Privacy Notice
Last updated: October 2026 (version 2026-10.3)
Bonimmo is a service operated by ESTRAGITAL Sociedad por Acciones Simplificada de Capital Variable, with registered address at Prol. de San Fernando 100, San Andrés Huayapam, Oaxaca, C.P. 68287, México and contactable at info@bonimmo.org, the controller responsible for processing your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and applicable rules. Hereafter, "Bonimmo" refers to that entity. This Notice describes what data we collect, for what purposes, who we share it with, how long we keep it, and how you can exercise your rights. This English version is provided for convenience; the Spanish version governs.
Personal data we collect
Identification and contact data
Name, email address, phone number, WhatsApp number and, where applicable, the messages, notes, or preferences you share when contacting us, scheduling a visit, registering, or requesting information about a property. If you publish or manage properties, also your profile photograph, biography, service areas, languages, and professional links. Those profile items are yours to provide or withhold; YOUR PUBLIC NAME IS NOT OPTIONAL, because it is how you are identified to whoever contacts you: it appears on your profile, alongside the properties you manage and, if you are an advisor, in the directory, and those pages are public — they can be seen without an account. How that name is formed, and why it stops being free text once your identity is verified, is explained under "Your public name".
Your account and activity data
Your favourite properties, saved searches and alerts, your notifications, and the record of relevant actions you take on the platform. This data is stored on our servers associated with your account, not only on your device, and is kept for as long as the account exists.
Technical and connection data
We process your IP address for two bounded purposes: limiting the number of submissions from a single origin to prevent abuse of our forms, and verifying through an external provider that a form submission is not automated. The IP address is retained only for the relevant control window and is not used to profile you.
Tax data
If you request a tax receipt, we collect your tax ID, legal name, the postal code of your tax domicile, tax regime, and intended use of the receipt. We collect the postal code rather than the full address, as that is the minimum issuance requires.
Payment data
Charges are processed through our payment processor. Your full card details are captured directly in that provider’s environment and never reach our systems: we retain only opaque references to your subscription, the amount, date, charge status, and method used.
Biometric data (identity verification only)
If you operate on the platform — for example as an advisor or as an owner who publishes — we ask you to verify your identity. In that process, our processor captures your official identification and a liveness proof (a selfie), which are biometric data and therefore sensitive personal data. Capture happens directly in the processor's environment: Bonimmo does not store those images in its systems and its access to them is limited to handling a clarification you request. This processing requires your express consent, which is obtained before the process begins, which you may withhold, and which is recorded together with the date and the version of this Notice you accepted.
Third-party data you provide to us
If you record the contact details of an owner, a client, or a counterparty, you are responsible for having the legitimacy to share them and for having informed that person. We process them solely for the specific property matter you designate, and that person retains their rights over them in relation to us.
Offices and authorization over your CRM
We record your office membership and, separately, your express authorization for that office’s administrator to view your CRM, including client details and inquiry follow-up. We retain the authorization version, the date of the act and any withdrawal, linked to your account and office. Accepting an invitation to a private team does not imply that authorization when the team becomes public. Offices’ CRM access requires prior authorization and is limited to the current office administrator and members with active authorization. You may withdraw it from Office without leaving the team; leaving or being removed also invalidates it. These acts do not delete or transfer your listings, history or plan. An advisor’s authorization does not replace their obligation to inform clients whose data they have recorded or limit those clients’ rights. Your office affiliation appears alongside your public profile while you remain a member and is removed when you leave.
Other sensitive data
Beyond the biometric case above, we do not collect sensitive personal data. Please do not include sensitive information in the message or notes fields of our forms.
Purposes of processing
Primary purposes
Handling your enquiries, scheduling and following up on visits, putting you in contact with whoever offers a property, creating and managing your account, saving your favourites and searches, publishing and administering the properties you manage, verifying your identity when you operate in the portal, processing your payments and issuing your tax receipts, preventing fraud and abuse, and complying with legal obligations. These purposes are necessary for our relationship with you.
Secondary purposes
Sending you information about new properties matching your criteria, service news and marketing communications; measuring site usage in aggregate to improve it; and measuring the results of our campaigns, by knowing which campaign or link brought each account and each enquiry or visit request you send us through a form; and telling Meta and Google Ads about your browsing on this site to measure and improve our campaigns on their platforms, and so that Google Ads can show you our ads after your visit, including ads for the properties whose listing you viewed and for other properties in our catalogue. You may object to these purposes at any time without affecting the primary ones, by writing to info@bonimmo.org or, for analytics, campaign measurement and those ads, using the control at the bottom of this page, which stops new notices but does not withdraw what those platforms have already received. Analytics and the browsing notices to Meta and Google Ads happen in your browser without us knowing who you are, so objecting to them is done from that control, in each browser and device you use.
Data rights and withdrawal of consent
Your rights
You may Access your data, Rectify it where inaccurate, Cancel it where you consider it is not required for the stated purposes, or Object to its processing (ARCO rights). You may also withdraw consent given and limit the use or disclosure of your data.
How to exercise them
Send your request through our Data Rights form or to info@bonimmo.org, stating your name, the data involved, and the right you wish to exercise. We will respond within the periods established by law. We may ask you to evidence your identity before resolving, so as not to disclose your data to someone who is not you.
Deleting your account
Deleting your account and data is handled through this route rather than a button, because it requires reviewing what information must be retained by legal obligation — tax records, for example — and what may be erased. Request it from the Data Rights form or by writing to info@bonimmo.org.
Limits of withdrawal
Withdrawing your consent stops future processing, but does not by itself reverse processing already carried out or a verification already performed, and does not affect information we must retain by legal obligation.
Cookies, analytics, and your control
We use cookies necessary to maintain your session and preferences, and analytics cookies (Google Analytics) to understand in aggregate how the site is used and improve it: pages visited, device type, and general interactions. We also measure the results of our campaigns. When you arrive through a link that carries campaign details —an ad, one of our emails, an invitation or one of our social media posts—, that link may carry a click identifier (added by the platform that showed the ad; some networks, such as Facebook, also add it to links that are not ads) and the campaign details: its source, medium, name, term and content. Your browser stores that identifier and those details, together with the page you landed on and the site you came from —never the full address— and the moment you arrived, for at most ninety days: after that period it is no longer used and is deleted on your next visit, and a visit without campaign details does not replace it. With them we know which campaign brought each account and each enquiry or visit request you send us through one of our forms: when you send it, the form sends what your browser stored, and we keep it together with that enquiry or visit request for as long as it exists; if you did not arrive from any campaign, we record that as well. If you arrived through an invitation or through the link of a selection an agent sent you, with your enquiry or visit request we store only that you arrived through that kind of link: never the invitation code, which selection it was, or the moment you opened the link. From the campaign details stored with an enquiry or visit request we discard, before storing them, values that contain @, /, \, ?, #, &, = or %; values that contain control characters; values that contain seven or more digits, even when separated by spaces, hyphens, full stops, commas, underscores, middle dots, parentheses or "+"; values that contain a run of twenty or more letters and digits shaped like a key or an identifier; and values shaped like a CURP or an RFC. We apply those rules to values written in full-width characters as well. This reduces the chance of storing an email address, a phone number or a code that way, but does not eliminate it: a value with none of those shapes —for example, a name or a domain— is stored. And when someone creates an account, completes their verification or contacts us about a property through WhatsApp, phone, email or an accepted inquiry form, we tell that platform it happened, so we know which ads work and which do not. We send those platforms that the conversion occurred, the click identifier that produced it and, when you have given them to us —by writing to us through a form, scheduling a visit or creating your account—, your email and your phone turned beforehand into an irreversible code (SHA-256), never in the clear, so they can recognise it was the same person and measure better which ads work. We do NOT send them your name, your identity document data or the detail of your verification, and the control at the bottom of this page also stops this sending. Separately, the Google tag we use for analytics sends our Google Ads account every page you open, with its address —without what follows "?" or "#"; the address of a property’s listing includes the property’s identifier, and that of an invitation, the code of the person inviting you—, its title, which on a listing is the property’s, and the address of the page you came from when your browser shares it; and every event we measure of your use of the site: for example, the listing you view and the means by which you make contact, with the property’s identifier and title; your searches, with their filters; what you share or save to favourites, and the steps of your sign-up and your verification. Along with them travel the identifier of the Google click that brought you, if any, and the codes for your browser that Google keeps in its "_gcl_au" and "_gcl_aw" cookies. As with any site you visit, Google also receives your IP address and browser type, and if you have a Google session open in that browser and the browser allows it, each transmission also travels with Google’s cookies, with which Google can relate it to your Google account. With that data Google Ads measures our campaigns and may build lists of visitors to show them our ads after their visit. In addition, when you open the listing of a property that is part of the property catalogue we provide to Google for our ads, the Google tag sends only our Google Ads account —not Google Analytics— a notice that you viewed that listing ("view_item") with the property’s identifier —the same one that appears in the listing’s address and under which it appears in that catalogue— and the indication that it is a property ("real_estate"), and with it Google may later show you ads for that property or for others in that catalogue. If the property is not in that catalogue —for example, because its owner or agent asked for it not to be advertised— that notice is not sent. That notice travels with the same things as any other event of the tag and adds no data about you. Google keeps a browser in the list of people who viewed catalogue listings for up to thirty days after their last view, which is the duration set in our account. When you open the selection an agent sends you, the Google tag is not loaded and sends nothing. With the control at the bottom of this page, the Google tag is not loaded and no event reaches it. That control stops new transmissions but does not withdraw what Google has already received: your browser leaves those lists when that duration expires. To stop Google showing you personalised ads on any site, you can turn them off in the ad settings of your Google account ("My Ad Center", myadcenter.google.com). We also tell Meta (the company behind Facebook and Instagram) about your browsing on this site, to measure our campaigns on those networks and help them work better: each time you open one of our pages, when you view a property’s listing and when you contact us about a property through WhatsApp, phone, email or an accepted inquiry form. When you open a private link —the selection an agent sends you, an invitation or a link with a code from one of our emails— we tell it nothing and its cookie is not created. With each notice we send what happened; the kind of page it happened on —its generic route, for example "/propiedad/[id]" or "/agents/[slug]", never the full address nor the specific property or agent—; only the domain of the site you came to this one from; a random code that identifies your browser to Meta and that we keep in the "_fbp" cookie for up to ninety days after your last visit, and, if you arrived through a Facebook or Instagram link, the identifier of that click. We do not send Meta which property, agent or search you viewed, the content of your messages or forms, or any other platform’s click identifier. In Meta’s case, your email and phone turned into a code only accompany the notice that an account was created, and after that notice —whether or not it carries your email— we send it nothing more until you load the site again. As with any site you visit, Meta also receives your IP address and browser type, and its library adds technical data such as your screen size and the time of the event. And if you have a Facebook or Instagram session open in that browser and the browser allows it, each notice also travels with Meta’s cookies, with which Meta can relate it to your account. The control at the bottom of this page stops these notices and deletes that cookie. We tell you transparently that we operate an opt-out model: measurement is active from your first visit and you may disable it whenever you wish using the control at the bottom of this page, without a cookie wall, and that control covers both analytics and advertising measurement. Your choice is stored in your browser, so it applies to this site and on that device; the operator portal keeps its own configuration. You may also block or delete cookies from your browser.
Invitation links and storage in your browser
If you arrive through someone else’s invitation link, we store that invitation code in your browser’s local storage, together with the moment you opened the link. It serves one purpose only: if you decide to create an account, being able to record that you arrived through that invitation. The data is deleted from your browser as soon as the attribution is recorded, and if you never create an account it never leaves your device. Apart from that code, the invitation link carries campaign details saying it is an invitation: if you send us an enquiry or a visit request through one of our forms, with it we store that you arrived through an invitation —never the code or the moment you opened the link—, as explained in "Cookies, analytics, and your control", and that part is covered by the control at the bottom of this page. We keep the record of the moment you opened the link only when it happened within the programme’s window in force — today, thirty days before sign-up; outside it, that data point is discarded. If you do create the account, we keep the link between your account and that of the person who invited you, which is what allows the invitation to be credited to them. THIS STORAGE IS NOT COVERED BY THE CONTROL AT THE BOTTOM OF THIS PAGE, and we say so expressly: it is neither analytics nor advertising measurement, it builds no profile, it is shared with no one, and it travels to no platform; it is storage strictly necessary to provide the service you requested by opening the link, and a control that switched it off would switch off the invitation itself. You may delete it at any time from your browser, or avoid it by opening the link in a private window; in that case the invitation simply will not be attributed.
Measurement of our emails
When we send you an email, our sending provider embeds a single-pixel tracking image in the message and rewrites the links in its body so that they pass through the provider before bringing you to our site. That lets us know three things: whether your mailbox server accepted the message, whether the message was opened, and whether any of its links was followed. We use this for two distinct purposes: checking that our service emails — the one confirming your address, the one resetting your password, the one telling you about a visit — are actually arriving, which is necessary to provide the service; and measuring in aggregate whether our informational and marketing communications are useful, which is a secondary purpose you may object to. From these events we retain only your email address, what happened — delivered, opened, or link followed —, the timestamp, and a reference to the message: we do NOT retain the IP address or the mail program or browser that the provider reports to us along with the open, and we do not retain them because there is nowhere to: our record has no such field. These records are retained for ninety days and are then deleted automatically; the only one that outlives that period is the record explaining why an address was suppressed after a bounce or a complaint, and only while that suppression remains in force. THIS PROCESSING IS NOT COVERED BY THE CONTROL AT THE BOTTOM OF THIS PAGE, and we say so expressly: that control governs your browser’s signals on this site, and this happens in your mailbox. What is in your hands: configuring your mail program not to load remote images, so the pixel never loads at all, and unsubscribing from our non-essential communications through the link they carry at the end. Apart from these events, the links in our informational emails carry campaign details —for example, the newsletter edition and the article’s category—: if after following one you send us an enquiry or a visit request through one of our forms, those details are stored with it as explained in "Cookies, analytics, and your control" and kept for as long as the enquiry or visit request exists, not the ninety days of these events; that part is covered by the control at the bottom of this page.
Processors and data transfers
We do not sell your personal data and do not transfer it to third parties for those third parties' own purposes, except in the cases provided by the LFPDPPP — for instance, a request from a competent authority. To provide the service we rely on providers acting as PROCESSORS, handling data solely under our instructions and under confidentiality and security obligations: database, authentication, and file storage infrastructure; site hosting and delivery; payment and subscription processing; email delivery and measurement of its delivery and opening; identity verification; protection against abusive automation in forms; application error monitoring; site usage measurement; advertising campaign and results measurement; map tiles; and the artificial intelligence service that interprets natural-language search text or helps draft a property description. Several of these processors operate from infrastructure located outside Mexico, so your data is transferred abroad for those purposes. You may request details of the current processors by writing to info@bonimmo.org.
Identity verification and processor
To verify the identity of those who operate on the platform we use Sumsub (Sum and Substance Ltd.) as data processor, acting solely under our instructions and under the confidentiality and security obligations we impose. Sumsub captures and retains your official identification and liveness proof for the period agreed with us and required by applicable rules, and operates from infrastructure located outside Mexico, so your data is transferred abroad for this purpose. From that verification Bonimmo retains the outcome, an opaque reference to the file, and the data the processor extracts from your document: your name, your date of birth, your sex where the document states it, your nationality and country of birth, and the type, issuing country and expiry of the document presented. One of those is not only retained but PUBLISHED: YOUR NAME. Your public name on the platform is formed from it, so your legal name — or a shortened form of it that you choose — CEASES TO BE INTERNAL DATA; we explain this in detail under "Your public name". The remaining data derived from your document — your date of birth, your sex, your nationality, your country of birth, and the type, issuing country and expiry of the document — are NOT published and are not shown to other users: they are internal and serve to evidence the verification. We do NOT retain your document number or any tax or registry identifier: we do not need them to operate, and not holding them limits what a security incident could expose. This data is retained for as long as your account remains active and for legal retention periods. Detection of one person opening several accounts is performed by the processor against the file it holds; we retain no value derived from your documents for that purpose. You may exercise your data rights over this information by writing to info@bonimmo.org; we will process erasure of your file with the processor. Withdrawing your consent stops future processing but does not by itself reverse a verification already performed.
Your public name
On the platform you appear to other people under a public name. It is not optional, nor a decoration of your profile: it is what anyone sees when they view your profile, when they look at a property you manage and, if you are an advisor, when they browse the directory — and those pages can be seen without holding an account. IF YOUR IDENTITY IS VERIFIED, THAT NAME IS FORMED FROM THE NAME RECORDED ON THE OFFICIAL DOCUMENT YOU PRESENTED, and therefore YOUR LEGAL NAME, OR A SHORTENED FORM OF IT, IS PUBLISHED. We say it this plainly because it used to be otherwise: until now the public name was free text and you could enter anything. What you keep is the choice of FORM, not the choice of a name unrelated to your own: you may pick from the variants we compose from your document — your full name, or your name with a single surname — or propose your own, which is accepted if every word is a shortening of some part of your legal name. What that rule cannot verify on its own — a diminutive such as "Pepe" for "José" — goes to review by a person on our team, and your public name does not change in the meantime. If your identity is NOT verified, your public name remains whatever you write. No other data from your document is published. You may change the form of your name from your account at any time; if none of the available forms reflects your name, or you consider the published one inaccurate, write to us at info@bonimmo.org to have it rectified through the data rights route.
Content others publish about you
The platform allows those who take part in a transaction to leave ratings and comments about the people they dealt with. Those texts are contributed by their authors, who are responsible for their content, and may refer to you identifiably. If you believe a review about you is inaccurate, offensive, or improper, write to us at info@bonimmo.org so we can review it.
Data retention
We retain your data for as long as your account is active and, thereafter, for the periods required by applicable legal obligations — notably tax obligations — or while a liability remains to be addressed. Some data has its own shorter periods: technical abuse-control data is purged within hours and, at the latest, after eight days; invitation and account-claim links expire within days; delivery and open events for our emails are retained for ninety days; advisor verifications expire after twelve months. The campaign an enquiry or visit request arrived with is kept for as long as that enquiry or visit request exists, and is deleted with it; your browser keeps the campaign you arrived with for at most ninety days. Information other people generated in the course of a relationship with you — for example a transaction record or a review — may survive, dissociated from your account, after cancellation, as it is also those people’s information and supporting evidence of both parties’ obligations.
Security measures
We apply reasonable administrative, technical, and physical measures to protect your data against damage, loss, alteration, or unauthorised access, including role-based access control enforced in the database, encryption in transit, storage of sensitive documents in private buckets with no public access, and logging of relevant administrative actions. In the event of a breach that significantly affects your rights, we will notify you as required by law.
Minors
The service is not directed at minors and we do not knowingly collect their data. If you become aware that a minor has provided us with information, please write to us so we can erase it.
Changes to this Privacy Notice
This Notice may be updated to reflect legal changes or changes in our practices. We will publish the current version on this page, indicating the date and version number. Where a change is substantive we will communicate it through the contact details we hold for you.
Authority
If you consider that your right to personal data protection has been infringed, you may approach the competent personal data protection authority.
Recorded views and opt-out control
To record property and profile views, we store a random first-party UUID in your browser local storage that rotates each America/Mexico_City civil day; it is not derived from your account, IP address, or fingerprint. When recording a view, we process your IP address only transiently and retain only a technical HMAC for at most eight days to prevent abuse. These metrics are recorded views, not people or unique visitors. If you opt out of analytics using the control at the bottom of this page, we remove the current token and prevent another from being created or transmitted.
Selection links an agent sends you
An agent may pick several properties and send you ONE private link so you can see them without needing an account. When you open that link we record three things and only three: that the link was opened, which properties of the selection you looked at, and whether you tapped the button to ask about one of them, each with its timestamp. Each open, view, and click is an interaction, not a unique person. It serves one concrete purpose, necessary for the service your agent is providing you: knowing what caught your interest and being able to follow up. The sending agent sees all activity from their panel and remains the only contact channel. Each current direct administrator of an included listing can see aggregate link opens and, only for the listings they directly manage and that remain included, the current status, their views, and their clicks on “Ask”. If, after a total removal, an administrator retains direct administration of the notification's representative listing, they may see only the daily summary that explains that total removal, with no currently included listings, no selection status or dates, and no new subsequent data; this does not grant historical authority. They never see other administrators' listings or the client's identity, and do not receive the link token. We do NOT keep your IP address or the browser or device you open the link from, and we do not keep them because there is nowhere to: our record has no such fields. Nor do we keep any data identifying you: the record is tied to the link, not to a person, and opening it creates no account and no profile of you. If, when you open the selection, the link carries a click identifier or campaign details —Facebook and Messenger add the former to links shared there— and you then send us an enquiry or a visit request through one of our forms, with it we store only that you landed on a selection link —never which one, its token, or the moment you opened it—, as explained in "Cookies, analytics, and your control". The link expires after thirty days and your agent can withdraw it whenever they wish, after which it stops showing properties; expiry or withdrawal does not mean the record is deleted. THIS RECORD IS NOT COVERED BY THE CONTROL AT THE BOTTOM OF THIS PAGE, and we say so expressly: that control governs the analytics and advertising-measurement signals this site sends to third parties, and this travels to no third party — it is a record of ours, necessary for the purpose for which your agent sent you the link. What is in your hands: not opening the link, and asking your agent to withdraw it.
Cloudflare Turnstile and protection against abusive automation
We use Cloudflare Turnstile to protect our forms against abusive automation. To perform this verification, Cloudflare may process technical signals from the browser and the connection.
Read the Cloudflare Turnstile Privacy AddendumExercise your ARCO Rights
Request access, rectification, cancellation, or opposition regarding your personal data.
Usage and advertising measurement, and its cookies
We measure views and clicks with our own counters without visitor identity and, when configured, with Google Analytics and with Google Ads and Meta (Facebook and Instagram) advertising measurement, which stores the "_fbp" cookie in your browser. You can turn all of this measurement off here at any time; the change takes effect immediately, in this browser only.
Current status: Active