Comprehensive Privacy Notice

Last updated: July 15, 2026.

1. Controller identity

Controller: Aldo Giovanni Alarcón Gómez Type: Mexican individual service provider Tax regime: Régimen Simplificado de Confianza (RESICO) RFC: AAGA060728EG5 Trade name: ARCO Privacy and claims address: Calle Paseo de las Palmas número exterior 49, interior 5, colonia Jardines de las Ánimas, Xalapa-Enríquez, municipio de Xalapa, Veracruz de Ignacio de la Llave, C.P. 91196, México. In-person service is by appointment only. Privacy email: team@arco.org.mx Operational phone: +1 (689) 275-2089

This address can receive correspondence, courier deliveries, notices, and claims addressed to Aldo or ARCO. It is not presented as a walk-in office and does not imply in-person service without an appointment.

2. Scope and current runtime

This Notice applies to browsing arco.org.mx and to the channels a person chooses to open from the site: email, WhatsApp, and Cal.com. The public website has no first-party form that collects PII. The Variable runs only in the browser and does not submit or persist identifiable answers.

The active public runtime for this release is:

Vercel for hosting and delivery;
Google Analytics 4, only after valid consent;
Cal.com and Google Calendar for scheduling and conflict checks when the person chooses that channel;
person-initiated WhatsApp; and
Zoho Mail for institutional email.

Meta Pixel is not configured and remains fail-closed. No automatic recording, transcription, or notetaker is active. There is also no public automation, web payment flow, identifiable collection in The Variable, or additional analytics platform in the runtime.

If a person advances to an assessment, contract, or program, this Notice also applies as relevant to direct contact, eligibility and English assessment, proposals, contracts, payments, coordination with a sponsor, employer, insurer, and authorities, support, emergencies, alumni, and claims. Each collection point may show a short-form notice that links to this document.

3. Data we may process

3.1 Website, contact, and scheduling

IP address, date and time, requested route, user agent, and technical logs needed to deliver and protect the site;
canonical route, service line, closed CTA code, and closed technical or declared channel categories, only after Analytics is accepted;
name, email, phone number, availability, and message a person enters directly in Cal.com, WhatsApp, or email; and
local evidence of the privacy choice and policy version.

GA4 does not receive names, email addresses, phone numbers, form answers, free text, User-ID, or arbitrary URLs. Accepting Analytics does not open Cal.com, WhatsApp, or email.

3.2 Prospect and eligibility data, if the person advances

ARCO may process name, contact details, age, city, university, degree, semester, program interest, communications, date of birth, nationality, passport, identification, student status, academic and employment history, CV, references, English level, dates, program requirements, and proof of funds when required.

3.3 Financial data, if there is a contract

ARCO may process payments, billing, RFC and tax data, account status, bank references, limited proof of funds, opaque processor identifiers, chargebacks, refunds, and reconciliation. This website does not process payments. If an approved contractual channel is enabled, ARCO will not store a full PAN or CVC.

3.4 Sensitive data

When lawfully and specifically required by the program, health, allergies, accessibility, vaccinations, background or conduct checks, sensitive immigration information, and emergency data may be involved.

ARCO will collect them only after explaining the purpose, recipient, necessity, secure channel, retention, and applicable express consent. Accepting cookies or a contract does not automatically mean consenting to all sensitive data.

3.5 Calls, meetings, and personalized content

There is no automatic recording or transcription in this release. ARCO may keep minimal manual notes, answers, interests, objections, decisions, and the human assessment needed to prepare a proposal or provide the service.

3.6 Technical data

IP address and basic device data may be used for security, as well as logs, date and time, route, CTA, delivery status, and evidence of acceptance, revocation, and version. Non-essential cookies or measurement operate only after the applicable choice.

4. Sources

Data may come directly from the person; from a representative when legally appropriate; from a university, reference, or third party authorized by the person; from a sponsor, employer, insurer, or authority in connection with the case; from a bank or processor if there is a contractual payment; and from the technical providers described in this Notice.

ARCO does not buy personal-data lists for campaigns.

5. Primary purposes

Depending on the stage, ARCO may use data to answer a request; schedule and prepare calls; assess eligibility, English, and fit; prepare and review a proposal; prevent fraud and verify identity; form and preserve the contract; administer milestones, payments, and refunds; designate a sponsor and coordinate an employer; assemble authorized files; coordinate documentation, insurance, and permitted administrative consular guidance; provide support and emergency assistance; meet obligations; handle rights, complaints, and disputes; and preserve evidence of material decisions.

ARCO does not decide visa, immigration, or admissibility matters on behalf of an authority.

6. Secondary and optional purposes

Promotions, newsletters, alumni, referrals, testimonials, photographs, public content, remarketing, personalized advertising, non-essential analytics, and non-anonymized internal research require a separate choice when applicable.

Rejecting them does not prevent the person from contracting or receiving the primary service. Remarketing and Meta Pixel are not active in this release.

7. Calls, transcription, and artificial intelligence

No automatic recording, transcription, or notetaker is active. Meetings use minimal manual notes.

If recording or transcription is proposed in the future, ARCO must announce it beforehand, request separate express consent, record the response, and offer manual notes. Any summary must be minimized and reviewed by a person. No final acceptance, guarantee, refund, or eligibility decision will depend only on AI.

8. Recipients and transfers

The active website providers are Vercel, consented Google Analytics 4, Cal.com, Google Calendar, WhatsApp, and Zoho Mail. They may process data outside Mexico according to their infrastructure and the applicable account agreements.

If there is a program relationship, ARCO may also disclose what is strictly necessary to the designated J-1 sponsor, employer or worksite, insurer, competent authorities, an approved bank or processor, and advisers bound by confidentiality.

Before H2 and before identifiable data is transferred to a sponsor, ARCO will notify the sponsor's identity, country, purpose, necessary categories, and secure channel. A sponsor change requires a new notice. Sensitive data retains separate consent when applicable.

An unknown provider or one without a verified region does not receive sensitive data.

9. Payments

The website has no active Stripe, SPEI, PAC, or CFDI flow. If a contract exists and a payment is enabled through a separate channel, ARCO may retain amount, milestone, currency, date, reference, reconciliation status, receipt, refund, and an opaque identifier or last four digits when necessary.

ARCO does not retain a full card number or CVC and does not request card data through WhatsApp, email, or a call. There is no autopay in this version.

10. Cookies and measurement

Essential remains active to deliver the website and remember the choice. Analytics is optional. A person may Accept, Reject, or Configure and later change the decision through Privacy preferences.

GA4 uses only ID G-XW0LGF5S70 and loads only after valid consent. Enhanced Measurement is disabled in GA Admin. Google Signals is off, User-ID is not configured, user-provided data is inactive, and ad personalization is disabled in every region. The site sends an allowlisted canonical route with a blank referrer and without PII or free text.

Meta Pixel is inactive and fail-closed. There is no additional tag or analytics layer.

The local consent receipt expires within 180 days. Local first-touch attribution expires within 30 days. Global Privacy Control keeps Analytics denied, clears local measurement state, and disables acceptance.

On rejection, expiry, or revocation, the website stops emitting events, unloads adapters, and requests deletion of known measurement cookies on ARCO's domain. Revocation does not erase data a provider received earlier; the provider's procedures and data-rights process apply to that data.

11. Consent for sensitive data and transfers

When needed, ARCO will present separate consent identifying the exact category, purpose, whether it is required, recipient and country, consequence of not providing it, retention, and revocation channel when applicable.

Accepting the contract or Analytics does not mean consenting to sensitive data, marketing, or recordings.

12. Security

ARCO applies proportionate controls such as role-based least-privilege access, MFA where available, encryption in transit, environment separation, logs and versioning, incident response, no secrets or sensitive data in URLs, and verifiable deletion or anonymization.

A significant breach will be investigated and communicated according to risk and applicable law. ARCO does not promise absolute security.

13. Retention

Local pseudonymous first-touch attribution: no more than 30 days.
Local consent or revocation receipt: no more than 180 days. This browser record is not the contractual file.
Hosting logs and consented GA4 events: according to the current configuration, necessary purpose, and applicable agreements; ARCO does not publish an unverified numeric period.
Cal.com and Google Calendar bookings, Zoho email, and WhatsApp conversations: for the period needed to handle the request and applicable obligations.
Unconverted prospect and manual notes: up to 12 months from the last meaningful interaction, unless a valid request or retention duty applies.
Contracts, payments, receipts, refunds, and defense: up to 6 years after operational closure or a longer applicable legal period. This period is not stored in localStorage.
Operational sponsor and visa file: operational closure plus 12 months, unless an obligation or claim applies.
Passport, health, background, and sensitive source data: 90 days after sponsor or program closure, unless an obligation or specific legal hold applies.
Backups: the same logical period, with purge no later than 90 days after the applicable deletion.

A claim or legal hold preserves only related data, with an owner and review date; it does not freeze the full file indefinitely.

14. ARCO rights, revocation, and limitation

A person may request access, rectification, cancellation, or objection; revoke consent; or limit use and disclosure through:

Email: team@arco.org.mx Subject: ARCO Rights / Privacy

The request should include the person's name and response channel, the right or consent involved, a sufficient description, and only the documents strictly necessary to verify identity or representation. ARCO uses proportionate verification and responds within applicable legal periods.

15. Minors

Summer Work Travel is directed to adults. ARCO will not knowingly collect a minor's data without reviewing capacity, representation, necessity, and applicable consent. A minor's inquiry is limited to general guidance until that path is resolved.

16. Automated decisions

ARCO may use scoring, summaries, or suggestions as support. Aldo or an authorized person reviews material decisions. A person may request an explanation or correction of material information used.

No automated agent independently decides acceptance, payment, suspension, refund, guarantee, or a sensitive transfer.

17. Changes

An update applies prospectively from its date. Material changes to purpose, recipient, sensitive data, or technology will be communicated and, when appropriate, require a new choice.

Continued use of the website does not automatically turn a new optional purpose into consent.

18. Contact and authority

First channel: team@arco.org.mx.

A person may also contact the competent federal authority for personal data held by private parties. ARCO does not publish a name, portal, or procedure that has not been verified as current.

19. Cal.com short-form notice

Both public ARCO events display exactly one required checkbox:

He leído el Aviso de Privacidad (https://arco.org.mx/privacy-es) y solicito que ARCO utilice estos datos para preparar y realizar esta sesión.

It does not contain consent for marketing, recording, transcription, or a notetaker. The booking cannot be completed without this acknowledgement.