Privacy Policy

Last updated: July 28, 2026

This policy explains how Grupo Pandal Servicios, S.A.P.I. de C.V. (RFC EDU2403151A3), Ciudad de México — operating the Tax Refund Mexico / Tax Free service under authorization from YVESAM, and reachable at hola@taxrefundmexico.com ("we", "us") — handles personal data when you use our website, browser intake, or WhatsApp channel for a Mexico tourist IVA (VAT) refund case.

1. What we collect

We collect information needed to assess, prepare, and track a case: your identity and contact details; original-passport information and images; proof of tourist migratory status; boarding pass or other departure proof; CFDI invoices, store tickets, and payment evidence; information about the purchased merchandise; the signed refund application; and the messages or files you send through the website or WhatsApp.

When a case requires an electronic refund destination, the refund-card details and photographs of both sides are collected through a separate secure browser flow and used to receive and substantiate the refund. The evidence must show the printed cardholder name and at least the last four digits. Where supported, the guided camera checks alignment locally, turns the frame green when the full card is stable, and crops the photo on the device. The service processes the original photographs transiently, permanently masks every card detail except the printed name and last four—including the CVV/security code—and shows the exact protected copies before confirmation. The original photographs are encrypted, used only to produce the protected copies, and then permanently deleted. They are never retained. Only the protected copies are application-encrypted and stored; the full payout number is encrypted and stored separately. Cash-only cases do not require card registration. Do not send a card photo through WhatsApp. Our website host and security or analytics services may also process ordinary technical data such as IP address, device/browser details, timestamps, and page events.

2. Why we use it

We use the data to check apparent eligibility under Article 31 of the Ley del IVA and the applicable RMF rules; identify missing or inconsistent records; prepare and route the case through the authorized refund process; communicate status; facilitate an approved payout; prevent abuse; secure the service; and understand whether the intake flow works. We do not sell or rent claim data for marketing, and the registered refund card is not used by this service to charge the tourist.

3. How we protect it

Your documents are transmitted over encrypted connections and held in private, access-restricted storage available only to the team members preparing your claim. The refund-card number and only the protected front/back evidence receive an additional application-encryption layer before storage.

4. How long we keep it

We keep your data only as long as the tax rules require for your refund claim (Mexican law obliges operators to retain certain fiscal records), and then we delete or anonymize it. You can ask us to delete your data at any time, and we will, except where the law requires us to retain a record of a filed claim.

5. Your rights (ARCO)

Under Mexico's data-protection law you may access, rectify, cancel or oppose the use of your personal data, and withdraw consent. To exercise any of these rights, email hola@taxrefundmexico.com.

6. Third parties

We disclose claim data to YVESAM and other authorized refund infrastructure, the SAT or other authorities where required for the case or by law, and service providers that support secure hosting, document processing, messaging, analytics, and communications. Those providers receive only the access needed for their role. WhatsApp is provided by Meta under its own terms and privacy policy.

7. Changes

We may update this policy; the "last updated" date above reflects the current version.