SELF-CONQUEST

​Human Authority  •  Executive Communication  •  Private Advisory

​

Data Controller: Karina Carlos Arreguín, operating under the trade name Self-Conquest

​

Effective date: August 9, 2026

​

Purpose of this notice. To explain clearly what personal data Self-Conquest processes, why it uses the data, with whom the data may be shared, and how Data Subjects may exercise control over it.

​

English translation. This English-language notice is provided to facilitate understanding. The Spanish-language version is the controlling version and this translation must be interpreted consistently with it and with applicable Mexican law.

​

1. Identity and address of the Data Controller

Karina Carlos Arreguín, an individual carrying out professional and business activities under the trade name Self-Conquest (hereinafter, “Self-Conquest”), is the Data Controller responsible for processing the personal data described in this Comprehensive Privacy Notice.

​

Address for privacy matters and receipt of notices: WeWork, c/o Karina Carlos Arreguín, Paseo de los Virreyes 45, Colonia Puerta de Hierro, Zapopan, Jalisco, C.P. 45116, Mexico.

​

Email for privacy matters and ARCO rights: karina@karinacarlos.com.

​

Self-Conquest is a trade name and an independent professional practice. This notice does not represent Self-Conquest as a legal entity separate from Karina Carlos Arreguín.

​

2. Scope

This notice applies to personal data processed through karinacarlos.com, self-conquest.com, related landing pages and forms; email communications and messaging platforms; videoconferences; application, diagnostic, contracting, payment and invoicing processes; delivery of Human Authority, executive communication, Authority Diagnostic, intensives, private advisory and 1:1 services; subscriptions, publications and resources; and historical service relationships that Self-Conquest is legally entitled or required to retain.

​

When a relationship is contracted or managed entirely through an independent platform—for example, Preply—that platform’s privacy notice will also apply to the processing activities it determines and carries out on its own behalf.

​

3. Categories of personal data that may be processed

Depending on the point of contact and the service requested, Self-Conquest may process the following categories of personal data:

• Identification and contact data: first and last name, country or city of residence, time zone, email address, telephone number, signature and preferred contact methods.

• Professional and employment data: title, organization, industry, professional history, professional profile, responsibilities, working languages, leadership context, communication objectives and professional materials that the Data Subject chooses to share.

• Application, contracting and service data: form responses, objectives, availability, contracted scope, session history, working notes, messages, feedback, decisions, preferences, progress, deliverables and the Client Continuity Summary.

• Tax, financial and asset-related data: name or business details for invoicing, Mexican tax identification number (RFC), tax regime and tax address, CFDI use, billing email, amount, currency, date, payment method and status, bank transfer references and limited transaction data made available by payment processors. Self-Conquest does not directly store full payment-card numbers or security codes.

• Image, audio and voice data: participation in video calls and, only with prior and specific authorization, session recordings.

• Technical and browsing data: IP address, device or browser identifiers, operating system, language, approximate location, pages visited, date and time, referral source, interactions, conversion events and data obtained through cookies or similar technologies.

• Derived data: summaries, professional observations, communication patterns, qualitative assessments and deliverables generated from information shared during the professional relationship.

 

4. Sensitive personal data

As an ordinary part of its services, Self-Conquest does not request or require data concerning health, diagnoses, racial or ethnic origin, religious, philosophical or moral beliefs, political opinions, sexual orientation or other sensitive categories.

​

A person may voluntarily disclose sensitive information because they consider it relevant to their context. Self-Conquest will seek not to include such information in notes, deliverables or files when it is not indispensable. If retention becomes strictly necessary, Self-Conquest will explain the specific purpose and request express written consent through a separate instrument. Otherwise, the information will be reasonably omitted or deleted. The Data Subject may ask for a recording to be paused before disclosing information of this nature.

​

5. Sources from which personal data is obtained

Personal data may be obtained directly from the Data Subject through forms, conversations, sessions, documents, payments and communications; from platforms the Data Subject uses to contract or communicate with Self-Conquest; from authorized referrals; and, on a limited basis, from publicly available sources or public professional profiles when necessary to validate professional context or prepare a legitimate interaction.

​

If a person provides data relating to colleagues, clients or other third parties, they should share only what is necessary and avoid intimate or sensitive information. Self-Conquest will not use that data to contact the third party for commercial purposes without a lawful basis or appropriate authorization.

​

6. Primary and necessary purposes

Personal data will be processed for the following purposes, which are necessary to initiate, maintain or fulfill the professional, contractual or legal relationship:

• Respond to inquiries; administer requests, applications and selection processes; verify identity, professional context and fit with the requested service.

• Schedule meetings and sessions; send confirmations, reminders, preparation information, access details, changes and operational communications.

• Prepare, personalize, deliver and follow up on Authority Diagnostics, intensives, private advisory, 1:1 services, resources, assessments and deliverables.

• Document objectives, agreements, observations, decisions and continuity; prepare Authority Snapshots, materials, summaries and Client Continuity Summaries.

• Record sessions only when prior, specific and demonstrable consent has been obtained for the purpose stated in each authorization.

• Process payments, prevent fraud, reconcile transactions, manage refunds and issue invoices or receipts.

• Provide support and respond to inquiries, complaints, privacy requests and the exercise of ARCO rights.

• Maintain the security, availability and technical operation of websites, forms, accounts and files.

• Comply with legal, tax, accounting, contractual and administrative obligations, and establish, exercise or defend legal rights.

• Manage legitimate historical records of previous relationships in accordance with the retention periods and criteria described in this notice.

 

7. Secondary purposes

In addition, and not as a condition of receiving the service, Self-Conquest may process contact, interaction and browsing data to:

• Send publications, newsletters, resources, invitations, updates and communications about Human Authority or related services.

• Conduct satisfaction surveys, request feedback and analyze the experience of prospects and clients.

• Measure campaigns, audiences and conversions, and conduct outreach or digital advertising through Wix, Google Analytics and Google Ads.

• Publish a testimonial, case study, name, title, company, image, voice, results or materials relating to a person only when separate, specific and demonstrable authorization has been obtained for the applicable elements and channels.

• Generate statistical analyses or internal learnings using aggregated or dissociated (de-identified) data that does not permit the identification of individuals.

Refusal or withdrawal. These secondary purposes do not condition access to the services. To refuse or withdraw consent, the Data Subject may use the unsubscribe link included in emails or write to karina@karinacarlos.com with the subject “REFUSAL OF SECONDARY PURPOSES / NEGATIVA A FINALIDADES SECUNDARIAS.”

​

8. Consent and separate authorizations

Making this notice available serves an informational purpose and does not replace any express-consent mechanism required by law. When processing is based on consent and express consent is required, Self-Conquest will request it through a specific affirmative action, in writing or by electronic means.

In particular:

• Financial or asset-related data will be processed with the corresponding express consent or pursuant to a legal exception applicable to the legal relationship and fulfillment of payment obligations.

• Sensitive personal data that must be retained will require express written consent.

• Zoom recordings will require prior authorization identifying the purpose, access, retention period and the option to pause the recording.

• Testimonials, case studies, images, voice, name, title, company and identifiable results will require an authorization separate from the service agreement.

 

9. Use of artificial intelligence and automated decisions

Self-Conquest may use generative artificial intelligence tools for internal support in organizing ideas, analyzing non-identifiable patterns, preparing drafts or developing materials. Before any such use, client information will undergo a dissociation (de-identification) procedure reasonably designed to prevent it from being associated with a specific person or used to reidentify that person.

​

Self-Conquest will not enter into such tools names, email addresses, telephone numbers, identifiable combinations of company and title, private links, recordings, voice, images, photographs, unredacted documents or distinctive circumstances that would allow an identity to be reconstructed. Self-Conquest will not attempt to reidentify dissociated information.

​

Self-Conquest does not make decisions based exclusively on automated processing that produce legal effects or significantly affect the rights or interests of prospects or clients. Assessments, recommendations and professional decisions remain subject to human review and responsibility.

 

10. Videoconference recordings

Sessions are not recorded by default. When a recording would be useful, Self-Conquest will request prior consent and explain the purpose. Zoom may also display a technical recording notice.

Authorized recordings will be accessible only to Karina Carlos Arreguín and, when technically indispensable, to service providers acting as Data Processors. They will not be used for advertising, testimonials, AI model training or publication without additional, specific authorization.

The ordinary retention period is 90 days from the date of recording. A different period may apply when there is a written agreement, a documented need or a legal obligation. The Data Subject may request that the recording be paused or stopped during the session.

​

11. Cookies and tracking technologies

Self-Conquest websites and pages may use cookies and similar technologies operated by Wix and Google to enable essential functions, remember preferences, protect forms, produce analytics, measure campaigns and attribute conversions.

​

These technologies may collect IP address, identifiers, device and browser type, approximate location, pages visited, duration, interactions, referral source and conversion events. Google Analytics and Google Ads may process this information under their own terms and privacy notices.

​

The Data Subject may restrict, block or delete cookies through browser settings and manage Google advertising preferences at https://myadcenter.google.com/. Disabling essential cookies may affect the operation of certain pages or forms.

 

12. Data Processors, technology services and international processing

Self-Conquest uses technology providers and platforms to operate the practice. Depending on their function and terms, some act as Data Processors and process personal data on behalf of the Data Controller; others determine their own processing activities as necessary for payments, security, compliance or administration of the relationship and are also governed by their respective privacy notices. These providers may include:

​

• Wix and Wix Payments: hosting, webpages, forms, automations, email marketing, technical analytics and payments enabled on the website.

• Google: Gmail, Google Calendar, Google Analytics and Google Ads.

• Zoom: videoconferences and temporary storage of authorized recordings.

• Dropbox: storage of client files, materials and deliverables.

• Stripe: payment processing, including Apple Pay and Google Pay when used through Stripe.

• PayPal: payment processing and transaction management.

• Preply: communication, contracting, administration and payments for relationships managed through its platform.

 

Some providers may process or store information outside Mexico. When acting on behalf of Self-Conquest, they will receive only the data necessary for the contracted function and must be subject to privacy, security and confidentiality obligations. When they determine their own processing activities, the Data Subject may consult their respective privacy notices.

 

13. Transfers of personal data

Self-Conquest does not sell, rent or transfer personal data to third parties for their own marketing purposes.

Personal data may be transferred without additional consent when a statutory exception applies, including to:

• Stripe, PayPal, Wix Payments, Apple Pay or Google Pay through Stripe, financial institutions and other payment participants, when necessary to process a transaction, prevent fraud, issue refunds or fulfill the legal relationship.

• Preply or another platform selected by the Data Subject, when necessary to administer a relationship contracted through that platform.

• Tax, administrative, judicial or other competent authorities, when required by an applicable law, order or obligation.

• Legal, tax or accounting advisers, only when necessary to comply with obligations, respond to audits, or establish, exercise or defend a legal right.

 

Self-Conquest does not currently contemplate additional transfers requiring consent. If such transfers are contemplated in the future, Self-Conquest will provide prior notice of the applicable conditions and obtain the required consent before the transfer occurs.

 

14. Retention, blocking and deletion

Self-Conquest will retain personal data only for as long as necessary to fulfill the stated purposes, maintain reasonable continuity, comply with legal or contractual obligations and determine potential liabilities. Personal data will then be blocked and securely deleted, as applicable.​​

​