Privacy notice

Complete notice

1. Controller identity

Controller: Aldo Giovanni Alarcón Gómez Type: Mexican individual service provider Tax regime: Régimen Simplificado de Confianza (RESICO) RFC: AAGA060728EG5 Trade name: ARCO Privacy and claims address: Calle Paseo de las Palmas número exterior 49, interior 5, colonia Jardines de las Ánimas, Xalapa-Enríquez, municipio de Xalapa, Veracruz de Ignacio de la Llave, C.P. 91196, México. In-person service is by appointment only. Privacy email: team@arco.org.mx Complaints phone: +52 228 501 5006

This address can receive correspondence, courier deliveries, notices, and claims addressed to Aldo or ARCO. It is not presented as a walk-in office and does not imply in-person service without an appointment.

2. Scope and current runtime

This Notice applies to browsing arco.org.mx and to the channels a person chooses to open from the site: email, WhatsApp, and Cal.com. The public website has no first-party form that collects PII. The Variable runs only in the browser and does not submit or persist identifiable answers.

The active public runtime for this release is:

• Vercel for hosting and delivery;
• Google Analytics 4, only after valid consent;
• Cal.com and Google Calendar for scheduling and conflict checks when the person chooses that channel;
• person-initiated WhatsApp; and
• Zoho Mail for institutional email.

Meta Pixel is not configured and remains fail-closed. There is also no public automation, web payment flow, identifiable collection in The Variable, or additional analytics platform in the runtime.

If a person advances to an assessment, contract, or program, this Notice also applies as relevant to direct contact, eligibility and English assessment, proposals, contracts, payments, coordination with a sponsor, employer, insurer, and authorities, support, emergencies, alumni, and claims. Each collection point may show a short-form notice that links to this document.

3. Data we may process

3.1 Website, contact, and scheduling

• IP address, date and time, requested route, user agent, and technical logs needed to deliver and protect the site;
• canonical route, service line, closed CTA code, and closed technical or declared channel categories, only after Analytics is accepted;
• name, email, phone number, availability, and message a person enters directly in Cal.com, WhatsApp, or email; and
• local evidence of the privacy choice and policy version.

GA4 does not receive names, email addresses, phone numbers, form answers, free text, User-ID, or arbitrary URLs. Accepting Analytics does not open Cal.com, WhatsApp, or email.

3.2 Prospect and eligibility data, if the person advances

ARCO may process name, contact details, age, city, university, degree, semester, program interest, communications, date of birth, nationality, passport, identification, student status, academic and employment history, CV, references, English level, dates, program requirements, and proof of funds when required.

3.3 Financial data, if there is a contract

ARCO may process payments, billing, RFC and tax data, account status, bank references, limited proof of funds, opaque processor identifiers, chargebacks, refunds, and reconciliation. This website does not process payments. If an approved contractual channel is enabled, ARCO will not store a full PAN or CVC.

3.4 Sensitive data

When lawfully and specifically required by the program, health, allergies, accessibility, vaccinations, background or conduct checks, sensitive immigration information, and emergency data may be involved.

ARCO will collect them only after explaining the purpose, recipient, necessity, secure channel, retention, and applicable express consent. Accepting cookies or a contract does not automatically mean consenting to all sensitive data.

3.5 Calls, meetings, and personalized content

ARCO uses the information you share to understand your profile, answer questions, and prepare a proposal or provide the service. Material agreements and decisions are confirmed in writing through the appropriate document or channel.

3.6 Technical data

IP address and basic device data may be used for security, as well as logs, date and time, route, CTA, delivery status, and evidence of acceptance, revocation, and version. Non-essential cookies or measurement operate only after the applicable choice.

4. Sources

Data may come directly from the person; from a representative when legally appropriate; from a university, reference, or third party authorized by the person; from a sponsor, employer, insurer, or authority in connection with the case; from a bank or processor if there is a contractual payment; and from the technical providers described in this Notice.

ARCO does not buy personal-data lists for campaigns.

5. Primary purposes

Depending on the stage, ARCO may use data to answer a request; schedule and prepare calls; assess eligibility, English, and fit; prepare and review a proposal; prevent fraud and verify identity; form and preserve the contract; administer milestones, payments, and refunds; identify the Designated Sponsor and coordinate the file and program pathway; assemble authorized files; coordinate documentation, insurance, and permitted administrative consular guidance; provide support and connect urgent situations with the appropriate party; meet obligations; handle rights, complaints, and disputes; and preserve evidence of material decisions.

ARCO does not decide visa, immigration, or admissibility matters on behalf of an authority.

6. Secondary and optional purposes

Promotions, newsletters, alumni, referrals, testimonials, photographs, public content, remarketing, personalized advertising, non-essential analytics, and non-anonymized internal research require a separate choice when applicable.

Rejecting them does not prevent the person from contracting or receiving the primary service. Remarketing and Meta Pixel are not active in this release.

7. Sessions and follow-up

Your booking details and the information you share are used to prepare for and address your inquiry. Decisions about acceptance, the guarantee, refunds, or eligibility require human review. You may ask for an explanation or correct the information used. A new optional purpose requires a separate choice.

8. Recipients and transfers

The active website providers are Vercel, consented Google Analytics 4, Cal.com, Google Calendar, WhatsApp, and Zoho Mail. They may process data outside Mexico according to their infrastructure and the applicable account agreements.

If there is a program relationship, ARCO may also disclose what is strictly necessary to the designated J-1 sponsor, employer or worksite, insurer, competent authorities, an approved bank or processor, and advisers bound by confidentiality.

Before H2 and before identifiable data is transferred to a sponsor, ARCO will notify the sponsor's identity, country, purpose, necessary categories, and secure channel. A sponsor change requires a new notice. Sensitive data retains separate consent when applicable.

An unknown provider or one without a verified region does not receive sensitive data.

9. Payments

The website has no active Conekta, Stripe, SPEI, PAC, or CFDI flow. The 2027 contract provides for separately instructed payments through hosted Conekta and/or Stripe flows. Card details are entered with the processor, never sent by WhatsApp or email. If a contract exists and a payment is enabled through a separate channel, ARCO may retain amount, milestone, currency, date, reference, reconciliation status, receipt, refund, and an opaque identifier or last four digits when necessary.

ARCO does not retain a full card number or CVC and does not request card data through WhatsApp, email, or a call. There is no autopay in this version.

10. Cookies and measurement

Essential remains active to deliver the website and remember the choice. Analytics is optional. A person may Accept, Reject, or Configure and later change the decision through Privacy preferences.

GA4 uses only ID G-XW0LGF5S70 and loads only after valid consent. ARCO-authored events use an allowlist of fields: canonical routes and technical categories, without messages, form contents, or free text. The configuration sent by the website disables Google Signals and ad-personalization signals and does not provide User-ID or user-provided personal data.

Meta Pixel is inactive and fail-closed. There is no additional tag or analytics layer.

The local consent receipt expires within 180 days. Local first-touch attribution expires within 30 days. Global Privacy Control keeps Analytics denied, clears local measurement state, and disables acceptance.

On rejection, expiry, or revocation, the website stops emitting events, unloads adapters, and requests deletion of known measurement cookies on ARCO's domain. Revocation does not erase data a provider received earlier; the provider's procedures and data-rights process apply to that data.

11. Consent for sensitive data and transfers

When needed, ARCO will present separate consent identifying the exact category, purpose, whether it is required, recipient and country, consequence of not providing it, retention, and revocation channel when applicable.

Accepting the contract or Analytics does not mean consenting to sensitive data or marketing.

12. Security

ARCO applies proportionate controls such as role-based least-privilege access, MFA where available, encryption in transit, environment separation, logs and versioning, incident response, no secrets or sensitive data in URLs, and verifiable deletion or anonymization.

A significant breach will be investigated and communicated according to risk and applicable law. ARCO does not promise absolute security.

13. Retention

• Local pseudonymous first-touch attribution: no more than 30 days.
• Local consent or revocation receipt: no more than 180 days. This browser record is not the contractual file.
• Hosting logs and consented GA4 events: according to the current configuration, necessary purpose, and applicable agreements; ARCO does not publish an unverified numeric period.
• Cal.com and Google Calendar bookings, Zoho email, and WhatsApp conversations: for the period needed to handle the request and applicable obligations.
• Unconverted prospect information: up to 12 months from the last meaningful interaction, unless a valid request or retention duty applies.
• Contracts, payments, receipts, refunds, and defense: for applicable statutory retention periods; the 2027 contract provides for at least 10 years for records subject to Article 49 of Mexico’s Commercial Code. This period is not stored in localStorage.
• Operational sponsor and visa file: operational closure plus 12 months, unless an obligation or claim applies.
• Passport, health, background, and sensitive source data: 90 days after sponsor or program closure, unless an obligation or specific legal hold applies.
• Backups: the same logical period, with purge no later than 90 days after the applicable deletion.

A claim or legal hold preserves only related data, with an owner and review date; it does not freeze the full file indefinitely.

14. ARCO rights, revocation, and limitation

A person may request access, rectification, cancellation, or objection; revoke consent; or limit use and disclosure through:

Email: team@arco.org.mx Subject: ARCO Rights / Privacy

The request should include the person's name and response channel, the right or consent involved, a sufficient description, and only the documents strictly necessary to verify identity or representation. ARCO uses proportionate verification and responds within applicable legal periods.

15. Minors

Summer Work Travel is directed to adults. ARCO will not knowingly collect a minor's data without reviewing capacity, representation, necessity, and applicable consent. A minor's inquiry is limited to general guidance until that path is resolved.

16. Automated decisions

ARCO may use scoring, summaries, or suggestions as support. Aldo or an authorized person reviews material decisions. A person may request an explanation or correction of material information used.

No automated agent independently decides acceptance, payment, suspension, refund, guarantee, or a sensitive transfer.

17. Changes

An update applies prospectively from its date. Material changes to purpose, recipient, sensitive data, or technology will be communicated and, when appropriate, require a new choice.

Continued use of the website does not automatically turn a new optional purpose into consent.

18. Contact and authority

First channel: team@arco.org.mx.

A person may also contact the competent federal authority for personal data held by private parties. ARCO does not publish a name, portal, or procedure that has not been verified as current.

19. Cal.com short-form notice

Both public ARCO events display exactly one required checkbox:

He leído el Aviso de Privacidad (https://arco.org.mx/privacy-es) y solicito que ARCO utilice estos datos para preparar y realizar esta sesión.

It does not provide consent for marketing or other optional purposes. The booking cannot be completed without this acknowledgement.