Privacy Policy

Last updated: 3 October 2026 · Version 2.3. This is a courtesy translation of the Spanish-language policy; in case of discrepancy, the Spanish version prevails.

1. Data controller

The data controller, that is, the party that decides on the purposes and means of the processing, is SmartLaw, a commercial enterprise (empresa mercantil) held in co-ownership, with address for these purposes at Edificio QUO, Torre Q, Nivel 3, Oficina 308, Vía 7, 4-20, Zona 4, Guatemala City.

For any matter relating to this policy or to the processing of your data, contact privacidad@smartlaw.gt or, failing that, contacto@smartlaw.gt and +502 5834-4922.

2. Applicable legal framework

As of the date of this policy, Guatemala has no general personal data protection statute. The Firm’s processing is governed by:

• articles 24 and 31 of the Constitution of the Republic of Guatemala, which recognise the inviolability of correspondence and private documents and every person’s right to know the information held about them in files and registries and to have it corrected, rectified and updated;
• the principles of lawfulness, consent, purpose limitation and data quality set out in the Access to Public Information Act (Decree 57-2008 of the Congress of the Republic), in particular its articles 9, 21 and 30 to 32, which the Firm adopts as a guiding standard even though it is not an obligated entity under that Act;
• the right to personal and family privacy and to one’s own image recognised in the Civil Code (Decree-Law 106);
• the anti-money-laundering and counter-terrorist-financing legislation in force, Decree 15-2026 of the Congress of the Republic, to the extent the Firm carries out operations that make it an obligated person;
• the Consumer and User Protection Act (Ley de Protección al Consumidor y Usuario), Decree 006-2003 of the Congress of the Republic, with respect to SmartLaw. Library purchases; and
• where applicable by reason of the data subject’s residence, Regulation (EU) 2016/679 (General Data Protection Regulation, «GDPR») and other foreign data protection legislation.

3. Definitions

• Personal data: any information relating to an identified or identifiable natural person.
• Sensitive data: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health data, genetic or biometric data, and data concerning sexual life or orientation. The Firm does not request or process sensitive data through the Site.
• Data subject: the natural person to whom the data relates.
• Processing: any operation performed on personal data, such as collection, recording, storage, use, disclosure, blocking or erasure.
• Processor: a third party that processes personal data on the Firm’s behalf and on its instructions.

4. Categories of data, source and nature of provision

• Identification and contact data (name, email address, telephone number and, where applicable, the entity you represent): provided by you directly when completing the contact form. Required to handle your enquiry; without it the Firm cannot respond.
• Content of the enquiry (the area of interest selected and the message you write): provided by you directly. We recommend that you do not include confidential or sensitive information in that message (see section 11).
• Browsing and device data (pages visited, visit duration, traffic source, device and browser type, approximate country): collected by Google Analytics through cookies, only if you accept the cookie notice, and in aggregated form. Google Analytics 4 does not record or store the visitor’s full IP address.
• Browsing data for advertising purposes (Site pages you visit, actions such as requesting a guide, submitting the contact form or starting and completing a kit purchase, with the kit name and price, and cookie and browser identifiers): collected by the Meta pixel, only if you accept the cookie notice. The Firm does not send your name, email address or phone number to Meta.
• SmartLaw. Library data (name, email address and the professional profile you select): provided by you directly when requesting a guide or subscribing to notices of new materials. Required to deliver the material and send those notices.
• Purchase data (name, email address, telephone, tax ID (NIT), receipt number, kit purchased, amount, link to the electronic invoice and number of downloads made): you enter it in the Recurrente checkout form, which passes it to the Firm once payment is confirmed. Required to deliver the kit and issue the invoice. Your card or bank account details are processed exclusively by Recurrente; the Firm does not receive or store them.
• Technical security data (IP address and request metadata): processed transiently by the hosting provider and the form provider, for security and message-delivery purposes. When you download a kit, the Site also records the number of downloads made with the link, to enforce the download limit.

The only mandatory provision is that of the fields marked as required in each form. The rest is optional and its omission does not prevent use of the Site.

5. Purposes and legal bases

The Firm does not use your data for automated decision-making producing legal effects on you, nor does it build individual profiles for commercial purposes. If you accept cookies, Meta may include your browser in aggregated audiences to show you the Firm’s ads, without the Firm knowing your identity.

6. Disclosure to processors and third parties

The Firm does not sell, rent or disclose your personal data for commercial purposes. Your data is shared only with the providers that make the operation of the Site possible, acting on the Firm’s behalf under documented instructions and bound by confidentiality and security obligations. As of the date of this policy, these providers are:

• Formspree (Formspree, Inc., United States): processing and delivery of contact form submissions.
• Netlify (Netlify, Inc., United States): hosting and delivery of the Site, running the kit delivery functions and storing the purchase records.
• Recurrente (payment platform operating in Guatemala): processing kit payments and issuing the electronic invoice. Recurrente processes payment data as an independent controller under its own terms and privacy policy, and passes to the Firm the purchase data described in section 4.
• Resend (Resend, Inc., United States): sending kit delivery emails.
• Google Analytics (Google LLC, United States): aggregated statistical measurement of Site use, only if you accept cookies.
• Meta (Meta Platforms, Inc., United States): measurement of the Firm’s ads and creation of advertising audiences through the Meta pixel, only if you accept cookies. Meta also processes that data under its own privacy policy, available at facebook.com/privacy/policy.
• Google Workspace (Google LLC, United States): receipt and management of the Firm’s corporate email and accounting record of Library sales in a restricted-access spreadsheet.

The Firm may also disclose data to judicial or administrative authorities where there is a legally founded request.

7. International transfers

The providers listed in section 6, except Recurrente (Formspree, Netlify, Resend, Google and Meta), are located in the United States. Sending your data to those providers constitutes an international transfer. The Firm requires those providers to give contractual confidentiality and security commitments equivalent to those in this policy and limits the transfer to what is strictly necessary for the purposes described. If you reside in the European Economic Area, those transfers rely on the European Commission’s standard contractual clauses and other mechanisms provided for in Chapter V of the GDPR.

8. Cookies and local storage

A cookie is a small file that a site stores in your browser to recognise it on later visits. The Site uses the following:

On your first visit, the Site shows a cookie notice. Google Analytics and the Meta pixel are not loaded and set no analytics or advertising cookie until you click «Accept». If you click «Reject», the Site works normally and no measurement takes place. You may withdraw your consent at any time by clearing the Site’s data in your browser; you may also install the Google Analytics opt-out add-on at tools.google.com/dlpage/gaoptout. The ads Meta shows you can also be managed from the ad settings of your Facebook or Instagram account.

The form also includes a hidden bot-detection field («honeypot»); if completed, the submission is discarded. That mechanism does not collect data about people.

The Firm has configured the Google Analytics 4 property without «Google Signals» and without a Google Ads link, so that the data is not used for advertising purposes.

When you pay for a kit, you move to the Recurrente checkout form, which may use its own cookies under its policy. The download link you receive by email sets no cookies.

9. Retention periods

• Enquiries that do not lead to a professional relationship: data is kept for 24 (twenty-four) months from the last contact, then erased or anonymised.
• Library data: kept while you remain subscribed. If you unsubscribe, it is erased within 30 (thirty) days, unless you are a client or have made an enquiry, in which case the corresponding period in this section applies.
• Enquiries that lead to an engagement: data is added to the client file and kept for the duration of the professional relationship and, after it ends, for the limitation periods of any actions that may arise from it and those imposed by accounting and tax obligations.
• Purchase data: kept for the periods required by tax and commercial law for accounting records and sales receipts and, in any case, while claims may arise from the purchase. If you object to receiving notices about related materials, the Firm stops using your email for that purpose, although it keeps the purchase record.
• Data subject to anti-money-laundering rules: where applicable, kept for the record-retention period required by Decree 15-2026 of the Congress of the Republic, or the longer period required by the applicable rules.
• Google Analytics data: kept in aggregated form for the period configured in the account, not exceeding 14 months, and in browser cookies as set out in section 8.
• Meta pixel data: the Firm’s advertising audiences are configured with a maximum duration of 180 days; Meta keeps event data under its own policy.
• Technical and security logs: kept for as long as necessary for the security purpose and, at most, twelve months, unless they must be kept longer to investigate an incident.

10. Security measures

The Firm applies reasonable technical and organisational measures to protect data against loss, unauthorised access, alteration and improper disclosure, including: encrypted transmission of the Site (HTTPS), need-to-know access control, and selection of providers that demonstrate security standards. No measure eliminates risk entirely; the Firm cannot guarantee the absolute security of information transmitted over the internet.

11. Professional secrecy and absence of a professional relationship

Submitting the contact form does not create an attorney-client relationship and does not oblige the Firm to accept the engagement. A professional relationship arises only upon the Firm’s express written acceptance, following a conflicts-of-interest check.

Accordingly, information you include in the form before that relationship exists is not covered by professional secrecy and may not be protected against third parties. We recommend that you limit your message to a general description of the matter and reserve confidential details for a later communication, once the relationship is formalised. Where it exists, the data will be protected by the professional secrecy governing the legal and notarial profession in Guatemala.

12. Data subject rights

You have the right to ask the Firm for:

• access: to know what data of yours the Firm processes and for what purpose;
• rectification and updating: to correct inaccurate or incomplete data;
• erasure: to delete data when it is no longer necessary or when you withdraw consent, subject to the retention periods in section 9;
• objection: to object to processing based on the Firm’s legitimate interest, on grounds relating to your particular situation, and in any case, without giving reasons, to receiving notices about Library materials; and
• to withdraw consent at any time, without affecting the lawfulness of prior processing. To stop receiving Library notices, whether as a subscriber or as a buyer, reply to any of those emails or write to privacidad@smartlaw.gt.

To exercise them, write to privacidad@smartlaw.gt stating the right you are exercising and attaching a document evidencing your identity. The Firm will respond within 10 (ten) business days of receiving the complete request. If a request is manifestly unfounded or excessive, the Firm may refuse it with reasons.

13. Minors

The Site is aimed at professionals and businesses. The Firm does not knowingly collect data from minors through the Site. If you become aware that a minor has provided data, write to privacidad@smartlaw.gt for its erasure.

14. Links to third-party sites

The Site may contain links to sites operated by third parties, for example the Firm’s social media or the map service. This policy does not cover the processing carried out by those third parties; we recommend that you review their respective policies.

15. Changes

The Firm may amend this policy to reflect regulatory or operational changes. The version in force is always the one published on this page, with its date and version number at the top. Material changes will be announced prominently on the Site with reasonable advance notice.

16. Supervisory authority and complaints

If you consider that the processing of your data infringes applicable law, you may raise your complaint directly with the Firm at the address in section 1. In Guatemala, in the absence of a specialised data protection authority, the data subject may turn to the competent courts and, where appropriate, bring the constitutional «amparo» action. If your complaint concerns a purchase and you are a consumer or user, you may also turn to the Consumer Assistance Directorate (Dirección de Atención y Asistencia al Consumidor, DIACO) of the Ministry of Economy, under the Consumer and User Protection Act, Decree 006-2003 of the Congress of the Republic. If you reside in the European Union, you may complain to the supervisory authority of your country.

17. Governing law and arbitration

This policy is governed by and construed in accordance with the laws of the Republic of Guatemala.

Any dispute, difference or claim arising out of or in connection with this policy, including any question regarding its existence, validity or termination, shall be finally settled by arbitration administered by the Conflict Resolution Commission of the Chamber of Industry of Guatemala (Comisión de Resolución de Conflictos de la Cámara de Industria de Guatemala, CRECIG), under its Arbitration Rules in force at the time the request is filed, which the parties declare that they know and accept. The arbitral tribunal shall consist of one (1) sole arbitrator; the seat of the arbitration shall be Guatemala City; the language of the proceedings shall be Spanish; the arbitration shall be at law; and the award shall be final, binding and not subject to appeal.

The foregoing is without prejudice to the non-waivable rights granted by the Consumer and User Protection Act, Decree 006-2003 of the Congress of the Republic, and to any mandatory consumer-protection or data-protection rules applicable by reason of the data subject’s residence that may grant the data subject the right to turn to DIACO or to bring proceedings before the courts of their domicile. Disputes arising from a purchase are governed by the Terms and Conditions (in Spanish).

18. Contact

For questions about this policy or about the processing of your data: privacidad@smartlaw.gt · +502 5834-4922 · Edificio QUO, Torre Q, Nivel 3, Oficina 308, Zona 4, Guatemala City.