Who is responsible for your data
Lisa Marie Garza (the “Controller”, “we” or “us”), a real estate professional operating in San Miguel de Allende, Guanajuato, México, is responsible for the processing of your personal data under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its regulations, and, for visitors in those places, under applicable US state privacy laws and Canadian privacy laws, as described below.
For anything related to this Privacy Notice, contact us through the form on our Contact page (/en/contact).
Personal data we collect
We may collect the following categories of personal data, directly (when you provide it through our website forms, email, phone, WhatsApp, or in person) or indirectly (through technology on our website):
- Identification and contact data: full name, email address, phone number, nationality, country or city of residence.
- Real estate interest data: type of property you are interested in, approximate budget, timeline, and reason for buying, selling, or renting. This includes the saved homes in your favourites list if you create an account.
- Home search text: whatever you type into our AI home search (see “AI-assisted home search” below).
- Financial data: only when necessary for a specific real estate transaction (for example, proof of funds or information required by a notary public). This data is collected only with your express consent.
- Technical data: IP address, browser type and pages requested, processed by our hosting provider to deliver and secure the site, plus data from cookies and similar technologies (see “Cookies” below).
We do not collect sensitive personal data (such as ethnic origin, health status, religious beliefs, or political affiliation). Please do not include it in forms or in the AI search.
AI-assisted home search
Our homepage lets you describe the home you want in your own words (for example, “a 3-bedroom near the centre under $500,000”). To understand that sentence, the text you type is sent to Anthropic, an AI provider based in the United States, which processes it on our behalf to turn it into search filters. The matching of homes is then done on our own servers against the public MLS listing data.
We do not ask you for your name or contact details in that box, and you should not enter any. We do not save the text you type in our database; it is used only to return your results. Our servers use your IP address briefly to limit abuse (for example, too many searches in a short time). Under the terms that apply to our use of Anthropic’s service, content sent through it is not used to train its models.
The search results are produced automatically and are suggestions only. They can be incomplete or wrong, and no decision about you is made by the AI. A person (Lisa Marie or her team) is always available to help.
Purposes of processing
Primary purposes
- Responding to your inquiries about properties and real estate services.
- Scheduling and conducting property showings and tours.
- Providing real estate brokerage services, including buying, selling, and renting properties, as well as comparative market analyses.
- Running the home search and your saved-homes list.
- Following through on real estate transactions, including coordination with notaries, legal advisors, and other necessary parties.
- Complying with applicable legal, tax, and regulatory obligations.
Secondary purposes
- Sending you information about new listings, market analyses, and content about life in San Miguel de Allende. We email you this only with your consent, and every message includes a way to unsubscribe.
- Marketing, advertising, and commercial prospecting.
- Statistics and improvement of our website and services (using analytics cookies only if you accept them).
If you do not want your data used for secondary purposes, you may tell us at any time by contacting us through the form on our Contact page (/en/contact). Opting out will never affect the services you request from us.
Data transfers and service providers
Your personal data may be shared, only to the extent necessary for the purposes described above, with:
- Cooperating real estate agents and brokerages involved in a transaction (for example, through the local multiple listing system).
- Notaries public and legal and tax advisors involved in a real estate transaction.
- Technology service providers that process data on our behalf under confidentiality obligations: web hosting, database and account services, email delivery, and the AI provider described above.
Several of these providers are located in, or store data in, the United States. By using the site you understand your data may be processed outside your country of residence, where it may be accessible to courts and authorities under local law.
We never sell or rent your personal data, and we do not “sell” or “share” it for cross-context behavioural advertising as those terms are defined in US state privacy laws. Where the law requires your express consent for a transfer, we will request it in advance. Beyond the cases above, we will not transfer your data without your consent, except in the cases permitted by law.
Your rights in Mexico (ARCO) and withdrawal of consent
You have the right to Access your personal data, Rectify it when inaccurate, Cancel it, and Oppose its processing (known in Mexico as ARCO rights), as well as to withdraw any consent you have given us and to limit the use or disclosure of your data.
To exercise these rights, send a request through the form on our Contact page (/en/contact) including: (i) your full name and a means of contact for our response; (ii) a document proving your identity or legal representation; (iii) a clear and precise description of the data and the right you wish to exercise; and (iv) any information that helps us locate your data.
We will respond within a maximum of 20 business days from receipt of your request and, where applicable, act on it within the following 15 business days, in accordance with applicable law.
If you are in the United States
Depending on the state where you live (for example California, Colorado, Texas or Virginia), you may have the right to:
- Know what personal data we collect, use and disclose, and receive a copy of it.
- Correct inaccurate personal data and ask us to delete your personal data, subject to legal exceptions.
- Opt out of the sale or sharing of your personal data and of targeted advertising. We do not sell or share your data or run targeted advertising. We also treat the Global Privacy Control signal sent by your browser as a request to decline non-essential cookies.
- Not be discriminated against for exercising these rights.
To make a request, contact us through the form on our Contact page (/en/contact). We will verify your identity and respond within 45 days (extendable once, where the law allows). You may use an authorised agent, and you may appeal a refusal by replying to our response. In the past 12 months we have not sold or shared personal data.
If you are in Canada
We handle personal data in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Québec, the Act respecting the protection of personal information in the private sector (Law 25). You may ask for access to your personal information and for it to be corrected, withdraw your consent at any time (subject to legal or contractual limits), and ask questions about our practices through the form on our Contact page (/en/contact).
We send commercial email only with your consent, as required by Canada’s Anti-Spam Legislation (CASL), identify ourselves in each message, and include a working unsubscribe mechanism.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Québec, to the Commission d’accès à l’information (cai.gouv.qc.ca).
Security measures
We have implemented reasonable administrative, technical, and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing. No online service can be guaranteed completely secure.
Changes to this Privacy Notice
This Privacy Notice may be updated at any time to reflect legal changes or changes in our practices. Any update will be published on this page with the date of last revision. We encourage you to review it periodically.
Competent authorities
In Mexico, if you believe your data protection rights have been violated, you may file a complaint with the data protection authority, currently Transparencia para el Pueblo, under the Secretariat of Anti-Corruption and Good Governance. For the United States and Canada, see the sections above.
By providing your personal data through any of our contact channels, you acknowledge that you have read and understood this Privacy Notice.