Procedure for exercising the rights of Access, Rectification, Cancellation and Opposition (ARCO), withdrawal of consent and limitation of use or disclosure, under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette of the Federation (DOF) on March 20, 2025.
1. Ways to submit a request
- Online, free of charge: the form in the Privacy Center.
- By email: [PENDIENTE: Correo de privacidad (p. ej. privacidad@wepassly.com)].
- If you have an account: Settings → Privacy and data (Ajustes → Privacidad y datos) (immediate access and cancellation).
- If you are a guest: "Your data" ("Tus datos"), at the bottom of your invitation.
2. What it must contain
- Your name and a means of communicating the response to you (email).
- A document or mechanism that proves your identity or, where applicable, that of your representative and their power of attorney. For users with an account, writing from the account email is enough; for guests, opening the request from their invitation.
- A clear description of the right you want to exercise and the data it concerns.
- For rectification: the changes to be made and, if applicable, the supporting documentation.
- Any other element that helps locate the data (for example, the name of the event).
3. Time limits
- We will communicate our response within at most 20 business days from receipt of the complete request.
- If the request is granted, we will carry it out within the 15 business days following the response.
- These time limits may be extended only once for an equal period when justified, with prior notice to you.
- If information is missing, we will ask you for it within the following 5 business days and you will have 10 business days to send it.
The delivery of the data is free of charge; only shipping or reproduction costs for physical copies could be charged.
4. When we may refuse
Only in the cases provided for by law: for example, if identity is not proven, if the data is not in our database, if a third party's rights would be harmed, if a decision by an authority prevents it or if we must keep the data due to a legal obligation (such as accounting records). We will explain this to you in writing with its legal grounds.
5. Guest data
When the request concerns guest data for an event, the host is the controller and Passly is its processor: we forward your request to the host immediately and give the host the tools to resolve it, monitoring that the time limit is met.
6. Authority
If you consider that your right was not honored, you can start the rights protection procedure before the Anti-Corruption and Good Governance Ministry (Secretaría Anticorrupción y Buen Gobierno), the supervisory authority since March 21, 2025.
Version history
- v1.0 · October 1, 2026 · Material change — First published version.