Confidentiality and data

Data controller

Abelardo Navarro — Vestcrest · Mexico City, Mexico · contacto@vestcrest.com. Privacy officer: Abelardo Navarro (contacto@vestcrest.com). Backup: Vestcrest team.

What data we collect

To generate your report we collect contact data (name, company, email), operational information (sector, employees, customer concentration, documentation quality) and financial statements for the last 3 years that you enter in the questionnaire. Detailed field inventory, purposes, and lawful bases available for institutional due diligence on request.

How we use your data

Exclusively to produce your preparation diagnostic, send your personal delivery link and, if you request and contract it, follow up on the Strategy or Transaction program. We do not sell or share your financial data with third parties for marketing or prospecting.

Legal basis and LFPDPPP

Processing is based on (i) performance of the service contract you accept when paying, (ii) informed consent at checkout for questionnaire data, and (iii) limited legitimate interest for security and fraud prevention. Framework: LFPDPPP and applicable regulation.

ARCO rights

You may request access, rectification, cancellation or objection by writing to contacto@vestcrest.com with subject «ARCO». We verify identity using your registered email, report details, or official ID before access, rectification, cancellation, or objection. We respond within 20 business days.

Processors and subprocessors

We use infrastructure providers under contract to operate the service. Main processors: Supabase (Report data storage); Vercel (Web application hosting); Mercado Pago (Payment processing (we do not store card data)); Cal.com (Session scheduling); Resend (Delivery link email). Some may process data outside Mexico; in those cases we apply contractual and configuration safeguards aligned with the security program.

Confidentiality and NDA

All information is treated as confidential. We sign an NDA on request before or after your purchase. Write to contacto@vestcrest.com with subject «NDA» and we will send the document.

Security program

Vestcrest operates a documented information security program: least-privilege access policies, incident management, backups, logging of relevant access and vendor review. Control design follows SOC 2 Trust Service Criteria (Security and Confidentiality) and ISO 27001 good practices.

Access control to your report

Your report is delivered via personal link with access token. It does not appear in search engines. Stored data is only accessible via authorized server infrastructure, no public browser read access.

Service scope and Transaction

The engagement covers expanded diagnostic, documented preparation, and support in sale, partner, capital, or succession processes that you initiate. It does not constitute regulated intermediation, CNBV-licensed investment advice, or certified expert appraisal.

Retention and deletion

We retain active data during service delivery and up to 5 years after, except We may retain additional data when a legal, tax, or contractual obligation requires it. Request deletion at contacto@vestcrest.com (subject «Data deletion»).

Incident notification

If a security incident affects your personal data, we will notify you without undue delay and, when the law requires it, within applicable timelines, describing the nature of the event and measures taken.

Cookies and analytics

We use browser local storage and session cookies strictly necessary to operate the service: (i) UTM parameters and entry path for campaign attribution when you arrive via marketing links; (ii) report usage events (open, PDF download, scheduling clicks) tied to your workspace via access token or verified session; (iii) `vc_customer_session` and `vc_customer_workspace` cookies to keep your workspace session for three days after you verify your email with OTP; (iv) authenticated session for the Vestcrest team internal panel (Ops), not accessible to clients. We do not use third-party advertising cookies or sell tracking data. You can limit cookies in your browser; some features (Ops session, personal link, workspace) may stop working.

Contact

For privacy, ARCO, NDA or data deletion: contacto@vestcrest.com.

Registro de encargados