Privacy notice
Privacy notice
Last updated: October 30, 2026
1. Identity of the controller
Astralis Systems, S.A. de C.V. (hereinafter “Astralis” or “the Controller”), is responsible for the processing of the personal data collected through the website astralismx.com (hereinafter “the Site”), under the terms of this privacy notice.
For any matter related to personal data, the data subject may contact Astralis at the email address info@astralismx.com.
2. Personal data collected and how it is obtained
Personal data is obtained directly from the data subject, by electronic means, when they fill in and send the contact form on the Site:
| Data | Required? |
|---|---|
| Name | Yes |
| Yes | |
| Message (the text the data subject writes) | Yes |
| Phone | No |
| Company | No |
| Business situation the data subject picks from a list (for example, that the business has outgrown its systems) | No |
In addition, when the form is sent, the following is recorded automatically:
- Language in which the form was sent (Spanish or English).
- Date and time of sending.
- An encrypted identifier derived from the IP address (a salted “hash” value). It is used only to limit the number of submissions and prevent abuse. The full IP address is not stored with the message.
- Server technical records (access logs): the date and time, the page requested, the browser type and the truncated IP address (without its last part, so it does not identify a person). They are kept for 14 days for the security and operation of the Site.
Sensitive personal data. The Controller does not request sensitive personal data. The data subject is asked not to include in their message information about their health, ethnic or racial origin, religious, philosophical or moral beliefs, political opinions, union membership, sexual preference, genetic information or other sensitive data. If they do, the Controller will not process it in any way other than replying to the message, and will delete it once it notices it.
Financial or property data. The form does not request financial or property data.
3. Purposes of processing
Primary purposes (necessary to handle the data subject’s request):
- Receive, read and reply to the inquiry sent through the form.
- Follow up on that inquiry, including contacting the data subject by email or, if provided, by phone, to talk about the situation of their business and, where appropriate, propose a meeting or a diagnostic.
- Protect the form and the Site against abusive or automated submissions (a limit on submissions per origin).
Secondary purposes. The Controller does not use personal data for secondary purposes: it does not send advertising or newsletters, does not build profiles and does not share the data for commercial purposes. Should it wish to use the data for a different purpose in the future, it will say so and obtain the data subject’s consent again before doing so.
4. Consent
By sending the form after this notice (in its short version, next to the form, and in this full version) has been made available to them, the data subject consents to the processing of their data for the primary purposes described, unless they state otherwise (implied consent).
5. Processors (providers that process data on behalf of the Controller)
To run the Site, the Controller relies on providers that process personal data solely on behalf of the Controller, following its instructions and without using it for their own purposes. These communications are not transfers:
| Provider | Service | Data processed |
|---|---|---|
| Microsoft Azure (South Central US data center, Texas, United States) | Hosting of the Site and the database (virtual machine) | All form data |
| Microsoft Azure Blob Storage (Mexico Central data center, Querétaro, Mexico) | Daily database backups, kept for 14 days | All form data |
| Fastmail | Sending the internal notice of each message received to the Astralis team’s email | All form data |
The Site, its database and the email service are hosted in the United States.
6. Transfers
The Controller does not transfer personal data to third parties. It could only communicate it without the data subject’s consent in the cases the Law allows, for example when required by a law or treaty, or by a competent authority or a judicial proceeding.
7. Links to third-party services
The Site includes links to WhatsApp and to an external scheduling service for booking calls (Calendly). The Site does not embed those services or send them data: they are links that open the third party’s service. Whatever the data subject shares there is subject to those third parties’ privacy notices.
8. Data retention
Form data is kept for 12 months from the last contact, or for as long as there is a relationship with the data subject arising from their inquiry. Once that period ends, the data is blocked and then deleted, in accordance with the Law.
Backups are deleted automatically 14 days after they are created, so data deleted from the database may remain in a backup for up to 14 days, without being processed in any other way.
9. Security measures
The Controller applies administrative, technical and physical security measures to protect the data, including: an encrypted connection (HTTPS), access to the administration panel only with two-factor authentication, a database not exposed to the internet, and access restricted to the staff who need the data to handle inquiries.
10. ARCO rights (access, rectification, cancellation and objection)
The data subject has the right to:
- Access: know what personal data the Controller holds about them and the conditions of its processing.
- Rectification: have it corrected if it is inaccurate or incomplete.
- Cancellation: ask for it to be deleted.
- Objection: object to its processing, or ask for it to stop, on legitimate grounds.
How to submit a request. Send an email to info@astralismx.com, addressed to Astralis, with:
- The data subject’s name and an address or email to receive the reply.
- A document proving their identity (for example, a copy of an official ID) or, if acting through a representative, the document proving the representation.
- A clear description of the data over which they wish to exercise the right (not needed for the right of access).
- The right they wish to exercise (access, rectification, cancellation or objection).
- Any other information that helps locate the data (for example, the approximate date they sent the form).
For rectification requests, it helps to state the correction and, where applicable, attach the supporting document.
Deadlines. The Controller will send its reply within a maximum of 20 business days from receiving the request. If the request is granted, it will take effect within the 15 business days following the reply. Both deadlines may be extended once for an equal period, when justified by the circumstances and the data subject is informed.
Cost. Exercising ARCO rights is free of charge. Only the costs of reproduction, copies or delivery may be charged, under the terms of the Law.
How the reply is sent. The reply will be sent to the email address from which the request was made, unless the data subject indicates another means. Access will be given through an electronic copy of the data.
If the data subject disagrees with the reply, or does not receive it in time, they may turn to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), the authority in charge of protecting personal data held by private parties, within the 15 business days following notice of the reply.
11. Withdrawal of consent
The data subject may withdraw the consent they have given at any time, without retroactive effect, through the same procedure and means described for ARCO rights. Because of a legal obligation, it may not be possible to act on the withdrawal immediately or in full; in that case they will be informed. Withdrawing consent means Astralis will no longer be able to follow up on their inquiry.
12. Options to limit the use or disclosure of the data
In addition to ARCO rights, the data subject may ask at any time, by writing to info@astralismx.com, for the use of their data to be limited; for example, not to be contacted again, or to be contacted only through one means. The Controller will record the request and respect it. As stated above, the data is not used for advertising and is not transferred to third parties.
13. Cookies and tracking technologies
The Site does not use analytics or advertising cookies, nor pixels, web beacons or other third-party tracking technologies.
The Site only uses:
- A language preference cookie (
lang), strictly necessary, which stores whether the person chose to view the Site in Spanish or in English. It contains no personal data that identifies them. The cookie lasts one year. It can be deleted from the browser settings; the Site will keep working and will show the language according to the browser settings. - Administration panel cookies, which are only created for Astralis staff who sign in to the internal panel. They are not created for visitors to the Site.
The Site’s language is never decided by the visitor’s location or IP address.
14. Changes to this privacy notice
This notice may be modified because of changes in the law, in Astralis’ services or in the way data is processed. Any change will be published on this same page, https://astralismx.com/en/privacy-notice/, with the date of last update at the top. If a change affects the purposes or involves a transfer, the data subjects whose data is held at that time will also be notified by email and, where the Law requires it, their consent will be obtained again.
15. Authority
The authority in charge of overseeing compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) is the Secretaría Anticorrupción y Buen Gobierno. [PLACEHOLDER: current official link of the Ministry for personal data procedures, to be confirmed.]