Your data and your rights

• Access. Find out what data of yours we hold and on what terms we process it, and receive a copy.
• Rectification. Correct it when it is inaccurate, incomplete or out of date.
• Cancellation. Have it removed from our possession when you consider it is no longer needed for the purposes in the notice.
• Objection. Have us stop processing it, for a legitimate reason arising from your particular situation — or with no reason required at all, where the optional purposes are concerned.

Several of these are already in the app and take effect at once:

• Correct your name, username, avatar and language from your profile.
• Remove favourites, sightings and trip plans one by one.
• Delete your whole account, from Delete my account.

Using any of those counts as exercising the corresponding right. You do not need to write to us as well.

Write to the privacy address below, from the address you opened your account with if you have one, and include:

• your name and a means of notifying you of the answer;
• documents establishing your identity — or your representative’s, together with proof of the representation;
• a clear description of the data the right concerns (not needed for an access request, which covers everything);
• which right you are exercising and what you expect us to do;
• for a rectification, also: what the corrected data should say, and something that supports it;
• anything else that helps us locate the information.

• We tell you our determination within a maximum of twenty days of receiving the request.
• If it succeeds, we give effect to it within the fifteen days following that answer.
• Each of those periods may be extended once, by an equal period, where the circumstances justify it. If we have to extend, we will tell you why.
• For an access request, delivery follows once your identity is established.

Exercising these rights is free. We could only charge justified costs of reproduction, copying or postage — and there are none if you ask for delivery by email, which is how we deliver by default.

If you repeat the same request within twelve months, the law allows a charge of up to three times the current Unidad de Medida y Actualización, unless the privacy notice changed substantially in between.

We may refuse a request, wholly or in part, when you cannot establish your identity or your authority to act; when we do not hold the data; when meeting it would harm a third party’s rights; when there is a legal impediment or an order from an authority; or when we have already done what you are asking. If we refuse, we will tell you why, by the same route you wrote to us.

Cancellation additionally does not reach data that is needed to perform a contract with you, that we must keep by law — payment records, for instance — or that is required to establish liability arising from the processing. That data enters a blocking period: kept, used for nothing else, and deleted when the period ends.

There is one thing we can do but that does not happen on its own: a photo you submitted that was approved stays published after you delete your account, though with no link to your identity. If you want it taken down, ask us and we will.

You can withdraw consent you have given at any time, by the same route as section 3. Withdrawal has no retroactive effect on processing already carried out, and withdrawing it for the necessary purposes may mean we can no longer provide the service to you.

You may file a solicitud de protección de datos with the Secretaría Anticorrupción y Buen Gobierno within fifteen days of our answer. If we do not answer at all, the clock runs from the day our own deadline expired; you need only attach proof of when you filed your request with us.

Resolutions of the Secretaría are challenged by juicio de amparo, heard by specialised judges and courts.