Data Protection Policy

Last updated: October 25, 2026 · version 2026-10-25.v3

This policy describes how Garritz Advertising LLC (operator of Garritz Marketing Cloud and Garritz Research — "Garritz", "we") collects, uses, retains and protects the personal data of the people who request or download the studies published on research.garritz.com, in accordance with the European Union's General Data Protection Regulation (GDPR) and Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). Section 10 also covers the visit statistics of garritz.com —the site of Garritz Online Media International GmbH, our EU representative (see its Impressum)— and international.garritz.com, and section 11 covers the contact form on international.garritz.com.

1. Data controller

Garritz Advertising LLC is the controller of your personal data. For any matter related to this policy or to your data, write to legal@garritz.com.

Controller's address: Garritz Advertising LLC, 8 The Green, Suite 6322, Dover, DE 19901 (United States). Representative in the European Union (Art. 27 GDPR): Garritz Online Media International GmbH, Feldbergblick 29, 65207 Wiesbaden (Germany); managing director (Geschäftsführer): Julian Garritz Cruz. Data protection contact, for both the controller and its representative: legal@garritz.com.

2. Data we collect

• Professional identification and contact data, provided by you: first name, last name, email address, phone number, company and job title.
• Technical and usage data, generated when you use the site: IP address, browser user agent, referring page, campaign parameters (UTM) and the record of which reports you requested and downloaded, with date and time.
• Consent record: date, time and version of the text you accepted.

We do not collect special-category data (health, ideology, biometrics) or data from minors. This site is aimed at professionals.

3. Purposes

We use your data to:

• Deliver the study you requested and notify you of new editions or corrections to it.
• Contact you directly — by email or phone — with commercial offers, studies and Garritz content we believe is relevant to your professional activity.
• Measure the performance of our studies and campaigns (what is downloaded, how many times, and from which channel).
• Know, in aggregate figures, how many people visit and read our sites and studies (section 10).
• Protect the site against abuse, fraud and automated access.

4. Legal basis

• Consent (art. 6(1)(a) GDPR): for direct commercial contact with offers and content. You give it by ticking the authorization box before downloading, and you may withdraw it at any time without affecting the lawfulness of prior processing.
• Performance of your request (art. 6(1)(b) GDPR): to deliver the study you asked for.
• Consent (art. 6(1)(a) GDPR and § 25 TDDDG): for the garritz_v measurement cookie on research.garritz.com, only if you accept it (section 10).
• Legitimate interest (art. 6(1)(f) GDPR): for site security, abuse prevention and aggregate, cookieless download and visit metrics.

5. Retention

We keep your data while there is an active relationship with you (report requests or downloads, or interaction with our communications) and, after the last interaction, for a maximum of 24 months — unless you withdraw your consent earlier or a legal obligation requires a different period. Once consent is withdrawn, we stop contacting you and delete or anonymize any data whose retention is not required.

6. Recipients and processors

We do not sell or share your data with third parties for their own purposes. To operate this service we use providers that process data on our behalf and under contract:

• Google LLC (Google Sheets / Apps Script): operational mirror of requests and contact messages for the sales team, and an email alert for each message.
• Cloudflare, Inc. (Turnstile and delivery network): anti-bot verification and perimeter security.
• Our web hosting provider, where the database resides.

7. International transfers

Some of these providers process data outside the European Economic Area and Mexico. Where that happens, the transfer relies on adequacy decisions, the EU-U.S. Data Privacy Framework, or standard contractual clauses approved by the European Commission, as applicable.

8. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability — the ARCO rights under the LFPDPPP — and withdraw your consent to commercial contact, by writing to legal@garritz.com from the email address you registered. We will respond within the applicable legal deadlines (one month under GDPR; twenty days under LFPDPPP).

If you believe we have not honored your rights, you may complain to the supervisory authority of your place of residence: in Mexico, INAI; in the European Union, your national data protection authority.

9. Security

We apply technical and organizational measures proportional to the risk: encryption in transit (TLS), restricted database access, signed and expiring download links, and anti-bot verification. No system is infallible, but we limit the data we store to what is strictly described in this policy.

10. Cookies and visit statistics

We use no advertising cookies, social media pixels or third-party analytics tools. Fonts and libraries are served from our own servers: when you open these pages, your browser does not contact Google or any other content delivery network.

On research.garritz.com we use these first-party cookies:

• garritz_consent: stores your choice about the measurement cookie. Necessary; lasts 6 months.
• garritz_lang: remembers the language you read the site in. Necessary; lasts 30 days.
• garritz_v, only if you accept it: a random identifier that contains no data about you. It lets us count unique readers, see how far they get in the viewer and tell real reads from automated traffic (email scanners). It is not shared with anyone. Lasts 12 months.

In the download form, Cloudflare Turnstile may use the technical cookies it needs to tell people from bots (security; legitimate interest).

If you do not accept garritz_v, or until you choose, we count your visits without cookies. We do the same on garritz.com and international.garritz.com, which use no cookies at all: a small script records which page you opened, which site you came from (domain only), the language, how far down you read and which outbound links you clicked. In both cases we store the date, the browser's user agent and a salted hash of your IP address, never the IP itself; to count unique visitors we compute, on the server, an identifier that changes every day. We use this only for aggregate statistics: we build no profiles and do not follow anyone across sites or days. Legal basis: legitimate interest (art. 6(1)(f) GDPR) in knowing how our sites are used. These records are deleted after 24 months.

You can change your choice at any time here or from the "Cookies" link at the bottom of every page on research.garritz.com.

Your current choice: not made yet Reject Accept

11. Contact form on international.garritz.com

When you write to us through that form we store your name, email, company, budget range and message, the page language, the page or campaign you came from and a hash of your IP address. We use them only to reply and follow up on what you ask (art. 6(1)(b) GDPR, pre-contractual steps at your request). The message reaches our sales team by email and is kept in our follow-up sheet (Google). Writing to us does not subscribe you to anything: without your consent we send you no offers. To tell people from bots, Cloudflare Turnstile loads when you start filling in the form (security; legitimate interest). We keep this data as described in section 5.

12. Changes to this policy

If this policy changes in substance, we will publish the new version here with its date, and where the change affects the scope of your consent, we will ask for it again before continuing commercial contact.