Effective Date: April 28, 2026
Wing Masters Express (“WME”, “we”, “our”, “us”) is committed to safeguarding the privacy of its users (“you”, “your”). This Privacy Policy comprehensively describes how we collect, use, disclose, and protect your personal information in connection with your use of our mobile application “Wing Masters Express” (the “Application”). By downloading, installing, and using the Application, you expressly consent to the data processing practices described in this document.
Wing Masters Express is a trademark duly registered in Mexico with the Mexican Institute of Industrial Property (IMPI).
1. Collection of Personal Information
We collect personal information primarily to provide, manage, and improve our restaurant and delivery services. The types of information collected are detailed below:
| Data Category | Description and Purpose |
|---|---|
| Identification and Registration | Includes first name, last name, email address, and date of birth for account creation and service personalization. |
| Phone Contact | Country phone prefix and phone number, verified via SMS to ensure validity and enable order communications. |
| Geolocation | Precise location to facilitate delivery logistics. Explicit consent is required for this functionality. |
| Payment Data | Information about the chosen payment method. Card data is managed exclusively by Stripe. |
| Usage Data | Technical information about the device and interaction patterns with the Application for system optimization. Such data may also be used for fraud prevention, risk analysis, identity authentication, and platform security, including the generation of device identifiers (device fingerprinting). |
1.1. Identity Verification
To ensure the integrity of our platform, WME implements a dual verification process. Upon registration, the user will receive two random 6-digit codes: one via SMS and one via email. The user has a strict deadline of one (1) minute to enter both codes; otherwise, the registration request will be voided and the process must be restarted.
1.2. Location and Notification Management
Prior to initial access, the Application will request permissions for push notifications and precise location. Granting these permissions is essential to ensure that order notifications are received promptly and to optimize the delivery experience. If precise location access is denied, the user must manually locate their delivery point on the provided map.
2. Payment Processing and Financial Security
WME offers three payment methods, each subject to specific security protocols:
Cash on Delivery: The user must specify the exact amount they will pay to ensure the delivery driver has the necessary change at the time of delivery.
Credit and Debit Cards: Transactions are processed entirely by Stripe, recognized as the world’s leading payment processor. Stripe employs cutting-edge technology and artificial intelligence for fraud prevention and detection of illicit activities.
Financial Data Security: Sensitive card information is never stored on or transmitted through WME’s servers. All data is securely maintained in our official Stripe account.
Processing Fees: When selecting this payment method, current Stripe fees will be added to the order total (currently 3.6% + $MX3.00 + VAT for operations in Mexico).
Points System: Users accumulate points for eligible purchases, which can be redeemed for food products.
3. Data Transfer and Disclosure
WME does not sell your personal information to third parties. However, information may be shared under the following circumstances:
“Wing Masters Express and its intellectual property, including the technological infrastructure and brand, are owned by Boostmonitor LLC. Information may be shared with this parent entity for operational management and corporate compliance purposes.”
Additionally, contact and location data is shared with our internal delivery team. WME emphasizes that it does not use external delivery providers, maintaining full control over the logistics process to guarantee service quality.
4. User Rights and Account Management
Users maintain control over their personal information through the following tools within the Application:
Profile Update: Ability to modify personal data and manage multiple delivery addresses.
Access Security: Option to recover passwords through a temporary password system sent to the verified email address.
Permanent Deletion: Users may opt for the permanent deletion of their account. This process requires double confirmation, explicitly warning that the action is irreversible and results in the total and unrecoverable loss of all information and accumulated points.
5. Retention and Deletion of Personal Data
5.1. Retention Period
Wing Masters Express will retain user personal data for the time strictly necessary to fulfill the purposes described in this Privacy Policy, as well as to comply with applicable legal, tax, and accounting obligations under current Mexican law.
Specifically, the following retention periods apply:
| Data Category | Retention Period |
|---|---|
| Identification and registration data | During the account’s active period and up to 5 (five) years after cancellation |
| Phone contact data | During the account’s active period and up to 5 (five) years after cancellation |
| Geolocation data | 90 (ninety) calendar days after each use session |
| Transaction and payment data | 10 (ten) years pursuant to the Federal Tax Code |
| Usage and technical data | 12 (twelve) months after collection |
| Identity verification records | 5 (five) years pursuant to fraud prevention obligations |
The above periods may be extended when there is an express legal obligation requiring it, a pending judicial or administrative dispute, or a request from a competent authority.
5.2. Criteria for Determining Retention Period
To determine the appropriate retention period for each category of personal data, WME considers the following criteria:
a) The nature, category, and volume of personal data processed.
b) The specific purpose for which it was collected and the time reasonably necessary to fulfill it.
c) The legal, regulatory, and tax obligations applicable to WME as the data controller, including but not limited to the Federal Tax Code, the Income Tax Law, the Anti-Money Laundering Law, and other applicable provisions.
d) The potential harm that could result from improper retention or unauthorized use of the data.
e) Industry standards and best practices in information security.
5.3. Deletion Procedure and Account Cancellation
Users may request the permanent deletion of their account and personal data at any time through the functionality enabled for this purpose within the Application. This process is subject to the following conditions:
a) Mandatory double confirmation. Due to the irreversibility of the process, account deletion will require express double confirmation from the user, who will be duly warned that this action results in the total, definitive, and unrecoverable loss of all information associated with their account, including order history, registered delivery addresses, and all points accumulated in the Rewards Program.
b) Processing period. Once the deletion request is confirmed, WME will proceed to effectively delete the user’s personal data within a maximum period of 30 (thirty) business days, except for data whose retention is mandatory pursuant to Section 5.1 of this Policy.
c) Data subject to mandatory retention. Data that cannot be immediately deleted due to a legal retention obligation will be blocked during the applicable period, so that it cannot be subject to any active processing, and will be securely destroyed once the applicable legal period has elapsed.
d) Active orders. Account deletion cannot be processed when the user has active, in-transit, or pending orders. The request must be made once all orders are in a finalized status.
e) Pending obligations. An account deletion request does not exempt the user from fulfilling previously acquired obligations with WME, nor from the consequences arising from the application of the Order Collection Non-Compliance Policy established in the Terms and Conditions.
5.4. Anonymization and Dissociation of Data
Prior to permanent deletion, WME may proceed to anonymize or dissociate certain personal data when technically necessary to preserve the statistical integrity of its internal systems, provided that such process irreversibly ensures that the resulting information cannot be associated with any identified or identifiable individual. Anonymized data will not be subject to the retention periods established in Section 5.1, having lost its character as personal data.
5.5. Security in Deletion
WME guarantees that the deletion of personal data will be carried out through technical procedures that prevent subsequent recovery, including secure deletion of database records, revocation of access and session tokens, and removal of backup copies in storage system update cycles, in accordance with applicable technical standards.
6. International Transfer of Personal Data
6.1. Context and Legal Basis for International Transfer
Wing Masters Express, in its capacity as personal data controller, informs users that, due to the corporate structure under which it operates, some personal data may be transferred, transmitted, or accessed from territories outside the United Mexican States. This is because the technological infrastructure, information processing systems, and the entity that owns the Application — Boostmonitor LLC, incorporated under the laws of the State of Delaware, United States of America — are domiciled and partially operate outside Mexican territory.
WME declares that such international transfers are carried out in strict compliance with the applicable provisions of Mexican federal privacy law, its regulations, and the Privacy Notice Guidelines issued by the National Institute for Transparency, Access to Information and Personal Data Protection (INAI).
6.2. Recipients of International Transfers
User personal data may be transferred to the following entities located outside Mexican territory:
| Receiving Entity | Country | Purpose | Legal Basis |
|---|---|---|---|
| Boostmonitor LLC | United States of America (Delaware) | Operational, administrative, and corporate management of the platform | Contractual relationship and data subject consent |
| Stripe, Inc. | United States of America | Secure processing of card payments | Performance of the service contract |
| Amazon Web Services, Inc. (AWS) | United States of America | Infrastructure hosting, databases, and cloud storage | Legitimate interest and performance of the contract |
WME declares that it does not carry out international transfers of personal data to entities other than those indicated in the table above, except upon express request from a competent authority or with the express consent of the data subject.
6.3. Safeguards Applicable to International Transfers
WME guarantees that all international personal data transfers described in Section 6.2 are covered by one of the following safeguards:
a) Contractual clauses: WME has entered into or adheres to the corresponding contractual instruments with each receiving entity, establishing obligations equivalent to those provided under applicable Mexican privacy law regarding the confidentiality, security, and limited use of transferred personal data.
b) International certifications and standards: The technology providers referenced in Section 6.2 — in particular Stripe, Inc. and Amazon Web Services, Inc. — hold internationally recognized information security certifications, including but not limited to PCI-DSS, ISO/IEC 27001, and SOC 2 Type II, which guarantee levels of protection equivalent to or higher than those required by applicable Mexican law.
c) Binding corporate policies: In the case of Boostmonitor LLC, as the parent entity and owner of WME’s technological infrastructure, data transfers are governed by binding internal data protection policies that establish obligations of confidentiality, limited use, and security equivalent to those required under applicable Mexican privacy law.
6.4. Data Transferred and Scope of Transfer
The categories of personal data subject to international transfer, as described in Section 6.2, are as follows:
a) To Boostmonitor LLC: Identification and registration data, contact data, usage and technical data, and transaction history, for the exclusive purpose of operational management, technical support, internal audit, and corporate compliance.
b) To Stripe, Inc.: Data strictly necessary for processing the payment transaction, pursuant to the terms of Stripe’s Privacy Policy available at https://stripe.com/us/privacy. WME reiterates that full card data does not transit through or is stored on its servers, being managed entirely by Stripe under its own PCI-DSS security standards.
c) To Amazon Web Services, Inc.: Data stored in the cloud infrastructure contracted by WME, including user databases, order records, and technical system information. AWS acts as a data processor, without authorized access to data content for its own purposes.
6.5. User Rights Regarding International Transfers
Users have the right to object to the international transfer of their personal data when such transfer is not necessary for the performance of the service contract or is not covered by a legal obligation. However, WME advises that refusal to authorize certain transfers — particularly those directed to Stripe, Inc. and Amazon Web Services, Inc. — may technically prevent the full or partial provision of the service, as such transfers are inherent to the operation of the Application.
To exercise the right to object to international data transfers, users may contact WME through the contact channels established in Section 10.4 of this Policy, or exercise their data subject rights pursuant to the procedure described in the corresponding section of this document.
6.6. Liability in Third-Party Transfers
WME declares that once personal data has been transferred to the receiving entities indicated in Section 6.2, the further processing carried out by such entities will be governed by their own privacy policies and applicable regulatory frameworks. Notwithstanding the foregoing, WME will have adopted reasonable contractual and technical measures to ensure that such processing is carried out in accordance with the principles of lawfulness, consent, information, quality, purpose limitation, loyalty, proportionality, and accountability established in applicable Mexican privacy law.
7. Cookies, Local Storage, and Tracking Technologies
7.1. Definition and Scope
Wing Masters Express informs users that the mobile Application makes use of various local storage and session identification technologies to ensure the technical functioning of the platform, optimize the user experience, and maintain the security of active sessions. These technologies include, but are not limited to, local device storage (localStorage), authentication and session tokens, device identifiers, and application data caches.
Unlike a conventional website accessed through a browser, the Wing Masters Express Application operates under a native mobile application model, which means that the storage technologies described in this section operate within the controlled environment of the Application installed on the user’s device, without interaction with the third-party cookie ecosystem typical of conventional web browsers.
7.2. Storage Technologies Used
WME uses the following local storage technologies on the user’s device:
| Technology | Purpose | Nature | Retention Period |
|---|---|---|---|
| Session authentication token | Maintain the user’s active session without requiring repeated authentication | Strictly necessary | Duration of the active session or until explicit logout |
| Push notification token (Firebase) | Identify the device for sending order-related notifications | Strictly necessary | During the account’s active period or until permission is revoked |
| Application data cache (localStorage) | Temporarily store configuration data, application options, shopping cart, user preferences, and session data to optimize performance | Functional | Variable by category; maximum 3 hours for user session data |
| Device identifier | Associate the physical device with the user’s account for security and fraud prevention purposes | Security | During the account’s active period |
| Delivery address cache | Temporarily store the user’s delivery addresses to streamline the order process | Functional | Until modified by the user or account deletion |
| Session geolocation data | Temporarily retain the user’s location coordinates during an active order session | Strictly necessary | Exclusively during the active order session |
7.3. Classification by Category and Purpose
The storage technologies used by WME are classified into the following categories based on their purpose and nature:
a) Strictly necessary storage. Includes technologies without which the Application cannot function in a technically viable manner. This includes session authentication tokens, device identifiers for push notifications, and geolocation data during active order sessions. This type of storage does not require additional user consent, as its use is inherent to the provision of the contracted service.
b) Functional storage. Includes technologies that significantly improve the Application’s user experience, allowing the system to remember user preferences, shopping cart contents, configuration data, and application options between sessions. Its use is based on WME’s legitimate interest in providing an efficient and personalized service.
c) Security storage. Includes identifiers and technical records used to detect and prevent unauthorized access, fraud, notification token duplication, and other threats to the integrity of the platform and user accounts.
7.4. Data Stored Locally on the Device
WME informs users that the following types of data may be temporarily stored on the device through the technologies described in Section 7.2:
a) Session credentials in encrypted token format, necessary to maintain user authentication without requiring repeated password entry.
b) Application configuration data, including system options, branch parameters, available payment methods, and interface configuration.
c) Temporary shopping cart contents, to preserve the user’s selection in the event of an involuntary session interruption.
d) Previously registered delivery address data, stored locally to streamline the order confirmation process.
e) Device technical records used exclusively for push notification management through Firebase Cloud Messaging.
7.5. User Control Over Local Storage
Users have the following options to manage or revoke the use of the storage technologies described in this section:
a) Logout. When explicitly logging out of the Application, WME will immediately delete active authentication tokens and locally stored session data on the device.
b) Application uninstallation. Uninstalling the Application from the device results in the automatic deletion of all data stored locally by the Application on the device, including caches, tokens, and preferences.
c) Revocation of operating system permissions. Users may revoke geolocation and push notification permissions granted to the Application at any time through their device’s operating system settings, without this implying the deletion of their account. However, WME advises that revoking such permissions may limit the Application’s functionality as described in Section 1.2 of this Policy.
d) Data deletion request. Users may request the deletion of data stored on WME’s servers through the data subject rights exercise procedure described in the corresponding section of this Policy.
7.6. Absence of Advertising Tracking and Third-Party Sharing
WME expressly declares that the storage technologies described in this section are not used for advertising purposes, commercial profiling, tracking user behavior on third-party platforms, or sharing data with advertising networks or external analytics platforms. The local storage used by the Application is exclusively functional, technical, and security-oriented in nature, aimed solely at the proper provision of the restaurant and delivery service offered by WME.
7.7. Updates to Storage Technologies
WME reserves the right to incorporate, modify, or remove storage technologies in future versions of the Application, provided that such changes are consistent with the principles and purposes described in this Policy. If storage technologies are incorporated that involve substantially different personal data processing from that described here, WME will notify users prior to the entry into force of such changes, pursuant to the procedure established in the modifications clause of this Policy.
8. Minors
8.1. Minimum Age Requirement
Wing Masters Express is a restaurant and delivery service platform intended exclusively for individuals 18 (eighteen) years of age or older, or alternatively, for individuals 13 (thirteen) years of age or older who have the express, verifiable, and documented consent of their parent or legal guardian, pursuant to applicable Mexican privacy law and its regulations.
WME declares that it does not intentionally collect personal data from individuals under 13 (thirteen) years of age. If WME detects or is notified that a user under such age has provided personal data without verifiable parental consent, it will immediately proceed to suspend the account and delete the corresponding data pursuant to the procedure established in Section 5.3 of this Policy.
8.2. Legal Representative’s Responsibility
When a minor between 13 (thirteen) and 17 (seventeen) years of age uses the Application with the consent of their parent or legal guardian, such legal representative assumes full responsibility for:
a) The use that the minor makes of the Application, including placing orders, selecting payment methods, and managing their user account.
b) The truthfulness and accuracy of the personal data provided during the registration and use of the Application.
c) The minor’s compliance with these Terms and Conditions, as well as the Privacy Policy and other applicable policies, including the Order Collection Non-Compliance Policy.
d) The financial consequences arising from orders placed through the minor’s account, including those arising from the application of the Non-Compliance Policy established in the Terms and Conditions.
e) Supervision of the minor’s use of payment methods associated with the account, particularly regarding the use of bank cards and the redemption of accumulated points.
8.3. Age Verification Mechanism
During the registration process, WME will request the user’s date of birth as mandatory data. This information will be used, among other purposes, to verify that the user meets the minimum age requirement established in Section 8.1 of this section. If the date of birth provided indicates that the user is under 13 (thirteen) years of age, the system will automatically prevent account creation and inform the user that they do not meet the age requirements to use the Application.
WME acknowledges that age verification mechanisms based on user self-declaration have inherent technical limitations. Consequently, WME establishes that responsibility for the use of the Application by minors lies with the parents or legal guardians who have facilitated, permitted, or failed to adequately supervise such access.
8.4. Verifiable Parental Consent
In cases where a minor between 13 (thirteen) and 17 (seventeen) years of age requests registration in the Application, WME may require, at its discretion and when circumstances warrant, proof of verifiable parental consent through any of the following mechanisms:
a) Direct communication from the legal representative to WME’s official email address, confirming their identity and express consent for the minor’s registration.
b) Submission of documentation proving the parent-child or legal guardianship relationship between the representative and the minor, when WME deems it necessary for the protection of the minor’s interests.
c) Any other verification mechanism that WME implements in future versions of the Application, in accordance with industry best practices and INAI guidelines on the protection of minors’ data.
8.5. Inadvertently Collected Personal Data of Minors
In the event that WME inadvertently collects personal data from a minor under 13 (thirteen) years of age without verifiable parental consent, WME commits to:
a) Immediately suspend access to the associated account upon detection or notification of such situation.
b) Delete all of the minor’s personal data from its active systems within a maximum period of 72 (seventy-two) business hours from the detection or notification of the incident.
c) Notify the minor’s legal representative, if their contact information is available, about the detection of the situation and the measures adopted.
d) Maintain an internal record of the incident pursuant to the accountability obligations established in applicable Mexican privacy law and its regulations.
8.6. Reporting Minor Accounts
Any user, parent, or legal guardian who becomes aware that a minor under 13 (thirteen) years of age has created an account in the Application without the corresponding consent may report this to WME through the following channels:
Email: support@boostmonitor.com
Mexico Phone: +52 81 3585 7975
US Phone: +1 302 385 8120
WME commits to addressing such reports within a maximum period of 5 (five) business days from receipt and to adopting the appropriate corrective measures as established in Section 8.5 of this section.
9. Legal Basis for Personal Data Processing
9.1. Applicable Regulatory Framework
Wing Masters Express, in its capacity as personal data controller, declares that all personal data processing carried out through the Application is based on one of the legal bases recognized by applicable Mexican federal privacy law, its regulations, and the Privacy Notice Guidelines issued by INAI. WME declares that it will not carry out any personal data processing without such processing being grounded in one of the legal bases described in this section.
9.2. Applicable Legal Bases
Personal data processing carried out by WME is based on the following legal bases, as applicable to each data category and processing purpose:
a) Express consent of the data subject
Pursuant to applicable Mexican privacy law, the data subject’s consent constitutes the primary legal basis for personal data processing carried out by WME. Such consent is obtained expressly during the Application registration process, through acceptance of this Privacy Policy and the Terms and Conditions. The consent thus granted is:
- Freely given: The user is not required to provide it as a condition for accessing services other than those for which it is strictly necessary.
- Specific: It is collected for concrete, determined, and explicitly described purposes in this Policy.
- Informed: The data subject has had prior access to complete information about the processing of their data before granting consent.
- Unambiguous: It is expressed through a clear and positive affirmative action by the user, consisting of express acceptance during the registration process.
The following categories of processing are specifically based on the data subject’s express consent:
| Processing | Data Involved |
|---|---|
| Registration and account creation | Name, last name, email address, date of birth, phone number |
| Identity verification via SMS and email | Phone number and email address |
| Push notification delivery | Firebase device token |
| Precise geolocation access | Device GPS coordinates |
| Data transfer to Boostmonitor LLC | All account data |
| Preferences and cache storage | Configuration and session data |
b) Performance of a contract
Pursuant to applicable Mexican privacy law, personal data processing is lawful when necessary for the performance of a contract to which the data subject is a party. In WME’s case, the contractual relationship is established at the moment the user accepts the Terms and Conditions and places an order through the Application. The following processing activities are justified under this legal basis:
| Processing | Data Involved | Contractual Justification |
|---|---|---|
| Order processing and management | Name, address, phone, payment method | Necessary to execute the contracted delivery service |
| Card payment processing | Transaction data transferred to Stripe | Necessary to complete payment for the service |
| Order status communication | Email, phone, notification token | Necessary to inform the user about their order |
| Rewards Program management | Account identifier, purchase history | Necessary to calculate and credit the corresponding points |
| Non-Compliance Policy enforcement | Account data, order history, points balance | Necessary to enforce contractually accepted conditions |
c) Compliance with legal obligations
Pursuant to applicable Mexican privacy law, personal data processing is lawful when necessary to comply with a legal obligation to which WME is subject. The following processing activities are justified under this legal basis:
| Processing | Applicable Legal Obligation |
|---|---|
| Retention of transaction records | Federal Tax Code — 10-year retention obligation |
| Retention of identity verification data | Federal Law for the Prevention and Identification of Transactions with Illicitly Obtained Funds |
| Response to competent authority requests | Obligation to cooperate with judicial and administrative authorities |
| Issuance of tax receipts | Income Tax Law and Federal Tax Code |
d) Legitimate interest
Pursuant to applicable Mexican privacy law, personal data processing may be carried out without the data subject’s consent when necessary for the satisfaction of the data controller’s legitimate interests, provided that such interests do not override the fundamental rights and interests of the data subject. WME applies this legal basis restrictively and only in the following cases, having conducted in each case the corresponding balancing test between the legitimate interest pursued and the data subject’s rights:
| Processing | Legitimate Interest | Balancing |
|---|---|---|
| Functional cache and preferences storage | Technical performance optimization of the Application | Privacy impact on the user is minimal; data is technical and non-sensitive |
| Device technical data recording for security | Fraud prevention, unauthorized access prevention, and account protection | Interest in protecting platform and user security outweighs minimal privacy impact |
| Internal usage pattern analysis for service improvement | Continuous Application optimization | Data is processed in aggregate form not linked to identifiable individual profiles |
| Retention of non-compliance records | Operational and financial protection of WME against abusive conduct | Legitimate interest in protecting business viability is proportionate to the measure adopted, which was previously accepted by the user in the Terms and Conditions |
9.3. Processing of Sensitive Personal Data
WME declares that it does not intentionally collect personal data considered sensitive under applicable Mexican privacy law, such as data relating to racial or ethnic origin, health status, genetic information, religious, philosophical, or moral beliefs, union membership, political opinions, or sexual preference. In the exceptional and involuntary event that WME receives data of such nature, it will be immediately deleted without being subject to any processing.
9.4. Consequences of Refusing Processing
WME informs users that refusal to provide certain personal data or to authorize certain processing activities may have the following consequences on service provision:
| Refused Data or Processing | Consequence |
|---|---|
| Mandatory registration data (name, email, phone) | Inability to create an account and access the service |
| Identity verification via SMS and email | Inability to complete the registration process |
| Precise geolocation | User must manually indicate their delivery point on the map |
| Push notifications | User will not receive real-time updates on their order status |
| Transfer to Stripe | Inability to use bank cards as a payment method |
| Cache and session storage | Possible degradation of Application performance and user experience |
9.5. Withdrawal of Consent
Users may withdraw consent granted for the processing of their personal data at any time, without retroactive effect on processing previously carried out lawfully. Withdrawal of consent must be requested through the data subject rights exercise procedure described in Section 10 of this Policy. WME advises that withdrawal of consent regarding data whose processing is essential for service provision will result in the inability to continue offering such service to the user, which may lead to account cancellation as established in Section 5.3 of this Policy.
10. Data Subject Rights — Access, Rectification, Cancellation, and Objection
10.1. Recognition and Guarantee of Data Subject Rights
Wing Masters Express recognizes and guarantees users, in their capacity as personal data subjects, the full exercise of the rights of Access, Rectification, Cancellation, and Objection (hereinafter, “Data Subject Rights”), pursuant to applicable Mexican federal privacy law, its regulations, and the Privacy Notice Guidelines issued by INAI.
WME designates its Personal Data Protection Department as responsible for handling Data Subject Rights exercise requests, which may be contacted through the channels established in Section 10.4 of this section.
10.2. Description of Data Subject Rights
a) Right of Access
The data subject has the right to obtain from WME, at any time and free of charge, confirmation as to whether their personal data is being processed, as well as detailed information about:
- The categories of personal data held by WME.
- The specific purposes for which they are processed.
- The origin of the data when not provided directly by the data subject.
- Transfers carried out or planned, identifying recipients and the purpose of such transfers.
- The envisaged retention period for each data category.
- The existence of automated decision-making, including profiling, and the logic applied in such processes.
Information will be provided in a readable, clear, and accessible format, preferably through the email address registered in the user’s account or through mechanisms enabled within the Application.
b) Right of Rectification
The data subject has the right to request the correction of their personal data when it is inaccurate, incomplete, outdated, excessive, or false. To exercise this right, the data subject must precisely indicate which data is incorrect and provide documentation supporting the requested correction when the nature of the data so requires.
WME will enable self-management mechanisms within the Application that will allow users to directly rectify certain profile data — such as name, last name, email address, phone number, and delivery address — without needing to file a formal request with the Personal Data Protection Department. For data whose modification is not available through self-management, the user must follow the formal procedure established in Section 10.3 of this section.
c) Right of Cancellation
The data subject has the right to request the deletion of their personal data from WME’s systems when any of the following circumstances arise:
- The data is no longer necessary for the purposes for which it was collected.
- The data subject has withdrawn consent on which processing was based and there is no other legal basis justifying it.
- The data has been processed unlawfully.
- The data must be deleted in compliance with a legal obligation.
The exercise of the right of cancellation is subject to the blocking period provided under applicable Mexican privacy law, during which the data will remain blocked and cannot be subject to active processing, being securely destroyed once the legally required retention period has elapsed as established in Section 5 of this Policy.
WME advises that cancellation of data essential for service provision will necessarily imply cancellation of the user’s account, with the consequences described in Section 5.3 of this Policy.
d) Right of Objection
The data subject has the right to object at any time, for legitimate and well-founded reasons relating to their particular situation, to the processing of their personal data, even when such processing is lawful, in the following cases:
- When processing is based on WME’s legitimate interest, as described in Section 9.2(d) of this Policy.
- When data is processed for direct marketing or profiling for commercial purposes.
- When processing is intended for automated decision-making that produces legal effects on the data subject or significantly affects them.
WME will evaluate each objection request individually, weighing the reasons alleged by the data subject against the legitimate interests, legal obligations, or third-party rights that may justify the continuation of processing. If the objection is upheld, WME will cease processing as soon as technically possible.
10.3. Procedure for Exercising Data Subject Rights
a) Submission of the request
The data subject or their duly authorized legal representative may exercise their Data Subject Rights by submitting a written request addressed to WME’s Personal Data Protection Department, through any of the channels established in Section 10.4 of this section. Such request must contain, at a minimum, the following elements:
- Full name of the data subject and, where applicable, their legal representative, attaching the instrument evidencing such representation.
- Address or email address to receive the corresponding response.
- Clear and precise description of the personal data regarding which the right is being exercised, as well as the right or rights to be exercised.
- Documentation proving the data subject’s identity, consisting of a copy of a current government-issued photo ID.
- In the case of the right of rectification, documentation supporting the requested correction.
- Any other element or document that facilitates the location of the personal data and the timely handling of the request.
b) Acknowledgment of receipt
WME will acknowledge receipt of the request within a maximum period of 3 (three) business days from its receipt, informing the data subject of the reference number assigned for tracking their request.
c) Response period
WME will handle and resolve the Data Subject Rights exercise request within a maximum period of 20 (twenty) business days from the date of receipt of the complete and duly integrated request, pursuant to applicable Mexican privacy regulations. This period may be extended once and for an equal period when the circumstances of the case so justify, with WME required to notify the data subject of such extension before the expiration of the original period, expressing the reasons justifying it.
d) Resolution and compliance
If the request is upheld, WME will adopt the corresponding measures within a maximum period of 15 (fifteen) business days from notification of the favorable resolution to the data subject. This period may be extended once and for an equal period when the technical complexity of the required measures so justifies.
e) Inadmissible or incomplete requests
When the request does not meet the requirements established in subsection (a) of this section, WME will notify the data subject within the following 5 (five) business days, granting them a period of 10 (ten) business days to remedy the identified omissions or deficiencies. If not remedied within such period, the request will be deemed not submitted, without prejudice to the data subject’s right to submit a new request.
f) Free of charge
The exercise of Data Subject Rights is free of charge. However, when the data subject submits manifestly unfounded, repetitive, or excessive requests — particularly those submitted with a frequency that cannot reasonably be justified by the nature of the data or processing — WME may charge a reasonable fee not exceeding the administrative costs actually incurred in handling such requests, or refuse to act on them, in either case providing justification for its decision.
10.4. Contact Channels for Exercising Data Subject Rights
Data Subject Rights exercise requests must be directed to Wing Masters Express’s Personal Data Protection Department through the following official channels:
| Channel | Contact Details |
|---|---|
| support@boostmonitor.com | |
| Mexico Phone | +52 81 3585 7975 |
| US Phone | +1 302 385 8120 |
| Mailing Address | Boostmonitor LLC, 8 The Green STE B, Dover, Delaware 19901, USA |
WME recommends that requests be submitted preferably by email, attaching the required documentation in digital format, in order to expedite their receipt, acknowledgment, and processing.
10.5. Review Appeal Before INAI
If the data subject considers that WME has not responded to their Data Subject Rights exercise request within the established periods, or that the response received does not satisfy their request, the data subject will have the right to file a complaint or report with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI), pursuant to applicable Mexican privacy law, through the following means:
- INAI website: www.inai.org.mx
- PISAD System (Integral Portal for Personal Data Access Requests): www.pisad.inai.org.mx
- Address: Insurgentes Sur 3211, Colonia Insurgentes Cuicuilco, Alcaldía Coyoacán, C.P. 04530, Mexico City.
WME emphasizes that filing a complaint with INAI does not constitute a prerequisite for exercising additional legal actions that the data subject may consider appropriate under applicable law.
10.6. Limitations on the Exercise of Data Subject Rights
WME informs users that the exercise of Data Subject Rights may be limited in the following cases, pursuant to applicable Mexican privacy law:
a) When there is a legal obligation that prevents the cancellation, modification, or delivery of the requested data, particularly regarding tax, accounting, or regulatory compliance records.
b) When the cancellation or modification of the data could cause harm to the rights or legitimate interests of third parties.
c) When there is an ongoing judicial, administrative, or arbitral proceeding in which the data is relevant as evidence.
d) When the request affects data that is necessary for the fulfillment of current contractual obligations between the data subject and WME.
e) When the request is manifestly unfounded or intended to obstruct WME’s legitimate operations.
In all of the above cases, WME will communicate to the data subject, with duly reasoned and substantiated justification, the reasons that justify the limitation on the exercise of the requested right, also informing them of the available remedies to challenge such determination.
© 2026 Wing Masters Express. All rights reserved. Wing Masters Express is a brand owned by Boostmonitor LLC.