Legal
Privacy Policy
1. Who we are
BAJEX ("we", "us") is the data controller (responsable) for the personal data described here. BAJEX is a cross-border package-forwarding and last-mile delivery service based in Los Cabos, Baja California Sur, Mexico, operating between a receiving point in California, USA and Baja California and Baja California Sur.
- Privacy contact: privacy@bajexx.com (mark your message "Privacy / Datos Personales")
- Phone / WhatsApp: +1 (619) 279-0648
2. What personal data we collect
2.1 Customers and package recipients
| Category | Examples | Source |
|---|---|---|
| Identification & contact | Full name, phone number, email address | You (when you request a quote or open an account), or the sender on your behalf |
| Delivery addresses | Your address on file, and any additional delivery address you add for a specific delivery | You, or our operator at delivery time |
| Shipment data | Package descriptions, weights, dimensions, declared value, tracking numbers, origin and destination, delivery preferences (for example "leave at the door if pre-authorized") | You, the sender, or our operations |
| Delivery evidence | A photo taken at the delivery address; the GPS coordinates recorded on the delivering device at the moment the photo is taken, and the street address those coordinates resolve to; the recipient's printed name and signature; the date and time | Captured at delivery |
| Payment data (once payments go live) | Amount, currency, payment status, the type of payment method and the last digits of a card. Full card numbers are entered directly into our payment processor (Stripe) and are never received or stored by BAJEX. | Stripe / you |
| Communications | Messages you send us through the quote-request form, email, or the chat widget | You |
2.2 Website visitors
- Quote-request form submissions — the name, contact details, shipment details, and message you provide.
- A Cloudflare Turnstile token, used once to confirm the submission is not automated and not stored afterward.
- Your IP address and standard request metadata, processed by our infrastructure provider (Cloudflare) to deliver and protect the site (see section 6).
- Aggregate, non-identifying traffic measurements via Cloudflare Web Analytics (cookieless — see section 6).
2.3 Couriers (BAJEX Courier app)
| Category | Examples |
|---|---|
| Account | Phone number (your sign-in identifier), a PIN (stored only as a cryptographic hash), your name, and the BAJEX locations you are assigned to. You sign in with your PIN and a key held in your phone's secure hardware; a one-time code by SMS is used the first time you set up a device and for account recovery. |
| Operational | The deliveries assigned to you, and the photo, GPS location, address, recipient name and signature you capture while completing a delivery (this is the customer delivery evidence in 2.1). |
| Device | Standard request metadata (app version, device type) for support and security. |
The Courier app requests camera access (to photograph the package and scan the tracking barcode) and location while using the app (to record where a delivery photo was taken). It does not request background location and does not track a courier's location at any other time.
2.4 Warehouse staff (BAJEX Warehouse app)
BAJEX staff sign in to the internal Warehouse app with a company account. The app processes the operational data needed to run a hub — intake scans, manifests, consolidation, pickups, and package/label records — and the staff member's identity for the chain-of-custody log. It does not request location access.
2.5 Sensitive personal data
BAJEX does not intentionally collect sensitive personal data as defined by Mexican law. Financial and payment data is given the heightened protection the law requires and is handled as described above (processed by Stripe, not stored by BAJEX). A handwritten signature and a photo of a doorway are collected strictly as proof that a delivery occurred and are used only for that purpose.
3. Why we use it
3.1 Primary purposes (necessary for the service)
- To give you a price quote and set up your account.
- To receive, consolidate, transport, track and deliver your packages across the border, and to keep a chain-of-custody record.
- To confirm deliveries — to capture and store the delivery photo, GPS location, recipient name and signature as proof of delivery, and to resolve the GPS coordinates to a street address for that record.
- To take payment for the service and to handle refunds, chargebacks and billing disputes.
- To communicate with you about your shipments and respond to your requests.
- To authenticate couriers and assign them deliveries.
- To secure our systems, prevent fraud and abuse, and comply with customs, tax, transportation and accounting recordkeeping obligations in Mexico and the United States.
3.2 Secondary purposes (not necessary for the service)
- To send you service updates or occasional information about BAJEX services.
You may refuse or withdraw consent for the secondary purpose at any time by writing to privacy@bajexx.com, with no effect on the service.
4. Legal basis and consent
We process the personal data needed for the primary purposes in section 3.1 because it is necessary to provide the service you or the sender asked us for — to give a quote, to carry and deliver a shipment, to prove delivery, to take payment — and to meet legal obligations (customs, tax, accounting). We do not rely on treating every visit or click as blanket consent to everything in this notice.
Two things are kept separate:
- Acknowledging this Privacy Notice means you have been told how BAJEX handles personal data. It is not, by itself, agreement to our Terms & Conditions.
- Accepting the Terms & Conditions is a separate step and is what forms the contract for a shipment.
Where the law does require consent for something specific — the secondary purpose in section 3.2, processing of financial data, or a data transfer that needs it — we ask for that consent at the relevant step, and you can decline or withdraw it without losing the service (except that we cannot process a payment you decline to authorize).
5. Who we share it with
We do not sell personal data. We share it only as needed to run the service:
| Recipient | Purpose | Data shared |
|---|---|---|
| Stripe (payment processor) | Process payments and refunds | Payment details you enter (card data goes directly to Stripe), the amount, and an order reference |
| Google (Geocoding API) | Convert a delivery photo's GPS coordinates into a street address for the proof-of-delivery record | The latitude/longitude only — no name or other identifier |
| Twilio (SMS) | Send couriers a one-time set-up / recovery code, and send a recipient a link to confirm a pre-authorized doorstep delivery | The destination phone number and the message text |
| Cloudflare | Website and API delivery, security, bot mitigation, cookieless analytics | IP address and request metadata |
| Cloud storage / hosting providers | Store delivery photos, signatures and operational data | The delivery-evidence and operational data in section 2 |
| The sender or recipient of a package | Confirm to the other party that a delivery was completed | The relevant delivery confirmation (photo, date, recipient name / signature) |
| Apple / Google | Only in their role as app-store operators, per their own policies | App diagnostic data per their platforms |
| Authorities / courts | Where required by law, or to establish, exercise or defend a legal claim | As legally required |
| A successor | If BAJEX is party to a merger, acquisition or sale of assets | As part of that transaction, subject to this policy |
Cross-border transfers
BAJEX operates on both sides of the Mexico–US border. Personal data needed to receive, clear and forward a package — for example the recipient's name and address, and package details — is processed at our California receiving point as well as in Mexico. Some service providers above (Stripe, Google, Cloudflare, Twilio) are US-based and process data in the United States and other countries. These transfers are made because they are necessary to perform the service you requested and, for Stripe, to complete a payment you initiated.
6. Cookies, analytics and similar technologies
The bajexx.com website does not use advertising, marketing or cross-site tracking cookies, and does not use Google Analytics, a Meta Pixel, or any similar tag. What is used:
- Strictly-necessary security cookies set by Cloudflare (for example
__cf_bm,cf_clearance) to tell human visitors from automated traffic and protect the site. Required for the site to work; not used to profile you. - Cloudflare Turnstile on the quote-request form — a privacy-focused CAPTCHA alternative that checks a submission is not automated. It does not use tracking cookies.
- Cloudflare Web Analytics — measures aggregate traffic (page views, referrers, country) without cookies and without identifying individual visitors.
Because none of this requires consent under applicable law, the site does not show a cookie-consent banner. If BAJEX later adds analytics or marketing technologies that use non-essential cookies, this section will be replaced with a full cookie notice and a consent banner. The mobile apps use on-device secure storage to keep you signed in and do not use advertising identifiers.
7. How long we keep it
We keep personal data only as long as needed for the purposes above and to meet legal recordkeeping requirements, then delete or anonymise it:
| Data | Retention |
|---|---|
| Delivery evidence — recipient signature and the watermarked delivery photo | 5 years from delivery (proof of delivery, customs and tax recordkeeping) |
| Raw (pre-watermark) delivery photo | 14 days from capture, then deleted — kept only long enough to re-generate the watermarked version if something goes wrong |
| Delivery metadata (recipient name, address, timestamp, GPS) in our shipment records | 5 years from delivery, aligned with the evidence above |
| Customer account and contact data | For as long as you have an account, then 5 years after the account is closed (commercial and tax recordkeeping), then deleted |
| Payment and billing records | 5 years (Mexican tax law) |
| Quote-request submissions that do not become an account | 12 months, then deleted |
| Courier account data | While the account is active, then 12 months after it is deactivated, then deleted |
| Website security logs (IP, request metadata) | No more than 30 days |
8. Your rights (ARCO)
Under Mexican data-protection law you have the right to Access your personal data, to request its Rectification when it is inaccurate or incomplete, to request its Cancellation when you believe it is not being handled lawfully, and to Oppose its use for a specific purpose. You may also withdraw consent you previously gave.
How to make a request
Send your request to privacy@bajexx.com with "Privacy / Datos Personales" in the subject line. Please include:
- your full name and an address, email, or phone number we can reply to;
- enough detail for us to find your data — for example the phone number or email you used with us, any tracking numbers, and roughly when;
- a clear description of what you are asking for (access, rectification, cancellation, opposition, or withdrawal of consent), and for a rectification, the correct information and — where reasonable — a document that supports it;
- a copy of an official photo ID (or an electronic equivalent) so we can confirm the request is really from you.
Someone acting for you
An authorised representative may submit a request on your behalf. We will need a written power of attorney or a signed authorisation from you, plus a copy of an official ID for both you and the representative.
How we respond
We will reply in writing, to the contact details in your request. Where we need more information to proceed, we will ask for it and the clock pauses until you provide it. If we grant a request, we will give it effect within the timeframe the law sets. If we decline it — in whole or in part — we will tell you why, and which specific data or which part of the request is affected.
Cancellation or opposition may not be possible where we are required to keep the data — for example delivery evidence within its legal retention period (section 7), or records needed to establish, exercise, or defend a legal claim; we will explain if that is the case, and it does not stop us acting on the rest of your request. If you are not satisfied with our response, you may file a complaint with the competent federal authority for the protection of personal data in Mexico.
9. Security
We use technical and organizational measures appropriate to the sensitivity of the data: encryption in transit, access controls and role-based permissions, hashing of authentication secrets (PINs and passwords are never stored in readable form), least-privilege access for staff and couriers, and separation of payment-card handling into our PCI-compliant processor. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the authorities as required by law.
10. Children
The service is not directed to children. We do not knowingly collect personal data from anyone under 18.
11. App-store disclosures
The data described here is also reflected in the privacy disclosures we provide to Apple (App Privacy labels) and Google (Data safety form) for the BAJEX Courier app. In summary, the Courier app collects a phone number (account), precise location (only at delivery-photo capture, never in the background), photos, and other user content (signature, recipient name); uses them only to complete and prove deliveries; does not use them for tracking or advertising; and does not share them except with the service providers listed in section 5.
12. Changes
We may update this policy. The "effective" date above will change and, for material changes, we will take reasonable steps to notify you.
Questions or requests: privacy@bajexx.com · +1 (619) 279-0648