Legal

Privacy Notice

Last updated September 15, 2026.

This notice explains how Romero & Braas collects, uses and protects the personal data of visitors, prospective clients and Field Note subscribers.

Two bodies of law apply to us at once. We are a Mexican company, so Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP") and its Regulations govern our processing. Because we also offer our services to clients in the European Union, including in German, and measure how visitors from the EU use this site, the EU General Data Protection Regulation ("GDPR") applies to that processing as well, under its Article 3(2). Where this notice describes a GDPR right or legal basis, it is additional to your rights under Mexican law, not a replacement for them.

Who is responsible for your data

Romero and Braas, S. de R.L. de C.V. ("Romero & Braas," "we," "us"), with its principal place of business in Mexico City, Mexico, is the party responsible (responsable) for the personal data described in this notice. You can reach us at hello@romeroandbraas.com or +52 55 2693 2332.

What personal data we collect

We collect personal data directly from you when you use this website:

  • Field Note signup — your email address.
  • Start a Production form — your name, company, role, email address, phone number, and the production details you choose to share (format, target countries, timeline, scale, staffing needs, and any free-text notes).

If, and only if, you accept analytics when the site asks you, we also collect through Google Analytics: general device and browser information, approximate location derived from your IP address (with IP anonymisation enabled), the pages you visit, and the campaign parameters in the link you arrived through. If you decline, none of this is collected and no analytics cookie is set.

Separately, delivering the page itself means your IP address and browser information reach the providers who serve parts of it: the map on our Latin America page, our fonts, and the video platform if you choose to play a video. Those providers are named below.

We do not knowingly collect sensitive personal data (for example, health, religious or biometric information) through this site, and ask that you not include it in any form.

Why we use your data

We use personal data to:

  • Respond to your inquiry and prepare a scope, quote, or risk pre-mortem for your production.
  • Deliver the Field Note, if you sign up to receive it.
  • Understand how the site is used, so we can improve it.

The first two purposes are necessary for us to respond to you; the third is optional and does not affect your ability to use the site or receive a response if you decline it.

Legal basis for each purpose (GDPR)

Where the GDPR applies, we rely on the following:

  • Answering your production enquiry and preparing a scope, quote or risk pre-mortem — Article 6(1)(b): steps taken at your request before entering into a contract.
  • Sending you the Field Note — Article 6(1)(a): your consent, given when you enter your email address. You can withdraw it at any time.
  • Analytics and campaign measurement — Article 6(1)(a): your consent, given through the banner on this site, together with § 25(1) TTDSG for storing or reading anything on your device. No analytics runs before you accept.
  • Serving the page itself — map tiles, fonts and web hosting, Article 6(1)(f): our legitimate interest in delivering a working website. You can object to this; see your rights below.
  • Keeping the site secure and preventing form spam — Article 6(1)(f): our legitimate interest in an operable, unabused site.

Who we share it with

We work with a small number of service providers who process personal data on our behalf, strictly to operate this website:

  • Formspree, Inc. (United States) — receives the forms on this site and delivers the submissions to us. Receives what you type into the form.
  • Google LLC / Google Ireland Ltd. (United States, Ireland) — Google Analytics, only after you accept analytics. Receives your IP address (anonymised), device and browser information, and the pages you view.
  • Google LLC (United States) — Google Fonts, which serve the typefaces on every page. Receives your IP address when the page loads.
  • Mapbox, Inc. (United States) — serves the map on our Latin America page. Receives your IP address when that map loads.
  • Google Ireland Ltd. (YouTube) — hosts the videos embedded on this site. Videos do not load until you click play; before that, YouTube receives nothing. Once you click, YouTube receives your IP address and sets storage on your device.
  • Indian Type Foundry (Fontshare) (India) — serves one of our typefaces. Receives your IP address when the page loads.
  • Cloudflare, Inc. (United States) — hosts and delivers this website. Receives your IP address for every request, which is unavoidable for any website to work at all.

These are all the third parties that receive personal data through this site. We do not sell personal data and we do not share it with any other third party for marketing purposes.

International transfers

Using the providers above means personal data is transferred outside Mexico and outside the European Economic Area, principally to the United States and in one case to India. Where the GDPR applies, we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework for providers certified under it, and on the European Commission's Standard Contractual Clauses for the others. You can ask us for details of the safeguards in place at the address below.

Cookies and similar technologies

This site sets nothing on your device beyond what it needs to work until you have said yes. What is strictly necessary and therefore always present: your analytics choice itself, and your language choice. Nothing else is stored, and no third-party tag loads, unless you accept analytics.

If you accept, Google Analytics sets cookies to measure how the site is used, and we store the campaign link you arrived through so a later enquiry can be attributed to it. If you play an embedded video, YouTube sets its own storage at that point.

Your choice is not final. You can change it here at any time, and declining afterwards deletes the analytics cookies and the stored campaign data from this browser:

You can also block or delete cookies in your browser settings. Neither route affects your ability to browse the site or contact us.

Your rights under Mexican law (derechos ARCO)

Under the LFPDPPP, you have the right to access, rectify, cancel or object to the use of your personal data (derechos ARCO), and to revoke any consent you have given us — for example, to stop receiving the Field Note.

Your rights under the GDPR

If the GDPR applies to you, you additionally have the right to:

  • Access the personal data we hold about you, and receive a copy of it.
  • Rectify data that is inaccurate or incomplete.
  • Erase your data where we no longer have a reason to keep it.
  • Restrict how we use it while a dispute about it is resolved.
  • Object to processing we base on legitimate interest, including the page-delivery providers named above.
  • Receive your data in a portable form where we process it by consent or under a contract.
  • Withdraw consent at any time, without affecting what was lawful before you withdrew it. For analytics, the button above does this immediately.
  • Complain to a supervisory authority in the EU country where you live or work.

How to exercise any of these rights

Write to hello@romeroandbraas.com with the subject "Data rights request," identifying yourself and describing what you want. We answer within the timeframes set by the applicable law — 20 working days under the LFPDPPP, one month under the GDPR — and we do not charge for it.

How long we keep your data

We keep personal data only for as long as necessary to fulfil the purposes described in this notice, or as required by applicable law, after which it is deleted or anonymised.

Changes to this notice

We may update this notice from time to time. The date at the top reflects the most recent version; material changes will be posted on this page.

Contact

Questions about this notice or your data: hello@romeroandbraas.com · +52 55 2693 2332.