Privacy Policy

1) Who we are & scope

• Controller/Business: The Meriya [legal entity name], [jurisdiction of incorporation].

• Primary contact: privacy@themeriya.com (recommended), +[phone], [postal address].

• Affiliates/Partners: We work with developers and affiliates in Yucatán (e.g., partners such as Grupo GEA) and U.S.-based marketing/operations vendors.

• Coverage: This Policy applies to all personal information we process through the Services, including websites, landing pages, CRM, messaging, and in-person events.

2) What we collect

We may collect:

A. Identifiers & contact data – name, email, phone, city/state/country, preferred language, social handles, WhatsApp ID.
B. Customer records – professional role, franchise/industry interests, investment preferences (budget range, desired location, timing), meeting notes, and communications.
C. Transactional & commercial info – inquiries, offers made/received, closings supported, payment/escrow confirmations (last 4 digits, amounts, dates), invoices/receipts.
D. Verification data (when needed) – national ID numbers only if legally required for KYC/closing (handled via secure third parties/notaries).
E. Technical data – device/browser, IP, cookies, pixels (Meta/Google), pages visited, lead source/UTM, session logs.
F. Media & events – photos/videos from site visits, webinars, and events where you appear (with notice/consent when required).
G. Inferences – segments (e.g., “franchise investor,” “commercial lots”), likelihood to buy, content affinity.

Sensitive data: We do not intentionally collect sensitive data (e.g., precise geolocation, government IDs beyond KYC where required, health info). If a closing requires sensitive data, it’s processed under strict legal/contractual safeguards.

Sources: You provide data directly (forms, WhatsApp/SMS, calls, email, meetings); we also obtain it from ad platforms, analytics, referral partners, developers/sellers, public records (e.g., property registries), and our CRM/automation tools.

3) Why we use your data (purposes)

• Provide the Services (respond to inquiries, schedule calls/tours, share property details, proposals).

• Qualification & deal support (budget fit, due diligence steps like INSEJUPY folio checks via authorized third parties).

• Contracts, closings & customer support.

• Marketing & growth (newsletters, remarketing/retargeting, webinars, lookalike audiences where permitted).

• Security, fraud prevention, compliance with law & tax.

• Analytics and product improvement.

Legal bases (EEA/UK where applicable): consent (e.g., newsletters/remarketing), contract (to provide requested services), legal obligation (KYC/anti-fraud), and legitimate interests (B2B marketing with safeguards).

4) Cookies, pixels, and analytics

We use cookies/pixels (e.g., Google Analytics, Meta Pixel) for analytics, conversion tracking, and tailored ads.

• Manage preferences via our Cookie Settings [link] and your browser/device settings.

• Some features rely on cookies; disabling them may limit functionality.

5) How we share information

We do not sell personal information for money. We may share (as that term is defined by some U.S. state laws) for cross-context behavioral advertising.

We share with:

• Service providers (CRM, email/SMS, analytics, ad platforms, cloud hosting, support tools).

• Business partners (e.g., developers/sellers such as Grupo GEA; title/escrow; notaries; attorneys; accountants).

• Authorities when legally required.

• Corporate events (merger, acquisition, financing, or asset sale).

We require recipients to protect your data and use it only for permitted purposes.

6) International data transfers

We operate across the U.S. and Mexico and may transfer data between these locations and (if applicable) the EEA/UK.

• Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses, cross-border transfer mechanisms) and protect data per this Policy.

7) Retention

We keep personal information only as long as necessary for the purposes above:

• Marketing leads: typically 24 months from last interaction.

• Contract/closing records: per legal/accounting requirements.

• If you request deletion, we will delete or de-identify unless we must retain it by law or to defend legal claims.

8) Security

We use administrative, technical, and physical safeguards appropriate to the risks (access controls, encryption in transit, least-privilege, logging). No system is 100% secure; we continuously improve our controls.

9) Your privacy rights

Mexico (LFPDPPP) – ARCO rights

Mexican residents may request Access, Rectification, Cancellation, and Opposition; revoke consent; and limit use/disclosure. We will respond within the timeframes required by law (generally 20 business days to respond and 15 business days to implement, where applicable). Submit requests to privacy@themeriya.com with proof of identity and clear instructions.

United States (e.g., California CCPA/CPRA)

Eligible U.S. residents (e.g., California) may:

• Know/Access the categories/specific pieces of personal info we collected.

• Delete personal info (subject to exceptions).

• Correct inaccurate personal info.

• Opt out of “Sale/Share” for targeted advertising (Your Privacy Choices / Do Not Sell or Share link).

• Limit use of sensitive info (if ever collected beyond allowed purposes).
  We will not discriminate for exercising rights. We respond within 45 days (with possible 45-day extension). Authorized agents may submit requests with proper authorization.

EEA/UK (GDPR), if applicable

You may have rights to access, rectify, erase, restrict, object (including to direct marketing), port data, and withdraw consent. We respond within one month (extendable under law). You can lodge a complaint with your local supervisory authority.

How to exercise rights: Email privacy@themeriya.com. We may verify your identity, and where we act as a processor for a developer/seller, we’ll forward your request to the appropriate controller.

10) Marketing, WhatsApp/SMS & email

• Email: You can unsubscribe via the link in our emails or by contacting us.

• WhatsApp/SMS: By providing your number and engaging with us, you consent to receive messages related to your inquiry and similar opportunities. You can reply “STOP” to opt out (or “HELP” for help). Message/data rates may apply. We do not use WhatsApp numbers from groups/chats without a lawful basis and your permission where required.

11) Children’s data

Our Services are intended for adults. We do not knowingly collect personal information from children under 13 (U.S.) or under the relevant age of consent elsewhere. If you believe a child provided data, contact privacy@themeriya.com.

12) Do Not Track & Global Privacy Control

Some browsers send Do Not Track (DNT) signals; there is no standard response, but we honor legally recognized signals such as Global Privacy Control (GPC) for opt-out where required. Use our Your Privacy Choices link to manage targeted ads preferences.

13) Third-party links

Our Services may link to third-party sites or tools. Their privacy practices are governed by their own policies. Review them carefully.

14) Changes to this Policy

We may update this Policy from time to time. We’ll post the new version with a new “Effective date.” Material changes will be highlighted or otherwise notified where required.

15) Spanish summary (resumen en español)

Este Aviso explica cómo The Meriya usa y protege tus datos personales. Recopilamos información de contacto, preferencias de inversión, datos técnicos (cookies/píxeles), y—solo si la ley lo exige—datos para verificación (KYC). Usamos tus datos para atender solicitudes, evaluar oportunidades, formalizar contratos/cierres, marketing (con tu consentimiento cuando se requiera), y cumplir con la ley. Compartimos datos con proveedores de servicios, desarrolladores/aliados (por ejemplo, en Yucatán), y autoridades cuando sea necesario; no vendemos tus datos por dinero. Puedes ejercer tus derechos (ARCO en México; CCPA en EE. UU.; GDPR en EEE/Reino Unido) escribiendo a privacy@themeriya.com. Puedes darte de baja de correos y responder “STOP” para dejar de recibir mensajes por WhatsApp/SMS. Mantenemos medidas de seguridad y conservamos datos solo el tiempo necesario. Consulta este Aviso periódicamente para ver actualizaciones.