Privacy Notice
Last updated: August 17, 2026
1. Who is responsible
Roots Photography (“Roots”, “we”), a commercial brand operated by Lucas Maximiliano Serpa, is responsible for the processing of your personal data. For any privacy matter, contact us at info@roots.photography.
Postal address: Cerrada Stanyol Mz 6 Lt 22, Int 24, Real Ibiza, C.P. 77723, Playa del Carmen, Solidaridad, Quintana Roo, México.
2. Data we process
- Identification and contact: name, email, phone / WhatsApp.
- Session details: travel dates, lodging city, quiz answers, session type.
- Billing data (only if you request a CFDI invoice): name or business name, country, tax address, RFC.
- Images: photographs and video from your session.
We do not collect sensitive personal data.
3. Purposes
Necessary — without these we cannot provide the service:
- Answer your enquiry and schedule your session.
- Process the deposit and balance (through Stripe).
- Deliver your gallery.
- Issue a CFDI invoice when you request one.
Voluntary — you may object without affecting the service:
- Send you follow-up emails about your session.
- Use your images in our portfolio and social media, only with your separate, express consent.
If we ever use your data for a purpose other than those stated here, we will ask for your consent again.
4. Service providers
To operate, we rely on providers that process data on our behalf: Resend (email), Supabase (database), Stripe (payments), n8n (automation), Pic-Time (gallery delivery), and Meta and Google (analytics and advertising). We share only the data each provider needs for its function.
These providers act as data processors on our behalf. Some store data outside Mexico (for example, in the United States or the European Union). Under Mexican data-protection law, a transfer to a processor acting on our behalf does not require your separate consent; we limit each transfer to the data the provider needs to perform its function.
5. Cookies and tracking
We use Meta Pixel and Google Analytics / Google Ads to measure and improve the site. If you visit from the European Economic Area or the United Kingdom, we show a cookie banner and load these tools only after you accept; until then they stay disabled by default. Everywhere else these tools load by default, and you can still manage cookies from your browser settings.
6. Data retention
- Enquiries that do not become bookings: up to 24 months from your last contact.
- Client records: 5 years, to meet Mexican tax and accounting obligations.
- Image releases (portfolio / social consent): for as long as the images remain in use.
After these periods we delete or anonymise your data, unless the law requires us to keep it longer.
7. Your rights (ARCO) and withdrawal of consent
You may access, rectify, cancel, or object to the processing of your data, and withdraw your consent, by writing to info@roots.photography. We will respond within the timeframe set by applicable law (generally up to 20 business days).
8. Minors
We photograph minors as part of family and milestone sessions. Any use of a minor’s image in our portfolio or social media requires explicit consent from a parent or legal guardian, which we collect separately from the person authorising it and in what capacity. Without that consent, a minor’s images stay private and are used only to deliver your gallery.
9. Changes and governing law
This notice is governed by the applicable laws of Mexico, and any dispute relating to it will be submitted to the competent courts of Quintana Roo, Mexico. This does not deprive you of any mandatory consumer-protection rights you may have under the laws of your country of residence.
We may update this notice; the current version is always published on this page.
10. Authority
In Mexico, the data-protection authority is the Secretaría Anticorrupción y Buen Gobierno, which you may contact regarding the handling of your personal data.