Technical and product obligations under Mexican personal data law: privacy notice, ARCO rights, retention, security, and processor agreements.