fonts are served from the website’s hosting or the device, without requesting fonts from Google when the page loads.

Your language preference is saved in your browser’s local storage to remember your choice on future visits. You can remove it by clearing this website’s data in your browser; this preference is not sent to an external translation service.

1.11 Minors

The general participation form is intended for adults. The institute does not knowingly collect data from people under eighteen through its forms. Where an activity is intended for children or adolescents, consent will be obtained from the person exercising parental authority or guardianship, with a specific notice written in accessible language. Anyone who discovers that a minor in their care has provided data through this website may request erasure at legal@plexia.org.

1.12 Changes to this notice

This notice may change because of legal reforms, new institute activities or changes in privacy practices. Every change is published on this page, with the last-updated date visible at the beginning and a note describing the change for the following thirty calendar days. Where a change is substantial and affects purposes for which consent was granted, registered data subjects will be informed by email before it is applied.

1.13 Authority

The competent authority for the protection of personal data held by private parties is the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), under Article 2, section XV, and Chapter VII of the LFPDPPP, acting through its competent units. Every data subject may approach it if they consider their right to personal data protection to have been infringed.

Processing governed by a specific notice

Plexia Institute’s corporate purpose includes activities whose data processing requires safeguards that a website notice cannot satisfy. These activities fall outside section 1 and are governed by their own privacy notices and consents, provided and signed at the start of each activity, at the point of collection.

• Psychological care. Mental health data are sensitive personal data. Processing requires express written consent through a handwritten signature, electronic signature or equivalent authentication mechanism under the first paragraph of Article 8 of the LFPDPPP, and is also governed by applicable health provisions and professional confidentiality. No checkbox on this website obtains that consent or can replace it.
• Participation in research protocols. Each protocol has its own informed consent, approved by the relevant ethics committee, describing the procedure, risks, data handling and the right to withdraw at any time without consequence.
• De-identified databases for scientific purposes. Secondary use of data for research is authorized separately from the consent for the activity that generated them and uses de-identified data, meaning data that do not allow the data subject to be identified.

These activities are described here for transparency about the institute’s purpose. Their actual provision is subject to meeting the institutional and health requirements applicable to each. Pending fulfillment of those requirements, the institute does not collect the corresponding data through this website.

Legal notice and terms of use

3.1 Operator

The domain plexia.org and this website are operated by Plexia Institute, A.C., at Monterrey 8, Roma Norte, Cuauhtémoc, CDMX, 06700, Mexico. The contact for legal matters is legal@plexia.org.

3.2 Nature of the content

The website brings together research, essays, reflection, educational resources, tools and collaboration proposals. Each work should make its nature, sources, scope and limitations understandable. An experience, a normative argument or a hypothesis does not make the same claim as an empirical result. Publishing a hypothesis is not the same as proving it. Claims of efficacy, safety or established effects require adequate support.

The content of this website does not constitute medical, psychological, legal, financial or professional advice of any kind, and consulting it does not create a professional, therapeutic or advisory relationship between the reader and Plexia Institute, A.C. or its authors. Decisions affecting health, rights or assets should be addressed to a qualified professional in the relevant field. Medical or mental health emergencies should be referred to emergency services.

3.3 Use of the website

Access is open and free of charge. Using the website to interfere with its operation, compromise its security, extract other people’s personal data or engage in unlawful conduct is prohibited. Reproduction of content is governed by section 4.

3.4 Links to third-party websites

Links to external sources are provided for verification and reference. The institute does not control those websites and is not responsible for their content, privacy practices or availability.

3.5 Availability and liability

The institute endeavors to maintain the website’s continuity and accuracy without guaranteeing freedom from interruptions or errors. Content is provided as is. To the extent permitted by law, the institute is not liable for damage arising from use of the website or decisions based on its content. Material errors are corrected and visibly recorded.

3.6 Applicable law

These terms are governed by Mexican federal law. For their interpretation and enforcement, the parties submit to the jurisdiction of the competent courts of Mexico City, waiving any other forum.

Intellectual property and open access

4.1 Content license

Unless a particular work states otherwise, content published by Plexia (newsletters, news, articles, research, books and journals) is distributed under the Creative Commons Attribution 4.0 International license (CC BY 4.0). Anyone may copy, redistribute, adapt and build upon it, including commercially, provided they give appropriate credit, link to the license and indicate whether changes were made.

4.2 How to cite

Surname, Given name. “Title of the work.” Plexia, year. URL. License applicable to the work. Attribution identifies the authors; affiliation is stated only where applicable.

4.3 What the license does not cover

• The designation Plexia Institute, the name Plexia, the interwoven infinity symbol, logos and the institute’s other distinctive signs, which are reserved and not licensed under CC BY 4.0. Use in third-party materials requires written authorization, except for nominative references for citation, reporting or commentary.
• Third-party materials incorporated into a work under their own licenses, whose terms are stated where they appear.
• Code, data, design and graphic elements, which are governed by the license expressly stated in each case. Third-party software and component licenses retain their own terms.

4.4 Authors’ rights

Publications are signed by natural persons. Moral rights are inalienable and remain with the author. Authors retain their economic rights. Publication requires agreement on the appropriate authorization or license for each work. Participation in Plexia does not transfer rights or by itself authorize publication of materials.

4.5 Claims

Anyone who believes content on this website infringes their intellectual property rights may write to legal@plexia.org, identifying the work, the basis of their right and the exact location of the material. Every substantiated claim is addressed through removal or correction.

Conflicts of interest and editorial independence

The institute’s autonomy from its funding sources and its members’ professional activities is a condition of its credibility and is therefore stated here alongside its legal obligations.

• Mandatory disclosure. Every publication includes each author’s conflict-of-interest declaration, covering financial, employment, institutional and personal ties capable of influencing the work. The absence of conflicts is also declared.
• Funding. Each work identifies its funding source. No donation, sponsorship or agreement grants the contributor a right to review, approve, condition or delay content before publication.
• Separation from professional practice. The professional practices of founders and contributors, and their clients, are separate from Plexia Institute. When Plexia offers professional care or guidance within its programs, it will identify availability, responsible persons, scope and applicable conditions. This does not amount to offering general consultancy or automatic representation. Publications and initial contact do not by themselves create a professional relationship.
• Recusal. Anyone with an interest that compromises their impartiality in a review or editorial decision recuses themselves from it.
• Corrections. Errors are corrected openly, with a visible note and date. Retractions are published with their reason, and the retracted work remains accessible with the corresponding notice to preserve the record.

Plexia · Infinity, interwoven.