SOMA
Privacy notice
This notice explains what personal data we collect through thesoma.app, why we collect it, and the rights you hold over it. It is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and is written to be read, not to be survived.
1. Who is responsible
[LEGAL ENTITY NAME] ("SOMA"), with address at [REGISTERED ADDRESS], Mexico City, is responsible for the processing of your personal data. You can reach our privacy contact at admin@thesoma.app.
2. What we collect
We only collect what you choose to send us through the brief form, the allies form, or direct messages:
- Identification and contact data: name, email address, telephone or WhatsApp number, and the profile you select.
- Request data: destination, dates, number of guests, objective, mood, privacy level, indicative order of magnitude, urgency, and any notes you write.
- Referral data: the name of the person who introduced you, if you provide one.
- Technical data: the page or campaign that brought you to the site, and standard server logs.
We do not request sensitive personal data. Please do not include health, religious, political, financial-account or biometric information in free-text fields. If a request genuinely requires such information, we will ask for it separately and obtain your express consent.
3. Why we use it
Primary purposes, necessary to give you the service you asked for:
- To read your brief, qualify it and prepare one or two options.
- To contact you through the channel you selected.
- To coordinate with the operators, venues and suppliers needed to execute a confirmed request.
- To keep records of engagements, invoicing and legal obligations.
Secondary purposes, which you may refuse without affecting your request: sending you occasional information about the calendar or availability we think is relevant to you. To refuse, write to admin@thesoma.app with the subject "No secondary purposes".
4. Who we share it with
We share the minimum necessary data with the suppliers required to fulfil a request you have confirmed — operators, venues, hotels, vessel and aircraft operators, ground and security providers. We do not sell your data, and we do not share it for advertising.
We also use service providers who process data on our behalf: Netlify (hosting and form submissions, United States) and Google Fonts (typography delivery). These providers act under their own security commitments and process data solely to deliver their service to us.
5. How long we keep it
Briefs that do not result in an engagement are kept for up to 24 months so that we can recognise you if you return. Records relating to confirmed engagements are kept for the period required by Mexican commercial and tax law. After that, data is deleted or anonymised.
6. Your ARCO rights
You may at any time request Access to your data, Rectification if it is inaccurate, Cancellation if you believe it is not needed, or Opposition to a specific use. You may also revoke your consent or limit the use of your data.
Write to admin@thesoma.app with your name, the right you wish to exercise, a description of the data concerned, and a copy of an official identification. We will respond within 20 business days as required by law. If you are not satisfied with our response, you may approach Mexico's data protection authority.
7. Cookies and measurement
This site does not use advertising cookies or cross-site trackers. If you arrive from a campaign link, we read the campaign parameters in the address so we know which channel your brief came from, and we store that alongside the brief. Nothing is written to your device for advertising purposes.
8. Security
Data travels over an encrypted connection and is stored with access limited to the SOMA team members who need it. Discretion is a working principle of this firm, not only a legal duty. That said, no system is absolutely secure, and we ask you not to send documents or identification numbers through the site's forms.
9. Changes
If this notice changes materially, we will publish the updated version at this address and change the date at the top. Substantial changes affecting the purposes of processing will be communicated to you directly.