fafalong · fafalong website and services
Privacy and personal data protection notice
This notice applies in two contexts: people who browse fafalong.com or contact fafalong through the website, and merchants who use the fafalong service, their staff, their customers, and buyers whose order data reaches fafalong from connected sales platforms. The Spanish version is the privacy notice legally operative in Mexico.
Updated September 22, 2026
Personal data controller
fafalong is operated by Longchang Information Technology Co., Ltd., an entity registered in China. The entity is responsible for the processing described in this notice where it acts as controller. The business contact location for privacy matters is Mexico City, Mexico, and the contact email is contact@fafalong.com.
Personal data we process
A. Website visitors When you visit the website or contact us voluntarily, we may process: Your name, contact details, company name, and the content of your inquiry. Browser and device type, access date, pages visited, approximate region, and basic technical security logs. Information needed to verify identity and respond to a personal data request. The website presents the product and supports inquiries. Account sign-in takes place in the separate fafalong application, which processes the information submitted during sign-in. The website inquiry form currently prepares text in your browser; a recipient receives it only when you choose to send it through a contact channel. B. The fafalong service When a merchant uses the fafalong service, we may process on the merchant's behalf: Merchant account and staff user data, including name, contact details, and role. Merchant customer records maintained by the merchant, which may include names, contact details, addresses, and outstanding credit balances. Tax profile information where a merchant's customer requests an invoice. Product catalogue, stock, and pricing data. Where a merchant connects a sales platform: buyer name, telephone number, delivery address, and order and settlement amounts.
Purposes of processing
Necessary purposes Personal data is used to deliver the service, authenticate accounts, manage orders and receivables on the merchant's behalf, prepare tax documents on the merchant's behalf, provide support, protect security and detect fraud, and meet legal obligations. Website visitor data is also used to respond to inquiries and arrange product demonstrations. Optional purposes There are currently no optional purposes. fafalong does not use personal data for product announcements or service-improvement research without separate consent. A person may refuse or withdraw consent to such optional processing at any time by writing to contact@fafalong.com, and refusal does not affect the service. We do not sell personal data, share it for advertising, or use it to train machine learning models.
Controller and processor roles
fafalong acts as controller for website visitor data and for merchant account and staff user data. fafalong acts as processor on behalf of the merchant for the merchant's own customer records and for buyer data received from a connected sales platform. In that role, fafalong processes data only on the merchant's documented instructions and not for its own purposes. A person whose data was provided by a merchant should direct requests to that merchant. If the person writes to fafalong instead, we forward the request to the merchant without undue delay.
Service providers and international transfer
Application hosting — United States Database, authentication, and file storage — United States Source code repository — United States Language model API used for spreadsheet column mapping and Spanish translation of product names — United States Data is stored and processed in the United States; data subjects are located in Mexico; administrative access originates from Mexico; and the operating entity is registered in China. This constitutes an international transfer. Personal data is not submitted to the language model provider, which processes product catalogue text only. When you open the WhatsApp contact link, subsequent communication takes place between you and fafalong through that service and is also subject to its own privacy rules. We do not disclose personal data to other controllers unless necessary to operate the website and service, respond to you, comply with the law, or protect legitimate rights.
Retention and deletion
Contact information is normally retained until 30 days after the related communication or business relationship ends, unless a legal obligation or dispute requires a longer period. On termination of a merchant relationship, all data collected for that merchant is deleted within 30 days. On request, an export is provided before deletion. Where a record must be kept to satisfy a legal obligation, it is kept for the minimum period required and the merchant is told.
Security measures
Encryption in transit and at rest. Tenant separation enforced at the database layer. Access to production systems restricted to authorised personnel with multi-factor authentication. Append-only audit records for sensitive operations.
Personal data breach notification
If a personal data breach occurs, fafalong notifies affected merchants within 72 hours of the incident being declared and notifies connected sales platforms in accordance with their agreements. Where required, supervisory authorities and affected individuals are also notified.
Your ARCO rights
You may request access to your personal data, correction of inaccurate information, deletion, or objection to specific processing. Email contact@fafalong.com and include your name, the right you wish to exercise, a description of your request, and information that helps us locate the relevant data. We will acknowledge the request and verify your identity when necessary. Under applicable Mexican requirements, we will respond within 20 days after receiving a complete request. If any information cannot be deleted, we will explain the relevant obligation and retention period. To withdraw consent or limit the use of personal data, email contact@fafalong.com. If you are not satisfied with the response, you may bring the matter before the Secretaría Anticorrupción y Buen Gobierno, the authority responsible for supervising personal data held by private parties under the Federal Law on the Protection of Personal Data Held by Private Parties in force since 21 March 2025.
Cookies
This website uses only cookies strictly necessary to provide the website and protect its security. It does not use analytics or other non-essential cookies.
Changes to this notice
We will update this page when website or service functions, information categories, service providers, or applicable requirements change. The new version and effective date will be shown here.
Contact
For questions about this notice or our processing of personal data, contact the fafalong privacy function: contact@fafalong.com