Comprehensive privacy notice

1. Data controller and address

B&B Global Consultores, S.C., Federal Taxpayer Registry (RFC) number BGC0705094F5, doing business as B&B Global, is responsible for processing and protecting your personal data. Its tax address, which is also its address for receiving notices on personal data matters, is the following.

Requests concerning your personal data are handled directly by the firm, at the email address above: there is no intermediary or third party handling them on our behalf.

2. Data we collect

We collect data through four channels: the form on this website; communication by WhatsApp, phone or email; one-on-one consultation sessions over Microsoft Teams or Zoom; and the documents that you or your company provide to us so we can deliver the service engaged.

2.1 Identification and contact data

• From the website form: name, email, phone, the service you are interested in and your message. The phone number is optional; the rest is needed so we can reply to you.
• From WhatsApp, phone or email: your number, your name and what you tell us in the conversation.
• From the one-on-one consultation: your name, your email, the data needed to schedule and charge for the session, and whatever you share during the call.
• If you engage a service: identification and tax data of the company and of its legal representative, such as RFC, tax address and position.

2.2 Tax, financial, asset and employment data

Depending on the service you engage us for —domestic and international tax advisory, transfer pricing, business and intangible asset valuation, audit, statutory tax and IMSS/Infonavit opinions, due diligence, accounting or payroll— we receive the documents that the work requires: financial statements, tax receipts (CFDI), tax returns, account statements, contracts (including those entered into with related parties in Mexico and abroad), information on partners and shareholders and, when the procedure requires it, the access credentials to the SAT (Mexican Tax Administration Service) portal, the e.firma (advanced electronic signature) or the IMSS (Mexican Social Security Institute) and Infonavit (National Workers’ Housing Fund Institute) systems.

If you engage us for payroll, we also process employee data: identification, social security number, salary, beneficiaries and enrollment changes. For expatriate payroll this also includes the data on their stay in Mexico and on their tax situation abroad that the calculation requires, such as passport, immigration document and tax residence.

This data is processed solely for the service engaged. Access credentials are used only for the procedures you entrust to us and are not given to anyone outside the firm, except in the cases described in section 4 when the procedure requires it.

We do not ask you for sensitive personal data. If a procedure required processing an employee’s health data, their express written consent would be requested first, as required by Article 9 of the Law.

3. Purposes of processing

If you do not want your data processed for the secondary purposes, write to us at info@bbglobal.com.mx within five business days after this notice is made available to you, stating your name and which communications you object to. If you do not write within that period, it is understood that you do not object; in any case, you may ask us to stop sending them at any time, through the same channel.

We keep your data for as long as the service relationship lasts and, once it ends, for the periods that tax, commercial and labor laws require for keeping accounting records, working papers and receipts. Once those periods have elapsed, the data is deleted or blocked.

4. Data transfers

We do not sell, rent or assign your personal data to third parties for commercial purposes. Your data leaves the firm only in the following cases.

4.1 Authorities

On your behalf, we submit the information that the work engaged requires to the Tax Administration Service (SAT), the Mexican Social Security Institute (IMSS), the National Workers’ Housing Fund Institute (Infonavit), the Ministry of Labor and Social Welfare and the relevant state tax authorities. These transfers do not require your consent, under Article 37, sections I and V, of the Law: they are provided for in tax and social security legislation and are necessary to deliver the service you entrust to us.

4.2 Allied firms and international alliance

B&B Global is a member of the international alliance Abacus Worldwide and has a presence in Puebla and Tamaulipas through allied firms. When your matter requires it —for example, a transaction in another state or another country— and only with your prior consent, we may share with the relevant allied firm or alliance member the information needed to handle it. Without that consent, your data does not leave B&B Global through this channel.

4.3 Technology providers

This website is hosted on Cloudflare, which also hosts the service that receives the form and, when enabled, runs the anti-bot verification. Form messages reach us by email through the Resend delivery service. Audience measurement is done by Google Analytics, unless you turn it off, and by Microsoft Clarity, only if you accept it. One-on-one consultation sessions take place over Microsoft Teams or Zoom, and that consultation is paid by bank transfer.

To provide the service, we also enter your data, and where applicable that of your employees, into the accounting, invoicing and stamping, and payroll software the firm works with. All of these providers act as processors: they process the data on our behalf, following our instructions and for no purposes of their own, so the Law does not consider these cases a transfer and they do not require your consent. Their servers may be located outside Mexico.

5. ARCO rights and how to exercise them

You may access your data, rectify it if it is inaccurate, cancel it when you consider it is not necessary, or object to its use for specific purposes. You may also revoke the consent you have given us.

How to submit the request

1. Write to info@bbglobal.com.mx with the subject line “Derechos ARCO” (ARCO rights).
2. Attach a copy of a valid official ID and, if you act through a representative, the document evidencing the representation together with the representative’s ID.
3. State clearly which data you want to know, correct or cancel, or which use you object to, and an email or phone number where we can reply to you. If you request a rectification, include the documents supporting the change.

We will reply by email within a maximum of twenty business days from receiving the complete request. If it is granted, we will carry it out within the fifteen business days following that reply. We may deny access, rectification, cancellation or opposition in the cases provided for in Article 34 of the Law, including when keeping the data is necessary to comply with a legal obligation of the firm, such as keeping accounting records and working papers. In that case we will explain the reason to you.

If you are not satisfied with the reply, you may start a rights protection proceeding before the data protection authority —since the 2025 reform, the Ministry of Anti-Corruption and Good Government (Secretaría Anticorrupción y Buen Gobierno)— within the following fifteen business days.

6. Cookies and tracking technologies

This website measures its audience to know which pages are viewed and how they are navigated. Google Analytics is on by default and you can turn it off in the notice shown on your first visit; turning it off has no effect whatsoever on the service you receive. Microsoft Clarity, which anonymously records browsing, only loads if you click “Got it” in that notice. If your browser sends the Global Privacy Control signal, neither of them is activated. Your choice is stored in your browser. The form may also use Cloudflare’s anti-bot verification.

The details of each cookie —name, provider, purpose and duration— and how to change your choice are in the cookie notice.

7. Changes to this notice

This notice may be amended to reflect legal changes, changes in our practices or in the services we offer. Any amendment is published on this same page, with its new update date, and if the change materially affects the processing of your data we will let you know by email if you are an active client. We recommend checking this page from time to time.

Last updated: October 3, 2026