Privacy Policy

Last updated: July 27, 2026

This policy explains how Grupo Pandal Servicios, S.A.P.I. de C.V. (RFC EDU2403151A3), Ciudad de México — operating the Tax Refund Mexico / Tax Free service under authorization from YVESAM, and reachable at [email protected] ("we", "us") — handles personal data when you use our website, browser intake, or WhatsApp channel for a Mexico tourist IVA (VAT) refund case.

1. What we collect

We collect information needed to assess, prepare, and track a case: your identity and contact details; original-passport information and images; proof of tourist migratory status; boarding pass or other departure proof; CFDI invoices, store tickets, and payment evidence; information about the purchased merchandise; the signed refund application; and the messages or files you send through the website or WhatsApp.

When a case requires an electronic refund destination, the refund-card details are entered through a separate secure browser flow and used to receive the refund. Cash-only cases do not require card registration. Do not send a card photo through WhatsApp. Our website host and security or analytics services may also process ordinary technical data such as IP address, device/browser details, timestamps, and page events.

2. Why we use it

We use the data to check apparent eligibility under Article 31 of the Ley del IVA and the applicable RMF rules; identify missing or inconsistent records; prepare and route the case through the authorized refund process; communicate status; facilitate an approved payout; prevent abuse; secure the service; and understand whether the intake flow works. We do not sell or rent claim data for marketing, and the registered refund card is not used by this service to charge the tourist.

3. How we protect it

Your documents are transmitted over encrypted connections and held in private, access-restricted storage available only to the team members preparing your claim.

4. How long we keep it

We keep your data only as long as the tax rules require for your refund claim (Mexican law obliges operators to retain certain fiscal records), and then we delete or anonymize it. You can ask us to delete your data at any time, and we will, except where the law requires us to retain a record of a filed claim.

5. Your rights (ARCO)

Under Mexico's data-protection law you may access, rectify, cancel or oppose the use of your personal data, and withdraw consent. To exercise any of these rights, email [email protected].

6. Third parties

We disclose claim data to YVESAM and other authorized refund infrastructure, the SAT or other authorities where required for the case or by law, and service providers that support secure hosting, document processing, messaging, analytics, and communications. Those providers receive only the access needed for their role. WhatsApp is provided by Meta under its own terms and privacy policy.

7. Changes

We may update this policy; the "last updated" date above reflects the current version.