Comprehensive Privacy Notice

1. Identity and address of the data controller

Common Ground Agencia Migratoria, S. de R.L. de C.V. (hereinafter the “Controller” or “Common Ground”), a company duly incorporated under the laws of the United Mexican States, with Federal Taxpayer Registry number CGA260212LNA and its address at Avenida Francisco Sosa 137, Colonia Del Carmen, Alcaldía Coyoacán, ZIP code 04100, Mexico City, is the controller of the personal data it collects.

2. Personal data we collect

To provide professional immigration services and related services, the Controller may collect, among others, the following personal data:

1. Identification and contact data
2. Employment and professional data
3. Tax data
4. Immigration data
5. Academic data
6. Financial and asset data
7. Data of related persons (dependents, beneficiaries, employees)

Likewise, for certain services, sensitive personal data may be collected and processed under article 3, section VI, of the LFPDPPP, including but not limited to data on the data subject’s present or future health, criminal records, and information related to racial or ethnic origin, religious, philosophical or moral beliefs, political opinions, gender identity or sexual orientation, when strictly necessary to provide professional legal services, including the preparation of files for immigration, naturalization, refugee, asylum or humanitarian proceedings before the competent authorities.

Sensitive personal data will be processed only when strictly necessary to provide the services, and will require the data subject’s express written consent, in accordance with applicable law.

2.1 Data collected through the website

When the data subject interacts with the website commonground.mx, the Controller may also collect browsing data such as IP address, browser type and version, pages visited, and date and time of access. This data is processed as set out in the Cookie Policy.

3. Purposes of processing

Personal data will be processed for the following primary purposes, which are necessary for the legal relationship:

1. Providing professional immigration services and related services
2. Preparing, managing and following up on files
3. Complying with legal and contractual obligations
4. Responding to requests from authorities
5. Communicating with the data subject
6. Invoicing and complying with tax obligations

In addition, the data may be used for the following secondary purposes:

1. Improving internal processes
2. Internal statistics
3. Quality control
4. Sending relevant information related to the services

If you do not want your data processed for the secondary purposes, you may say so as set out in section 6 of this Notice.

4. Transfers of personal data

Personal data may be transferred, in the cases permitted by applicable law and, where applicable, with the data subject’s consent, to:

1. Competent immigration, administrative or judicial authorities
2. Government agencies
3. Financial institutions for invoicing or payment purposes

All transfers will be made in accordance with applicable law and under reasonable confidentiality measures.

The Controller may also share personal data with third parties acting as data processors, including outside providers of services needed to carry out the contracted services (such as accounting, tax, insurance, translation, soft-landing or similar services), with whom the Controller has previously signed a contract as required by applicable data protection law, including confidentiality obligations, and who will process the personal data solely on the Controller’s instructions and under the security and confidentiality measures required by applicable law.

4 bis. Use of technology tools and artificial intelligence

To provide professional services and for quality control of immigration files, the Controller uses technology tools that may include, among others, digital platforms, computer systems and support tools based on artificial intelligence (hereinafter, “AI Tools”), such as language models provided by Anthropic, OpenAI or other comparable technology providers.

When AI Tools are used, the Controller takes reasonable measures to ensure that such processing complies with applicable law, including:

1. Limiting the information shared to what is strictly necessary for the purpose of the analysis or review;
2. Selecting providers with reasonable privacy policies and security measures, including, where available, settings that exclude data from model training;
3. Treating those providers as data processors, subject to contractual obligations of confidentiality and limited use.

The data subject acknowledges and consents that the use of AI Tools may involve the processing of personal data by providers located outside the United Mexican States, which constitutes an international transfer under article 36 of the LFPDPPP. AI Tools are used solely to support the professional judgment of Common Ground’s lawyers; they do not replace legal analysis or produce binding automated decisions about the client.

5. Security measures

The Controller has implemented reasonable administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction or unauthorized use, access or processing.

6. ARCO rights and withdrawal of consent

The data subject may at any time exercise their rights of Access, Rectification, Cancellation or Objection (ARCO), and withdraw their consent to the processing of their personal data, by sending a request to:

The Controller will respond within 20 business days at most from the date the request is received, in accordance with article 32 of the LFPDPPP. The request must include:

1. The data subject’s full name and address
2. Documents proving their identity
3. A clear and precise description of the right they wish to exercise
4. Any other requirements set out in applicable law

7. Use of electronic means

The data subject acknowledges and accepts that the processing, storage and communication of personal data may be carried out by electronic and digital means, in accordance with Common Ground’s processes, under article 89 of the Mexican Commercial Code.

8. Changes to this Privacy Notice

The Controller reserves the right to modify or update this Privacy Notice. Changes will be published on the website commonground.mx and, where appropriate, notified to the email address provided by the data subject at least 10 calendar days before they take effect.

9. Consent

The data subject states that they have read, understood and accepted this Privacy Notice and consents to the processing of their personal and sensitive data as set out herein. Consent may be obtained by physical or electronic means, including electronic signature or express acceptance by digital means.