COMPREHENSIVE PRIVACY NOTICE

Last update: September 6, 2026

In compliance with applicable Mexican legislation regarding the protection of personal data, LE Amaya, responsible for the processing of personal data used in relation to Legatto®, makes this Privacy Notice available to users.

1. DATA CONTROLLER

View details of the Responsible Party and Owner
▼

Responsible: LE Amaya

Trade name: Legatto Institute®

Representative / holder: LE Amaya

Home: Akumal, Quintana Roo, Mexico.

Email for privacy: contact@mayansolutions.com

The responsible party will process personal data in accordance with applicable Mexican legislation and with the principles of lawfulness, purpose, loyalty, consent, information, proportionality, quality and accountability.

2. WHAT PERSONAL DATA CAN WE COLLECT?

Depending on the interaction with Legatto®, we may only collect the data necessary to provide the requested experience, service, or functionality.

Identification data

  • name;
  • stage name;
  • age or age range, when necessary;
  • country or city;
  • information needed to identify a registration or participation.

Contact information

  • email;
  • telephone number;
  • WhatsApp;
  • other means of contact provided voluntarily.

Data related to educational experiences and assessments

  • musical experience;
  • instrument;
  • musical level;
  • musical interests;
  • learning objectives;
  • educational preferences;
  • answers provided in forms, assessments and tests;
  • results generated by the tests;
  • Information provided voluntarily during a Legatto class, course, mentoring, or experience.

Responses to assessments, tests, and musical exploration tools will only be used to the extent necessary to provide the requested experience, generate results, create or maintain the corresponding profile, and improve Legatto's services.

Transaction data

We may process information related to:

  • contracted service;
  • date;
  • amount;
  • payment status;
  • receipts;
  • transaction identifiers.

Full bank card details may be processed directly by the corresponding payment platform and will not necessarily be stored by Legatto.

Technical data

We may receive or generate technical information such as:

  • IP address;
  • type of device;
  • browser;
  • operating system;
  • pages visited;
  • date and time of access;
  • interaction information;
  • cookies;
  • local storage;
  • technical identifiers.

Information security

Legatto implements reasonable and proportionate administrative, technical and physical measures, in accordance with the nature of the data processed, to protect information against unauthorized access, use, alteration, loss, destruction or disclosure.

Where applicable, encryption mechanisms and secure protocols are used to protect the transmission and processing of information.

Legatto seeks to limit the collection of information to the data necessary for the purposes described in this Privacy Notice and to avoid the unnecessary collection of sensitive personal data.

3. LEGATTO TESTS

The tests can generate information related to:

  • musical level;
  • auditory perception;
  • musical responses;
  • preferences;
  • learning style or profile;
  • artistic identity;
  • results and categories generated by the system.

These results are primarily used to provide the requested expertise, generate results, and improve services.

The test results They do not constitute medical, psychological, or psychiatric diagnoses, nor official professional evaluations.

Where technically possible, certain results may be stored locally in the user's browser.

If a test requests name, email address or other identifiable data, this will be processed in accordance with the purposes described in this Notice.

4. PRIMARY PURPOSES

Personal data collected through Legatto® will be processed solely for the purposes necessary to provide and manage the experiences and services requested by the user.

These purposes include:

  1. create, manage and maintain the participant's profile when the corresponding functionality requires it;
  2. to process the responses and results of tests, assessments and musical exploration instruments;
  3. send the participant the results of their assessments or tests when appropriate;
  4. to attend to and manage requests for information about Legatto, its courses, classes, experiences, mentoring and other services;
  5. manage registrations, reservations and participation in courses, classes, mentoring and experiences;
  6. provide the contracted services;
  7. manage payments, receipts and records related to a contract;
  8. send information necessary for the provision of a requested service;
  9. provide support and answer inquiries;
  10. to maintain the security, operation and continuity of Legatto's digital platforms and tools;
  11. to prevent fraud, abuse, unauthorized access or misuse;
  12. to fulfill legal, tax, administrative or contractual obligations where applicable; and
  13. to exercise or defend rights when necessary.

Legatto will not use the answers from tests, assessments or musical exploration instruments for purposes other than those described here, unless there is a legal basis that allows it or the corresponding consent is obtained.

The processing of personal data for promotional communications or marketing is considered a separate purpose and will be subject to the consent and objection options provided in this Privacy Notice.

5. SECONDARY PURPOSES

Where appropriate and subject to available legal options, we may use contact details to:

  • send updates;
  • share Legatto content;
  • provide information about courses;
  • communicate new experiences;
  • send invitations;
  • to carry out promotional communications;
  • conduct surveys;
  • request feedback.

These purposes are secondary and the data subject may object to or limit the use of their data for these purposes through the mechanism indicated in this Notice.

Refusal to consent to these purposes should not affect the provision of contracted services when the data is necessary for a primary purpose.

6. SENSITIVE PERSONAL DATA

Legatto strives to avoid requesting sensitive personal data that is not necessary for its activities. Sensitive information should not be voluntarily provided through forms, tests, comments, or communications when it is not required.

See details on the processing of Sensitive Personal Data
▼

In the event that an activity legitimately requires the processing of sensitive personal data, Legatto will request the corresponding consent in accordance with applicable legislation.

Sensitive data may include, among other things, information related to:

  • Health status or physical/hearing assessments.
  • Genetic information.
  • Religious, philosophical, or moral beliefs.
  • Political opinions.
  • Racial or ethnic origin.
  • Sexual preference (according to the applicable legal definition).

All this information is protected under strict confidentiality standards and digital encryption.

7. CONSENT

The processing of personal data will be carried out based on the consent of the data subject when necessary and under the exceptions provided for by applicable legislation.

Consent may be given through electronic means or other legally valid mechanisms.

When the law requires express consent, Legatto will implement the corresponding mechanism.

The data subject may revoke their consent under the terms established by applicable law and this Notice.

The revocation will not have retroactive effects and may not be possible when the processing is necessary to comply with legal or contractual obligations.

8. USE OF DATA FOR PROVISION OF SERVICES

To provide the services correctly, Legatto may use technology providers acting on behalf of the controller.

These providers may include categories such as:

  • web hosting;
  • mail providers;
  • form platforms;
  • payment platforms;
  • videoconference;
  • storage;
  • analytics tools;
  • security systems;
  • messaging;
  • automation;
  • educational platforms.

These providers may process information only to the extent necessary to provide their services and will be subject to their own terms and privacy policies where applicable.

9. TRANSFERS

Legatto may transfer or communicate data when necessary to:

  • perform a requested service;
  • to process a payment;
  • provide access to a platform;
  • organize a session;
  • fulfill legal obligations;
  • attend to authority requirements;
  • to protect legitimate rights or interests;
  • to prevent fraud or security incidents.

When a transfer requires consent under applicable law, such consent will be requested.

10. INTERNATIONAL SUPPLIERS

Some technology providers used by Legatto may be located outside of Mexico.

Consequently, certain data may be processed or stored outside of Mexican territory.

The use of these services will be carried out in accordance with the applicable legal conditions and taking reasonable measures to protect the information.

11. COOKIES AND SIMILAR TECHNOLOGIES

Legatto may use cookies, local storage, pixels, technical identifiers, or other similar technologies.

These technologies can be used for:

  • site operation;
  • security;
  • remember preferences;
  • remember progress;
  • analyze utilization;
  • improve the experience;
  • measure campaigns when appropriate.

Some technologies may be provided by third parties.

Users can manage certain cookies through their browser settings, although disabling them may affect some site functionalities.

12. TESTS AND LOCAL STORAGE

Some test experiences may store information directly in the browser using technologies such as localStorage or other equivalent technologies.

This allows Legatto to recognize certain information within the same browser to facilitate a seamless experience.

Deleting browser data, using a different device or browser, activating certain privacy mechanisms, or blocking storage may eliminate or prevent such continuity.

13. SECURITY

Legatto will implement reasonable administrative, technical, and physical measures to protect personal data against:

  • damage;
  • loss;
  • disturbance;
  • destruction;
  • unauthorized access;
  • unauthorized treatment;
  • improper disclosure.

However, no electronic transmission or storage can guarantee absolute security.

In the event of a legally required violation, Legatto will take appropriate action in accordance with applicable law.

14. RETENTION OF PERSONAL DATA

Legatto will retain personal data only for as long as necessary to fulfill the purposes for which it was collected and subsequently for the periods necessary to comply with legal, tax, administrative, contractual obligations or to exercise or defend rights.

As a default operating period, records associated with participant profiles, tests, assessments, forms, and information requests may be retained for up to 730 days counted from the last recorded interaction with Legatto, unless there is a legitimate legal, contractual, administrative or technical reason to retain them for a different period.

Once the applicable period has elapsed, Legatto will endeavor to delete, anonymize, block or dissociate personal data, as appropriate and in accordance with the nature of the record and applicable legal obligations.

Data necessary to retain payment receipts, tax records, compliance with legal obligations, handling of claims or exercise and defense of rights may be retained for the additional period that is legally necessary.

When certain data is stored locally in the user's browser using cookies, local storage or other similar technologies, its permanence may also depend on the configuration and operation of the device and browser used.

15. ARCO RIGHTS AND DATA MANAGEMENT

The data subject may exercise, in accordance with applicable law, their rights to:

Access: to know what personal data Legatto holds and what it is used for.

Rectification: request the correction of inaccurate, incomplete or outdated personal data.

Cancellation: request the deletion of your personal data when legally appropriate.

Opposition: to object to the processing of your personal data in the cases provided for by applicable law.

Likewise, the holder may request the deletion or removal of personal data associated with your profile or participation on Legatto platforms, subject to any applicable legal, tax, contractual or conservation obligations.

When Legatto's technological infrastructure allows, requests related to data deletion or management may be handled through the native data management tools available in WordPress and/or through the mechanisms implemented by the forms, plugins or platforms used by Legatto.

The removal of information from a given system does not necessarily imply its immediate removal from third-party systems that have legitimately processed said information to provide a service, such as payment platforms, email, hosting, storage, or technological tools.

Where appropriate, Legatto will handle requests for deletion, rectification or objection also with the suppliers that need to be contacted to comply with the request and with applicable law.

16. PROCEDURE TO EXERCISE ARCO RIGHTS OR REQUEST ERASURE

The applicant may submit their application by:

Privacy email: info@amayahunab.com

The application must contain, at a minimum:

  1. name of the holder;
  2. means to receive a response;
  3. clear description of the right you wish to exercise;
  4. description of the personal data involved;
  5. any element that facilitates the location of said data;
  6. documentation required to prove identity or representation where applicable.

For deletion requests, the data subject may expressly indicate:

“I request the deletion of my personal data from Legatto’s systems, to the extent permitted by applicable law.”

Legatto may request additional information when necessary to verify the identity of the applicant or to correctly locate the data.

Applications will be processed within the timeframes established by applicable legislation.

Deletion may be limited when certain data must be retained due to legal, tax, contractual, administrative, security obligations or for the exercise or defense of rights.

The deletion of data will not have retroactive effects on processing carried out legitimately before the request.

17. REVOCATION OF CONSENT

The data subject may request the revocation of their consent by:

Mail: info@amayahunab.com

The application must state:

  • name;
  • contact email;
  • treatment for which you wish to revoke consent;
  • sufficient information to identify the corresponding data.

The revocation will not have retroactive effects and may not be applicable when there is a legal or contractual obligation or legitimate reason that allows the treatment to continue.

18. LIMITATION OF USE OR DISCLOSURE

The data subject may request to limit the use or disclosure of their data for certain purposes.

To stop receiving promotional communications, you can unsubscribe by:

Mail: info@amayahunab.com

Canceling commercial communications will not necessarily prevent the sending of communications strictly necessary to manage contracted services, payments, security, important changes or compliance with obligations.

19. MINORS

Legatto recognizes the special importance of protecting the information of children and adolescents.

When the services are directed to minors, the intervention or authorization of the person who legally exercises parental authority, guardianship or corresponding representation will be requested when necessary.

Legatto does not deliberately request sensitive data from minors for commercial purposes.

20. DATA RECEIVED FROM THIRD PARTIES

When a person provides personal data of another person to Legatto, they declare that they have sufficient authorization to do so when necessary.

This can happen, for example, when one person enrolls another in a course or provides information about a representative.

21. CHANGES TO THE PRIVACY NOTICE

Legatto may modify this Privacy Notice to reflect:

  • legal changes;
  • technological changes;
  • new features;
  • new services;
  • changes in suppliers;
  • new compatible purposes;
  • security improvements.

The current version will be available at:

https://legatto.space/aviso-de-privacidad/

Where legally required, relevant changes will be communicated through reasonable means.

22. CONTACT REGARDING PRIVACY MATTERS

For questions, requests, revocations, limitations or ARCO rights:

Responsible: LE Amaya
Mail: contact@mayansolutions.com
Home: Akumal, Quintana Roo, Mexico
Place: https://mayansolutions.com

23. ACCEPTANCE

By voluntarily providing your personal data after having had access to this Privacy Notice, the data subject acknowledges having been informed about the purposes and general conditions of the processing of their data, without prejudice to the specific consents that must be legally obtained.

Legatto®
New World Music Education.