Privacy Notice

1. Who is responsible

Lucas Maximiliano Serpa, an individual providing services under the trade name “ROOTS Photography” (“ROOTS”, “we”), is responsible for the processing of your personal data. For any privacy matter, contact us at info@roots.photography.

Postal address: Cerrada Stanyol Mz 6 Lt 22, Int 24, Real Ibiza, C.P. 77723, Playa del Carmen, Solidaridad, Quintana Roo, México.

2. Data we process

• Identity/contact: name, email, phone/WhatsApp.
• Session/enquiry: travel dates, lodging city, quiz answers, type, and messages you send us.
• Billing (CFDI only): name/business name, country, tax address, RFC.
• Images: session photos/video.
• Visit/campaign origin: source, UTMs, ad click IDs (including Google click IDs when present), landing/enquiry pages, internal session/ref IDs, date/time, and venue/property context when applicable.

We do not collect sensitive personal data.

3. Purposes

Necessary — without these we cannot provide the service:

• Answer your enquiry and schedule your session.
• Process the deposit and balance (through Stripe).
• Deliver your gallery.
• Issue a CFDI invoice when you request one.

Voluntary — you may object without affecting the service:

• Send you follow-up emails about your session.
• Use your images in our portfolio and social media, only with your separate, express consent.

Measurement — how we know which channel your enquiry came from:

We use the visit and campaign origin data to attribute enquiries and bookings to the channel or campaign they came from, to measure how the site performs, to avoid losing that attribution between your first visit and your enquiry, and to analyse how our marketing is working. It is measurement of our own site and advertising — we do not use it to build profiles about you, and we do not sell it.

If we ever use your data for a purpose other than those stated here, we will ask for your consent again.

4. Service providers

To operate, we rely on providers that process data on our behalf: Resend (email), Supabase (database), Stripe (payments), n8n (automation), Pic-Time (gallery delivery), OpenAI (AI-assisted draft generation and verification for enquiries), and Meta and Google (analytics and advertising). We share data with these providers as needed for the functions described here.

Some providers store or process data outside Mexico (for example, in the United States or the European Union). We limit our use of providers and the data shared with them to the services we use.

We use Meta and Google measurement and advertising tools. Depending on consent and configuration, they may receive site events, page and technical information, cookies or pseudonymous identifiers, and advertising click identifiers. We do not upload customer email or phone numbers to Google or Meta for Enhanced Conversions or Customer Match.

Enhanced Conversions, Customer Match and Data Manager customer-data matching are not active on this site today.

5. Cookies and tracking

We use Meta Pixel and Google Analytics / Google Ads to measure and improve the site. If you visit from the European Economic Area or the United Kingdom, we show a cookie banner and load these tools only after you accept; until then they stay disabled by default. Everywhere else these tools load by default, and you can still manage cookies from your browser settings.

Separately from those tools, we store the visit-origin data described in section 2 in a first-party cookie and an equivalent browser-storage entry (roots_attribution_v1, up to 90 days). This is our own site storage used to preserve attribution context between visits; it is not a third-party cookie. Clearing your browser storage for this site removes it.

6. Data retention

• Enquiries that do not become bookings: up to 24 months from your last contact.
• Client records: 5 years, to meet Mexican tax and accounting obligations.
• Image releases (portfolio / social consent): for as long as the images remain in use.

After these periods we delete or anonymise your data, unless the law requires us to keep it longer.

7. Your rights (ARCO) and withdrawal of consent

You may access, rectify, cancel, or object to the processing of your data, and withdraw your consent, by writing to info@roots.photography. We will respond within the timeframe set by applicable law (generally up to 20 business days).

8. Minors

We photograph minors as part of family and milestone sessions. Any use of a minor’s image in our portfolio or social media requires explicit consent from a parent or legal guardian, which we collect separately from the person authorising it and in what capacity. Without that consent, a minor’s images stay private and are used only to deliver your gallery.

9. Changes and governing law

This notice is governed by the applicable laws of Mexico, and any dispute relating to it will be submitted to the competent courts of Quintana Roo, Mexico. This does not deprive you of any mandatory consumer-protection rights you may have under the laws of your country of residence.

We may update this notice; the current version is always published on this page.

10. Authority

In Mexico, the data-protection authority is the Secretaría Anticorrupción y Buen Gobierno, which you may contact regarding the handling of your personal data.

← Back to home