Privacy notice

Applicable to individuals who request information, enroll, take courses, complete assessments, or receive certifications through The White Box Project Institute, A.C.’s e-learning platform.

The White Box Project Institute, A.C. (“TWBPI”) protects the personal data of individuals participating in its training activities. This notice explains what data is processed, how it is used, with whom it may be shared, how long it is retained, and how the relevant rights may be exercised.

1. IDENTITY AND ADDRESS OF THE DATA CONTROLLER
   The White Box Project Institute, A.C. is responsible for processing personal data relating to enrollment, payment, delivery, assessment, and certification of its e-learning programs.
   • Address: Av. Isaac Newton 186, Office 205A, Polanco V Sección, Miguel Hidalgo borough, ZIP Code 11560, Mexico City, Mexico.
   • Privacy and rights contact: coordinacionadministrativa@whiteboxproject.institute.
   • Institutional website and current notice: https://wbpgroup.com.mx/ and, when available, https://wbpgroup.com.mx/aviso-de-privacidad/.
2. LEGAL FRAMEWORK AND SCOPE
   In Mexico, processing will comply with the current Federal Law on the Protection of Personal Data Held by Private Parties, its regulations, and applicable provisions. Where processing falls within the territorial scope of European law, Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spain’s Organic Law 3/2018 will also be observed.
   This notice applies to the website, contact and enrollment forms, virtual classroom, forums, messaging, payments, support, assessments, practical case, downloadable forms, issuance and verification of certificates, and related academic and administrative communications.
3. PERSONAL DATA THAT MAY BE PROCESSED
   • Identification and contact data: first and last names, date of birth, nationality, country of residence, address, email, telephone number, signature, profile photo, and identity document when necessary to verify identity.
   • Professional and academic data: job title, organization, sector, résumé, experience, education, certifications, diplomas, and documents proving participation or certification requirements.
   • Enrollment, contracting, and billing data: program, format, amount, promotions, tax details, payment receipts, transfer references, and administrative status.
   • Academic activity: logins, progress, study time, resources consulted, answers, attempts, grades, forum participation, practical case, submitted forms, feedback, and final result.
   • Certification data: information and evidence required to validate, register, issue, and verify certificates from NYCE, the World Compliance Association, or any other partner or associate.
   • Technical and security data: IP address, date and time, device, browser, operating system, session identifiers, logs, security events, and approximate location derived from the connection.
   • Communications and support: emails, messages, requests, clarifications, complaints, surveys, and evidence relating to incidents or academic integrity.
   • Image and voice: only when a person voluntarily participates in sessions, interviews, or testimonials. Promotional uses require specific authorization.
   As a general rule, TWBPI does not request sensitive data. If a person requests accessibility adjustments or support that reveals health information or another sensitive category, only strictly necessary information will be collected, with enhanced safeguards and the appropriate legal basis.
   Responsible use of case forms: Participants must avoid entering real personal data, trade secrets, or confidential information belonging to third parties. Fictional, anonymized, or expressly authorized data is recommended.
4. SOURCE OF THE DATA
   Data may be obtained directly from the data subject through forms, enrollment, activities, files, and communications; automatically through the platform, technical cookies, and server logs; or through a company, university, partner institution, or sponsor managing enrollment and having a valid legal basis for sharing the information.
5. PRIMARY AND NECESSARY PURPOSES
   • Responding to information requests and managing pre-contractual measures.
   • Creating and administering accounts, verifying identity, and protecting credentials.
   • Managing enrollment, payment, invoicing, scholarships, discounts, and administrative obligations.
   • Providing access to content, forums, resources, templates, assessments, support, and feedback.
   • Measuring progress, calculating results, addressing requests for clarification, and determining completion.
   • Preventing fraud, impersonation, plagiarism, credential misuse, and tampering with assessments.
   • Managing the practical case and forms used to complete it.
   • Validating, registering, issuing, and verifying relevant certificates with NYCE and WCA.
   • Handling data-subject rights, inquiries, complaints, cancellations, and refunds.
   • Complying with legal, tax, contractual, and evidence-retention obligations, and bringing or defending claims.
   • Maintaining service security, availability, backups, continuity, and technical improvement.
6. SECONDARY OR OPTIONAL PURPOSES
   TWBPI may request separate consent to:
   • Send information about new courses, events, publications, discounts, and institutional activities.
   • Use a person’s name, image, voice, testimonial, job title, or individualized results for promotional or informational purposes.
   • Invite participants to surveys, professional communities, or activities unrelated to the contracted service.
   Refusing or withdrawing consent for these purposes will not affect course access or the possibility of certification. Academic, administrative, and security messages are not optional commercial communications.
7. LEGAL BASES FOR PROCESSING
   In Mexico, processing is based on consent where necessary, the legal relationship arising from enrollment, and the exceptions and obligations established by applicable law.
   Where the GDPR applies, legal bases may include taking pre-contractual steps at the data subject’s request or performing a contract; complying with legal obligations; legitimate interests in protecting the platform, preventing fraud, responding to requests, and improving the service; and consent for commercial communications, images, testimonials, non-essential cookies, or other optional uses.
8. REQUIRED DATA AND CONSEQUENCES OF NOT PROVIDING IT
   Fields identified as mandatory are necessary to register a person, provide the service, assess performance, or manage certificates. Failure to provide essential information may prevent enrollment, access, assessments, invoicing, or certificate issuance. Optional data will be identified as such.
9. AUTOMATED ASSESSMENTS AND HUMAN REVIEW
   The platform may automatically calculate progress percentages, quiz results, and grades according to predefined rules. These operations support academic administration. In the event of an incident, a reasonable challenge, or a decision with significant effects, the person may request human review.
   Facial recognition, biometric data, or invasive remote-proctoring systems are not currently intended to be used. If introduced in the future, TWBPI will provide prior information about their purpose, necessity, general operation, legal basis, retention period, and challenge mechanism.
10. RECIPIENTS, PROCESSORS, AND DATA DISCLOSURES
    TWBPI will limit access to people and entities that need it to provide the service or comply with obligations. The following may be involved:
    • Authorized academic and administrative staff, assessors, and support personnel.
    • Providers of Moodle, hosting, storage, backups, security, email, videoconferencing, analytics, payments, and technical support.
    • NYCE, to validate, register, issue, or verify the relevant certificate.
    • World Compliance Association, to assess requirements and issue, register, renew, or verify its professional certification.
    • Sponsoring companies, universities, or institutions that funded enrollment, only regarding information agreed upon and permitted by law.
    • Advisors, auditors, and authorities where legally required, upon a duly supported request, or to protect rights.
    Providers acting as processors will handle information under documented instructions, confidentiality obligations, and security measures. TWBPI will not sell personal data or make it available to advertisers for behavioral advertising unrelated to the service.
11. INTERNATIONAL TRANSFERS
    Given the international scope of the training, use of technology services, and involvement of certification bodies, some data may be stored in or accessible from Mexico, Spain, other European Economic Area countries, or third countries.
    Transfers will comply with applicable law and, where required, use adequacy decisions, standard contractual clauses, transfer agreements, supplementary measures, or other recognized mechanisms. Information about relevant providers and destinations will be kept up to date and may be requested from the privacy contact.
12. RETENTION PERIODS
    • Account and enrollment: while the training relationship exists and for the period needed to address obligations and claims.
    • Assessments and practical case: as needed to substantiate results, resolve reviews, and demonstrate process integrity.
    • Certificates and verification: while certificates may need validation and for periods required by NYCE, WCA, or applicable law.
    • Tax and payment data: for applicable tax, accounting, and contractual retention periods.
    • Security logs: for the time reasonably needed to prevent fraud, investigate incidents, and protect the platform.
    • Commercial communications: until consent is withdrawn or an objection is made, retaining minimal evidence of the opt-out request.
    When these periods end, data will be deleted, anonymized, or blocked as appropriate. TWBPI may retain aggregated statistics that do not identify any individual.
13. DATA SUBJECT RIGHTS
    Data subjects may exercise rights of access, rectification, cancellation, objection and, where applicable, erasure, restriction, portability, withdrawal of consent, and objection to decisions based solely on automated processing.
    Requests must be sent to coordinacionadministrativa@whiteboxproject.institute and include the person’s name, a means of receiving a response, proof of identity or representation, a clear description of the right and data involved, and information that helps locate the data. TWBPI will respond within statutory deadlines. Where the GDPR applies, responses will generally be provided within one month, subject to permitted extensions due to complexity.
    In Mexico, the person may contact the competent personal-data protection authority. In Spain or the European Economic Area, a complaint may be filed with the Spanish Data Protection Agency or the supervisory authority where the person resides, works, or where the alleged infringement occurred.
14. WITHDRAWAL, RESTRICTION, AND PREFERENCES
    Consent may be withdrawn without retroactive effect. Withdrawal or erasure may not be available where processing is necessary to provide the service, comply with law, retain evidence, verify certificates, or address outstanding liabilities. Commercial communications will include an unsubscribe mechanism.
15. COOKIES AND SIMILAR TECHNOLOGIES
    The platform will use technical cookies to authenticate users, maintain sessions, retain essential preferences, and protect the virtual classroom. Analytics, advertising, or other non-essential cookies will be used only with consent where required by law. The cookie panel will allow users to accept, reject, or configure optional categories.
16. SECURITY AND DATA BREACHES
    TWBPI will adopt reasonable administrative, technical, and physical measures, including access controls, protected passwords, backups, logs, updates, role-based restrictions, and confidentiality agreements. No system is completely invulnerable; users must also protect their credentials and report incidents.
    Where a breach may significantly affect individuals’ rights, TWBPI will make the notifications and take the containment measures required by applicable law.
17. MINORS, AMENDMENTS, AND CONTACT
    The programs are intended for persons over eighteen years of age. TWBPI does not intend to knowingly collect data from minors. If it detects such a registration, it will restrict processing and take appropriate measures.
    This notice may be updated due to legal, technical, academic, or administrative changes. The current version will be published on the website or platform. Substantial changes will be communicated through an appropriate channel and, where necessary, consent will be requested again.
    Inquiries and requests: coordinacionadministrativa@whiteboxproject.institute. Address: Av. Isaac Newton 186, Office 205A, Polanco V Sección, Miguel Hidalgo borough, ZIP Code 11560, Mexico City, Mexico.

Mexico City, July 28, 2026