Privacy
Policy.
How we collect, use, and protect personal data across our operations in the United States, Mexico, and the European Union / United Kingdom.
1. Who we are
Genius Lab Media Group ("GLMG", "we", "us") is a political digital intelligence and campaign operations firm with offices in Mexico City, Guadalajara, Monterrey, Cancún, and Miami. For the purposes of the data protection laws described below, GLMG is the data controller for personal data collected through this website and our client-facing services.
2. Scope
This policy applies to geniuslabmedia.com and any subdomains, forms, and related services we operate (together, the "Site"). It describes our practices for visitors and prospective clients located anywhere in the world, and specifically addresses the additional rights granted under:
- The EU General Data Protection Regulation (GDPR) and the UK GDPR, for individuals in the European Economic Area, the United Kingdom, and Switzerland;
- The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable US state privacy laws;
- Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).
This policy does not cover data processed on behalf of clients under a separate engagement or data processing agreement, which is governed by the terms of that agreement.
3. Information we collect
- Contact and inquiry data you submit through our briefing, careers, or contact forms — name, role, organization, email, country, and message content.
- Career application data — résumé/CV contents, work history, and any information you choose to include in an application.
- Usage and device data collected automatically — IP address, browser type, device identifiers, pages viewed, referring URL, and approximate location derived from IP.
- Cookies and similar technologies, described in Section 6.
We do not knowingly collect sensitive categories of data (such as political opinions, health data, or biometric data) through this Site. Sensitive data shared with us in the course of a client engagement is governed by that engagement's confidentiality terms.
4. How we use it
- To respond to briefing requests, career applications, and other inquiries;
- To operate, secure, and improve the Site;
- To communicate with prospective and current clients and candidates;
- To comply with legal obligations and enforce our agreements.
We do not sell personal data, and we do not use it to serve third-party advertising.
5. Legal basis for processing (EU / UK)
Where the GDPR applies, we rely on the following legal bases: consent (for optional cookies and marketing communications), legitimate interest (to operate and secure the Site and respond to inquiries), and performance of a contract (to deliver services once you engage us). You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
6. Cookies and similar technologies
We use strictly necessary cookies to operate core Site functions (such as remembering your language preference). If we deploy analytics or marketing cookies in the future, we will request consent where required by law and provide a mechanism to withdraw it, including a "Do Not Sell or Share My Personal Information" option for California residents if applicable.
7. Sharing and disclosure
We share personal data only with: service providers who process data on our behalf under confidentiality obligations (e.g., hosting, email delivery); professional advisors; and authorities where required by law or to protect our rights, users, or the public. We do not sell personal data to third parties.
8. International data transfers
Given our offices in Mexico and the United States, personal data may be transferred to and processed in countries other than your own, including countries that have not been recognized as providing an "adequate" level of protection under the GDPR. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
9. Data retention
We retain inquiry and application data for as long as needed to respond to your request, evaluate your application, or comply with legal, accounting, or reporting obligations, after which it is deleted or anonymized.
10. Security
We apply technical and organizational measures proportionate to the sensitivity of the data we hold, including access controls, encryption in transit, and confidentiality obligations for personnel and service providers. No system is completely secure, and we cannot guarantee absolute security.
11. Your rights under the GDPR / UK GDPR
If you are located in the EEA, UK, or Switzerland, you have the right to: access the personal data we hold about you; request rectification of inaccurate data; request erasure ("right to be forgotten"); request restriction of processing; object to processing based on legitimate interest; request data portability; and withdraw consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority. To exercise any of these rights, contact us using the details in Section 16.
12. Your rights under the CCPA/CPRA (California and other US residents)
If you are a California resident, you have the right to: know what personal information we collect and how it is used and shared; delete personal information we hold about you, subject to certain exceptions; correct inaccurate personal information; opt out of the sale or sharing of personal information (we do not sell or share personal information); and not be discriminated against for exercising these rights. To submit a request, contact us using the details in Section 16.
13. Your rights under Mexico's LFPDPPP
If you are located in Mexico, you have ARCO rights: to Access the personal data we hold about you; to Rectify it if inaccurate or incomplete; to request its Cancellation when it is no longer necessary; and to Oppose the processing of your data for specific purposes. This section serves as our simplified privacy notice (aviso de privacidad simplificado); you may request our full privacy notice or exercise your ARCO rights by contacting us using the details in Section 16.
14. Children's privacy
This Site is intended for business audiences and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16.
15. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the Site after an update constitutes acceptance of the revised policy.
16. Contact us
For any question about this policy or to exercise your rights, contact us at privacy@geniuslabmedia.com.