Privacy notice

Awsaan Consulting, S.A. de C.V., operating under the trade name naawa (“naawa”), with its address at Av. Paseo de la Reforma 180, Col. Juárez, Alcaldía Cuauhtémoc, C.P. 06600, Mexico City, Mexico, is the data controller responsible for the personal data you provide through the website naawaconsulting.com (the “Site”), under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”).

For any matter related to this notice or your personal data, write to us at privacy@naawaconsulting.com.

1. Personal data we collect

When you create an account on the Site, we collect:

• Identification and contact data: first name, last name and email address.
• Professional data: company, job level, job function and country.
• Account data: password (stored encrypted; no one at naawa can see it), preferred language and your newsletter choice.
• Usage data: the publications you download and when, and the page you signed up from.
• Technical data: IP address, browser type and date and time of access, which our providers log to run and protect the Site.

If you only subscribe to the newsletter, without creating an account, we collect only your email address, the language you receive it in, the page you subscribed from, the dates you subscribed and unsubscribed and the version of the consent you accepted, plus the technical data.

If you write to us with the contact form (“Book a meeting”), we collect your first name, last name, email address, company, job level, job function and country, the message you send us and the page you wrote from.

If you apply for a role, we collect your first name, last name, email address, city and country, the role you are interested in, your CV and the information you include in it and, if you provide them, your phone number, your LinkedIn profile and a comment.

We do not ask for sensitive personal data or financial data. If you apply, please do not include sensitive data in your CV, such as your health, religion or political views. If it is included anyway, we will not use it for any purpose.

2. How we use your data

Necessary purposes, to provide the service you request:

1. Create and manage your account and verify your email address.
2. Give you access to the downloadable publications on the Site.
3. Send you the emails your account needs to work: confirmation, sign-in codes, password or email changes.
4. Protect the Site and your account against misuse, fraud and unauthorized access.
5. Respond to your requests and questions, and to the exercise of your rights.
6. Respond to your contact request and arrange a meeting with you.
7. If you apply: assess your profile, contact you about the selection process and, during the retention period, consider you for other roles that match your profile.

Additional purposes, not necessary for the service:

8. Send you our newsletter with naawa’s publications, studies and news, only if you opt in: when signing up, from “My account” or with the Site’s subscription form. If you use the form, we will first send you an email to confirm your subscription.
9. Produce statistics on use of the Site and interest in our content, only if you accept analytics cookies (see section 6).
10. Contact you with information about our consulting services.

You may object to the additional purposes at any time, without affecting your account or your access to publications:

• Newsletter: use the unsubscribe link included in every email or, if you have an account, turn it off in “My account”.
• Site statistics: choose “Reject” in the cookie notice or use “Cookie settings” at the bottom of the page.
• Commercial contact: write to privacy@naawaconsulting.com.

3. Who we share your data with

We do not sell or rent your personal data.

To run the Site we rely on providers that process your data on naawa’s behalf, solely to provide their service and under confidentiality and security obligations. Some of them host data in the United States:

We will only share your data with authorities when required by law or court order. Under the Law, these disclosures do not require your consent.

4. Your ARCO rights

You have the right to access your personal data, rectify it if it is inaccurate, cancel it when you consider it is not needed for the purposes in this notice, and object to its processing for specific purposes.

You can update your name, company, job level, job function, country and preferences at any time from “My account”. To exercise any of these rights, send a request to privacy@naawaconsulting.com including:

• your name and the email address of your account or subscription, or the one you wrote to us from;
• a document proving your identity or, where applicable, that of your legal representative;
• a clear description of the data and the right you want to exercise;
• any other information that helps us locate your data.

We will respond within 20 business days of receiving your complete request and, if applicable, carry it out within 15 business days of our response.

If you ask us to cancel your account, we will delete your data from our active systems. Some copies may remain in backups for a limited period before they are permanently deleted.

5. Withdrawing your consent

You may withdraw your consent at any time by writing to privacy@naawaconsulting.com. Please note that if you withdraw consent for the necessary purposes, we will no longer be able to keep your account or give you access to publications.

6. Cookies and similar technologies

The Site currently does not use advertising cookies or tracking tools for advertising purposes. If we ever do, we will ask for your consent separately and update this notice before turning them on. Today it uses two kinds of technologies.

Strictly necessary, always on because the Site does not work without them:

• Account session: when you sign in, your browser stores a session identifier (local storage) so you don’t have to sign in again on every page. It is removed when you sign out.
• Your cookie choice: we store in your browser (local storage) whether you accepted or rejected analytics cookies, so we don’t ask you again on every visit.
• Abuse protection: forms use Cloudflare Turnstile to tell people apart from automated programs.
• Fonts: the Site loads its fonts from Google Fonts, which means your browser connects to Google’s servers.

Analytics, only if you accept. The first time you visit, we ask whether you accept analytics cookies. If you reject them, no analytics tool is loaded and none of these cookies is stored. If you accept them, we load Google Tag Manager and Google Analytics 4 (Google LLC, in the United States), which use the _ga and _ga_* cookies (up to 2 years) to measure, statistically, which pages are visited, how people reach the Site, and whether actions such as sending a form or downloading a publication are completed. To do this, Google receives your IP address, information about your browser and device, and the pages you visit; we do not send it your name, your email address or what you type into forms. We do not currently use them for advertising or to build profiles. Analytics data is kept for up to 14 months.

You can change your choice at any time with the “Cookie settings” link at the bottom of every page: if you switch to “Reject”, we stop measuring your visit and delete those cookies. You can also delete or block cookies in your browser settings; if you do, you may not be able to sign in. If we add other technologies in the future, we will update this notice before using them.

Cookie settings

7. How long we keep your data

We keep your data while your account or your newsletter subscription is active, or while it is needed for the purposes in this notice. After that we delete it, unless a legal obligation requires us to keep it longer.

We keep contact requests for as long as we need them to follow up. We keep CVs and application data for 12 months from the day you send them, and then they are deleted automatically; if you want us to delete them sooner, write to privacy@naawaconsulting.com.

If you unsubscribe from the newsletter, we keep your email address and the dates you subscribed and unsubscribed as a record of your consent and so we don’t send it to you again. If you want us to delete them as well, write to us at privacy@naawaconsulting.com.

8. How we protect your data

We apply administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction, or unauthorized use, access or processing. These include:

• encrypted connections (HTTPS) across the Site;
• passwords stored encrypted;
• access to each account limited to its owner, and internal access restricted to authorized staff;
• publications kept in private storage, with temporary download links;
• CVs kept in private storage that only authorized staff can access;
• delivery network protection against malicious traffic;
• technology providers with recognized security standards.

9. Changes to this notice

We may change this notice due to changes in the law, our services or our practices. We will publish the current version on this page with its update date. If a change is significant, we will also notify you by email.

10. Authority

If you believe your right to personal data protection has been violated, you may contact the competent data protection authority under the Law.

Last updated: October 20, 2026.