TULAZO COMPREHENSIVE PRIVACY NOTICE
Courtesy translation. The Spanish version (PRIV-1.1.0) is the official text and prevails in case of any difference.
1. Identity and address
Alfonso Juan Montesinos Tamayo, who operates commercially under the Tulazo brand, with address at Vicente Guerrero 100 Pte., Centro, San Nicolás de los Garza, Nuevo León, C.P. 66400, Mexico, is the data controller for the processing of personal data whose purposes he determines directly. Privacy contact: contacto@tulazo.app.
2. Scope and roles
This notice covers the processing carried out by Tulazo for its own purposes, such as contracting, administrative accounts, operation, security and support. Organizers may determine purposes regarding their guest lists, confirmations and other event decisions; in that processing, the legal capacities of the parties will depend on their actual involvement. When Tulazo processes information exclusively on behalf of an organizer acting as controller, it will follow the instructions and the processor obligations that apply. If a guest has questions about their data, they may write to Tulazo so that the request can be identified and forwarded to the appropriate party, without preventing the exercise of their rights.
3. Data processed
Depending on the relationship and the features used, the following may be processed: name, contact details, contracting and billing data; the account, credentials and acceptance of conditions of the organizer and of the administrators the organizer authorizes; guests' names and their membership of a family or group; RSVP answers; menu choices; WhatsApp links and contact numbers; song proposals and votes; tags, notes and content entered by the organizer; the device identifier and token needed to send push notifications when the mobile app is used, platform and language; IP addresses, technical identifiers, access, security and administration logs; event documents, images and communications. When the Disposable Camera is enabled under specific conditions, photographs and related technical data may be processed.
4. Sensitive data
Allergies and certain dietary restrictions linked to health may constitute sensitive personal data. Providing them is optional and they are requested only when the Organizer turns this feature on for their event. Before they are recorded, a specific, express and verifiable electronic consent is requested from the data subject or from whoever may legally represent them; for each consent, the version of the text accepted, the date and time and a technical reference linking it to the corresponding answer are kept as evidence; this record contains no health information and is kept even if that information is deleted. The main contact of a family is not automatically authorized to consent on behalf of other adults: each adult must give their own consent. In the case of minors, their legitimate representative will take part, with the proportionate verification that applies. This data is used exclusively to manage the event's dietary needs, is not used for commercial purposes, and access is limited to the authorized persons who really need to know it. The data subject may withdraw consent and ask for the data to be deleted at any time by writing to contacto@tulazo.app.
5. Necessary purposes
Data is used, as appropriate, to manage contracts, process payments and invoicing, enable accounts, provide the contracted features, manage events and RSVP, allow the communications configured by organizers, send push notifications to devices that have allowed them, maintain the integrity and security of the service, provide support, handle privacy requests, prevent abuse and comply with legal obligations. Allergy data will be used only for the dietary purposes informed and authorized. Tulazo will not use guest data for its own advertising.
6. Non-necessary purposes
Tulazo will not run advertising campaigns aimed at guests using their RSVP data. If secondary purposes are proposed in the future, they will be informed beforehand and the opt-out or consent options required by law will be made available before the processing begins.
7. Source of guest information
Some guest data may be entered initially by the Organizer before the guests access Tulazo. When they enter the service, invited persons will have the applicable privacy information available. The indirect origin of the data does not release whoever acts as controller from their legal obligations.
8. Administrators and wedding planners
The Organizer may authorize as administrators, up to the number allowed by their package, the people they choose, including their wedding planner. Administrators access the information needed to organize the wedding, including guests, confirmations, menu preferences and notes, and accept terms of use and confidentiality before gaining access. The Organizer is responsible for selecting them, assigning their permissions and revoking their access; Tulazo keeps evidence of each administrator's acceptance (version, date and time). A wedding planner acting only on the Organizer's instructions processes the data in that role; if they use it for their own professional or commercial purposes, they assume the corresponding legal responsibilities.
9. Providers and location
Tulazo uses technology provided by Uskonni, LLC, and hosting and backups from DotBlock, with infrastructure in the United States. These providers may process data exclusively to provide technology services under the applicable instructions and contracts. When data is transferred to third parties that do not act solely as processors or sub-processors, the conditions or consents required will be disclosed and met. To deliver push notifications, the notification services of mobile operating systems take part; they receive the device's technical identifier and the content of the notification only to deliver it, on Tulazo's behalf. The mere location of servers outside Mexico does not by itself determine whether there is a transfer or a processing assignment.
10. Access and disclosure
Access to event data is restricted by the roles and permissions of the Organizer and authorized users. Technical providers will have access only when necessary and authorized for their function. The Organizer may manage exports and communications to event vendors, in accordance with the responsibilities legally assigned to them. Access links or codes must be protected from third parties. Buttons or links to external sites published by the Organizer, such as gift registries, are provided by the Organizer and lead to third-party sites, which have their own privacy notice; Tulazo does not control their content or policies.
11. Retention
Ordinary access to the event will end after the commercial closing period of 90 calendar days following the last event, except for definitive cancellation or other contractual cases. The actual retention of each category is determined separately by purpose and legal obligation. Allergy data will be deleted when it is no longer needed for dietary care or when the data subject requests it, unless there is a legal basis for other processing; the evidence record of its consent, which contains no health information, is kept so that it can be proven. The device data of people who use the app is kept while the service is used or until its deletion is requested. Backups follow a technical cycle of up to 30 days, subject to verification of its operation and to legally required retentions. Certain receipts, security logs and contractual evidence may be kept for different periods when there is legal justification. The end of access does not mean the instant deletion of every copy, nor does it authorize indefinite retention.
12. ARCO rights and revocation
The data subject or their representative may request access, rectification, cancellation or objection to the processing, and may revoke consent where applicable, by writing to contacto@tulazo.app. The request must identify the data subject, provide a means to receive a reply, describe the right to be exercised and include enough information to locate the data. Proportionate proof of identity or representation will be requested. ARCO requests will be resolved within the periods set by applicable law; where appropriate, they will be carried out within the corresponding legal period. If Tulazo acts as processor for the requested data, it will cooperate with the controller to handle the request.
13. Limitation of use or disclosure
Data subjects may request the limitation of the use or disclosure of their data by email to contacto@tulazo.app, indicating the information and the purpose concerned. Tulazo will reply in accordance with applicable regulations and the responsibilities of each party.
14. Security and breaches
Tulazo will apply reasonable administrative, technical and physical measures to protect information. Breaches that require notification to data subjects will be communicated in accordance with applicable law. No electronic system guarantees zero risk.
15. Photographs and minors
The Disposable Camera is a future feature and is not an available service merely because this notice is published. Before it is enabled, the purposes, access rules, image authorizations and withdrawal mechanisms applicable to photographed persons and minors will be disclosed. Photographs will not be used for Tulazo's promotional purposes without the specific authorizations that apply.
16. Changes to this notice
Changes to this notice will be published at https://tulazo.app/privacidad, identifying the version and the update date. When a change requires new information or consent, Tulazo will implement the corresponding mechanisms before applying the new purpose.
17. Contact
For questions, privacy requests and personal rights: contacto@tulazo.app. Address: Vicente Guerrero 100 Pte., Centro, San Nicolás de los Garza, Nuevo León, C.P. 66400, Mexico.