Privacy Policy & Data Notice governs all regulatory inquiries, advertising channels, and commercial records.

This Privacy Policy took effect on October 17, 2026. It applies to all electronic records, intake transmissions, web platform interactions, and advertising traffic reaching the regulatory practice of Lourdes Negrón Montalvo via lourdesnegron.us. Revisions are catalogued under formal version control markers and posted directly to this framed instrument without archival suppression.

The sole data controller responsible for the processing of personal data, regulatory dossiers, and electronic inquiries gathered through this website is:

Lourdesnegron, trading at lourdesnegron.us (trading as LOURDES NEGRON MONTALVO)
Postal address, written out in full: 738 ESTANCIAS DEL GOLF · C/ ENRIQUE LAGUERRE, PONCE, PR 00730, PONCE, PR, United States
Direct consultation telephone: (787) 842-1314
Regulatory email desk: [email protected]

The practice operates as a registered business entity. Governing law is the law of PR, United States, with disputes heard in the courts of PONCE.

We restrict data collection to technical identifiers and substantive operational parameters required to review commercial expansion files. The practice records exclusively the following items:

• Inquiry Console Data (wipu973.php): Full representative name, commercial telephone number, business email address, physical property address or municipal cadastral number, project classification, project notes, requested technical specifications, and explicit affirmative consent timestamp.
• Technical Transmission Metadata: Internet Protocol (IP) address, browser user-agent header string, referring URL source, timestamp marking when the intake form was rendered in the client viewport, and timestamp marking the exact network post transmission.
• Live Chat Support Records (cewa46f.php): Regulatory chat transcript messages, client representative name, and an ephemeral session authentication token saved within browser local storage to maintain continuity during permitting discussions.
• Consent State Records: User preference values stored locally under the single persistent key site_consent_v2.
• Advertising Click Identifiers: Inbound parameter strings passed via active paid advertising campaigns, specifically gclid from Google, msclkid from Microsoft, and fbclid from Meta.

We do not operate user accounts, customer logins, or client passwords. No credit card numbers, banking credentials, or payment card transactions are accepted or processed on this website. Our professional fees for initial consultation ($50), permit processing ($300), compliance audits ($100), and administrative representation ($1,500) are handled through direct commercial invoicing outside this web portal.

Information gathered through the site is processed strictly for defined business objectives:

• Evaluating municipal zoning classification, cadastral records, and agency requirements for Puerto Rico commercial permits.
• Communicating directly by telephone or electronic mail with commercial operators regarding quotes, procedural timelines, and agency hearings.
• Maintaining live regulatory advisory sessions through the intake chat console.
• Preventing fraudulent transmissions, automated spam submissions, and malicious exploitation via hidden server honey-pot attributes.
• Attributing paid advertising acquisitions and assessing campaign efficiency across Google Ads, Microsoft Advertising, and Meta Ads platforms.

Under applicable United States and international data protection standards, including GDPR for international visitors, processing is founded on specific legal grounds:

This practice actively runs commercial acquisition campaigns. We state in the present tense that traffic arrives at lourdesnegron.us via paid digital marketing managed through Google Ads, Microsoft Advertising, and Meta Ads (also referred to in platform policy as google ads and microsoft advertising).

When an investor or commercial business owner clicks our campaign notices, the destination URL receives specific query parameters carrying platform click identifiers: gclid (generated by Google Ads), msclkid (generated by Microsoft Advertising), and fbclid (generated by Meta Ads). These parameters allow measurement of landing page relevance, ad conversion events, and cost efficiency. Nothing anywhere claims or implies that Google, Microsoft, or Meta has reviewed, approved, vetted, or certified this site or practice.

Our digital infrastructure enforces Google Consent Mode v2 (consent mode). By default architectural design, four distinct tracking signals are held strictly in a denied status prior to any visitor choice:

• ad_storage: denied
• ad_user_data: denied
• ad_personalization: denied
• analytics_storage: denied

These four signals remain denied until the visitor executes an affirmative selection by clicking "Allow Storage" in our consent interface. If the visitor selects "Strictly Necessary Only", or later invokes the consent reset tool in the footer, each of the four signals is immediately returned to denied status, and existing measurement scripts are suppressed. Consent state is recorded locally in site_consent_v2 and persists for 6 months unless manually cleared.

Personal data and technical transmission logs are received by selected external service providers operating under strict confidentiality and processing agreements:

• Google LLC / Google Ireland Ltd: Provides Google Ads conversion measurement and advertising delivery. Operates under standard contractual clauses and Google Ads controller-processor terms.
• Microsoft Ireland Operations Ltd: Provides Microsoft Advertising attribution and measurement across Bing network surfaces. Handled pursuant to the Microsoft privacy statement published at privacy.microsoft.com.
• Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Provides Meta Ads attribution and social campaign analytics under Meta Business Tools terms.
• Core Hosting & Server Infrastructure Provider: Houses our high-performance web servers, manages the encrypted SQL filing database, and executes secure transmission protocols for wipu973.php and cewa46f.php.
• Encrypted Mail Transport Provider: Delivers intake notifications from the web server directly to the operator's desktop workstation in Ponce.

Our technical systems and primary physical consultancy are situated in Puerto Rico, an unincorporated territory of the United States. Processing infrastructure may route encrypted records through server clusters in mainland United States or the European Union depending on third-party cloud load-balancing. For data received from the European Economic Area or United Kingdom, international transfers are governed by standard contractual clauses (SCCs) adopted by the European Commission or applicable adequacy frameworks, ensuring protection equivalent to domestic statutory requirements.

We do not retain personal information indefinitely under vague necessity claims. Records are governed by precise, enforceable retention schedules:

• Commercial Inquiries & Email Notifications: Retained for 18 months from the date of submission to accommodate permit administrative appeal cycles and municipal docket evaluations, after which files are permanently purged.
• Support Chat Transcripts: Retained on server systems for 12 months following conversation completion.
• Server & Access Logs: IP connection logs and transmission headers are automatically deleted after 30 days.
• Consent Choice Record: The browser local storage record (site_consent_v2) is retained for 6 months before re-prompting.
• Data Access & Deletion Inquiries: Fully processed and answered within 14 days of verified receipt.

All data exchanged with lourdesnegron.us is protected in transit using Transport Layer Security (TLS 1.3) cryptographic protocols with 256-bit encryption. Web intake handlers enforce strict input sanitation, parameterized database queries, and hidden honeypot parameters to neutralize injection attacks. Production administrative databases are partitioned behind hardware firewalls with restricted key-based authentication limited to principal consultant Lourdes Negrón Montalvo.

For clients, investors, or representatives accessing our services from Europe (the European Economic Area, the United Kingdom, or Switzerland), the gdpr (GDPR) guarantees the following enforceable rights:

• Right of Access: Request confirmation of whether your data is being processed and obtain a copy of the substantive regulatory record.
• Right to Rectification: Demand immediate correction of inaccurate or incomplete commercial and parcel information.
• Right to Erasure (Right to be Forgotten): Request permanent deletion of personal records when retention is no longer justified.
• Right to Restriction: Request suspension of processing during disputes regarding accuracy or legal grounds.
• Right to Data Portability: Receive your provided records in a structured, machine-readable format.
• Right to Object: Oppose data processing conducted on legitimate interest bases at any time.
• Right to Withdraw Consent: Revoke previously granted tracking consent with immediate prospective effect via our footer settings.

This practice adheres to United States state privacy statutes, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa / CCPA / CPRA), as well as statutes in Virginia, Colorado, Connecticut, Utah, and Puerto Rico. Commercial operators and consumers possess:

• The right to know what personal identifiers and categories of commercial information have been collected.
• The right to delete personal information collected from them, subject to statutory filing preservation exemptions.
• The right to correct inaccurate personal data.
• The right to opt out of the sale or sharing of personal data for cross-context behavioral advertising.
• The right to freedom from discriminatory treatment for exercising statutory privacy protections.

Declaration Regarding Sale of Information: Lourdes Negrón Montalvo does not sell personal information, commercial dossiers, or client phone numbers for monetary consideration, and has not sold personal information in the preceding 12 months. Cross-context ad telemetry on Google Ads, Microsoft Advertising, and Meta Ads is classified as "sharing" under California law and is governed strictly through our consent mechanism.

Our web infrastructure natively recognizes and honours global privacy control (Global Privacy Control / GPC) signals transmitted via browser user-agents. When an incoming HTTP request carries the Sec-GPC: 1 header, the website automatically treats the command as a valid, binding affirmative opt-out of cross-context behavioral tracking and non-essential analytics, immediately locking advertising cookies to denied status without requiring manual menu interactions.

The regulatory and commercial permitting services offered by Lourdes Negrón Montalvo are exclusively intended for adult corporate officers, real estate investors, and commercial operators. We do not knowingly solicit, collect, or retain data from individuals under the age of 18. Any docket mistakenly containing information belonging to a minor will be purged immediately upon notice.

If you believe our data handling infringes applicable statutory protections, you have the formal right to lodge an administrative complaint with regulatory enforcement agencies:

• In Puerto Rico and the United States: The visitor may complain to their state Attorney General, to the Consumer Protection Division of the Puerto Rico Department of Consumer Affairs (DACO), or the Federal Trade Commission (FTC).
• In California: Lodge a formal complaint with the California Privacy Protection Agency (CPPA) or the California Attorney General.
• In European Jurisdictions: Submit an administrative petition to your national Data Protection Authority (DPA).

To inspect, update, export, or request the permanent deletion of personal records or commercial contact dockets, submit a formal written inquiry to our compliance desk:

Please specify your full business name, affiliated commercial project, and the specific statutory right you wish to exercise. Every verified request is acknowledged promptly and fully answered within 14 days without fee.

The practice reserves the right to modify this instrument to mirror adjustments in commonwealth permitting procedures, municipal zoning rules, or digital platform advertising standards. Updates take effect immediately upon posting to this document card. The effective date at the head of this document reflects the most recent revision.

For questions regarding our privacy architecture, consent governance, or municipal permit records retention, direct your inquiry to our principal consultant: