Privacy Notice

Last updated: October 25, 2026

Privacy Notice

This is a translation for reference. In case of any discrepancy, the Spanish version prevails.

1. Identity and Address of the Controller

COVA Consulting S.C. (“COVA”), located at Blvd. Francisco L. Montejano #1280, Int. 203, 2.º piso, Torres del Sol (Torre Norte), Col. Fovissste, C.P. 21038, Mexicali, Baja California, México, is responsible for processing your personal data under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”).

Sales of COVA SEALS security seals are invoiced by Magdalena Sofía Villarreal Vega, located at Arcos de Chapultepec No. 1280, Col. Los Arcos, Mexicali, Baja California, Mexico, who is responsible for the contact and billing data of seal customers and processes it under this same privacy notice. Requests regarding that data may be sent to the email address in section 5.

2. Personal Data We Process

  • Identification and contact: name, position, company, email, phone or WhatsApp, and company address.
  • Employment and professional data of our clients’ personnel and their business partners, needed to provide our services: name, position, department, signature, training records, and participation in audits, interviews and effectiveness tests.
  • Online training assessments: answers, scores, number of attempts, date and time, the IP address from which the assessment is submitted and, when you choose to provide it, a photo taken when you start the assessment as evidence that you were the one who took it. The photo is not used for facial recognition or any other biometric processing.
  • Billing data: tax ID (RFC), company name and tax address.

COVA does not request sensitive personal data. If a service ever requires it, we will first obtain your express written consent.

3. Purposes of Processing

Primary purposes, necessary for our relationship with you:

  • Providing consulting, training, audit and verification services, including the CTPAT, OEA and Parque Industrial Seguro programs.
  • Issuing training certificates and allowing third parties to verify their authenticity and validity at gcova.com.mx/verificar.
  • Administering and grading online training assessments and providing the company that hired the training with a report of its participants’ results.
  • Preparing proposals, contracts, invoicing and collections.
  • Responding to information requests, appointments and communications.
  • Compiling the files and evidence required by certification programs and authorities.
  • Complying with applicable legal obligations.

Secondary purposes, not necessary for our relationship with you:

  • Sending newsletters and news on international trade and supply chain security.
  • Inviting you to events and training sessions.

If you do not want your data used for secondary purposes, you may say so at any time by replying to our newsletters with the word UNSUBSCRIBE or by writing to acorona@gcova.com.mx. Your refusal will not affect the services we provide to you.

4. Transfers and Processors

Your data may be transferred, in the cases permitted by the Law, to:

  • Competent authorities in Mexico and abroad (for example, SAT, Mexico’s National Customs Agency or U.S. Customs and Border Protection), when necessary for certification procedures you request from us or when legally required.
  • The Mexican Association of Private Industrial Parks (AMPIP), for verification of the Parque Industrial Seguro program requested by the park.
  • The company that hired the training, which receives, for its own participants, their name, employee number, position, scores, attempts and, where provided, the evidence photo, as part of the contracted service.

Certificate verification. Anyone who has a certificate number and its verification code (printed on the certificate, next to its QR code) can look up, at gcova.com.mx/verificar, the participant’s name, company, program, issue date, validity and instructor. No other data is shown and participant lists cannot be browsed: each record is encrypted and opens only with its own number and code. This lets employers, auditors and authorities confirm that a certificate is genuine.

Retention. COVA keeps training records, including assessments and evidence photos, and certificate verification data for five years from each certificate’s issue date. After that period they are removed from the verification page and deleted from our records, unless a legal obligation requires keeping them longer.

COVA also relies on web hosting, email, cloud storage, web analytics (Google Analytics) and accounting providers, which process personal data solely on COVA’s behalf and under confidentiality obligations.

5. ARCO Rights and Withdrawal of Consent

You may access, rectify, cancel or object to the processing of your personal data (ARCO rights), as well as withdraw your consent or limit the use of your data. To do so, send your request to acorona@gcova.com.mx including:

  • Your name and a means to receive the response.
  • A document proving your identity or, where applicable, legal representation.
  • A clear description of the data and the right you wish to exercise.
  • Any other information that helps locate your data.

COVA will respond to your request within the time limits set by the Law.

If you request cancellation of a certificate’s data, we will remove its record from the verification page and, from then on, the certificate can no longer be verified online. COVA may keep the internal record, blocked, only for as long as the law requires.

6. Cookies and Tracking Technologies

This site uses two statistics tools. The first is our own, hosted on our server and cookie-free: it records the page visited, the referring site, the device type, the browser language and clicks on the contact, WhatsApp and certificate verification links; it does not store IP addresses or browser identifiers, is not shared with third parties and is kept for 24 months. The second is Google Analytics, by Google LLC, which is only turned on if you accept it in the cookie notice: it sets cookies to measure visits statistically (pages viewed, visit length, device type, approximate location and referring site). COVA does not use this information to identify you or for advertising, and if you decline cookies the site works the same. You can change your choice at any time: change cookie preferences. It uses Google Fonts to display typefaces, a third-party service that may log technical data such as your IP address. Links to WhatsApp, Facebook, X and LinkedIn are governed by those platforms’ privacy policies.

The assessment page (gcova.com.mx/examen) temporarily stores your details and answers for the day in your phone’s browser, so you can continue if the session is interrupted; this information is not sent to third parties and you can delete it from your browser settings. The visit statistics described above do not include IP addresses; the IP address recorded when an assessment is submitted is handled as described in section 2.

7. Changes to This Notice

Any change to this privacy notice will be published on this page with the date of the last update.

8. Authority

If you believe your right to personal data protection has been violated, you may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno, the competent authority.