Notice of Privacy – Users

Identity and address of the Data Controller

Arochi & Lindner, S.C., hereinafter (A&L), domiciled at Insurgentes Sur 1605, 20^th floor, San José Insurgentes, 03900, Mexico City, Mexico is responsible for processing your personal data.

Definitions

Personal data: refers to any isolated or collective information in possession of the Controller that may identify or render an individual identifiable, either directly and/or indirectly.

Sensitive personal data: personal data that affects the most private sphere of the Data Subject, or the improper use of which may lead to discrimination or entail a serious risk to the Data Subject.

Data Subject: the natural person to whom the personal data belongs and whereby they are identified.

Data Controller (Controller): the natural person or legal entity (in this case, A&L) of private capacity that decides on the processing of personal data.

Processor: the natural person or legal entity that processes personal data on behalf of and on account of the Controller.

Processing: the collection, use (including access, handling, exploitation, transfer or disposal of personal data), disclosure or storage of personal data by any means.

Transfer: any communication of data held with any person (natural or legal) other than the Controller or Processor.

Personal Data Subject rights: the ARCO rights refer to the Rights of Access, Rectification, Cancellation and Objection (Opposition); there is also the right to revoke consent, the limitation of disclosure, and the right to file complaints before the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI).

Primary purposes: the grounds on which personal data is requested and whereby the relationship between the Controller (A&L) and the Data Subject (You) is established.

Secondary purposes: purposes that are not essential to the relationship between the Controller (A&L) and the Data Subject (You), but whose processing contributes to the fulfillment of A&L’s corporate purpose.

Regarding the processing of personal data

We collect your personal data when the Data Subject provides said data personally to us through physical, electronic, optical and/or sound means, through a third party as a result of a consented transfer or through publicly available sources.

1. Processed personal dataIn order to comply with the purposes outlined below in this Privacy Notice, A&L will process the following categories of personal data: Identification and contact (only if you provide such information through any of the means available to contact us, either by phone or digital means); as well as data obtained through the use of cookies (See the Use of Cookies and Cookies Policy section).
2. Sensitive personal dataWe inform you that A&L does not collect or process data that is considered sensitive due to its nature. However, in case it is necessary to collect and process such information, we will inform you in advance, letting you know of the purposes of its processing and requesting your express written consent.
3. Means of collecting personal data
   • Physical: when the Data Subject provides their data in person at A&L’s premises.
   • Electronic:  when the Data Subject provides their data via telephone, through electronic means (email, social media or when their image or voice is recorded through multimedia platforms or through our video surveillance services). Furthermore, when we collect information from the Data Subject automatically, through our own and third-party Cookies.
   • Through Third Parties: in this case, we will make our Privacy Notice available to the Data Subjects when we first contact them.
   • Publicly accessible sources: when the Data Subject’s data is stored in publicly accessible sources.

Use of personal data

The Data Controller will process your personal data for the following primary purposes:

If the Data Subject visits our website and contacts us by any of the means provided to this end, your data will be used to answer your questions and comments, as well as to show you general information regarding the Firm, available services and bring you closer to the professional team of A&L.

If you come to our offices, your personal data will be processed to identify you; to ascertain the purpose of your visit; to comply with surveillance and safety requirements of the premises and physical assets of A&L, of its clients, collaborators, visitors and suppliers; to control access to the firm’s premises and, if necessary, to be able to identify persons in the event of any legal right being breached.

Moreover, unless the Data Subject objects, we will use their personal data for the following secondary purposes: to send them information regarding events, services and legal news that may be of interest through our publications in social media and newsletters.

If the Data Subject does not wish to have their personal data processed for any or all of the additional purposes, they can let us know via e-mail to the following address: [email protected].

The Data Subject has 5 (five) working days to state their refusal to the processing of their personal data for any or all of the secondary purposes via e-mail to [email protected]. This term shall start at A&L’s first contact with the Data Subject.

A refusal to use your personal data for additional purposes shall not be a reason to deny you the requested services or to terminate the relationship established with A&L.

Personal data transfers

In order to comply with the purposes described above, if necessary, we transfer personal data to companies of the same group, or to national or foreign legal correspondents, so as to respond to the Data Subject’s queries.

In accordance with Article 37 of the Federal Law for the Protection of Personal Data Held by Individuals, these transfers may be undertaken without the consent of the Data Subject. However, should any transfer of personal data be necessary regarding the purposes for which it is compulsory to obtain the consent of the Data Subject, we will inform you in advance to collect the data appropriately.

ARCO Rights

The Data Subject or their legal representative may exercise any of the rights of access, rectification, cancellation or objection (opposition), also known as ARCO rights, as well as revoke their consent for the processing of their data via e-mail to [email protected], which is managed and serviced by the Personal Data Department of A&L, located at Av. Insurgentes Sur No. 1605 20^th floor, San José Insurgentes, Mexico City, 03900. If the Data Subject wishes, they may also submit their request in person at the address above, marked for the attention of A&L’s Personal Data Department.

Once the Personal Data Department has been contacted, the Data Subject may submit their request through the form specifying the following:

• The name of the applicant and, where appropriate, of their legal representative.
• The documents that prove the identity of the personal Data Subject and, if applicable, of their legal representation. The address and/or e-mail address for the purpose of replying to the request to exercise the relevant right.
• A clear and accurate description of the right to be exercised, as well as the personal data associated with the aforementioned right.[1]^.
• Any means or documentation that would enable the location or identification of personal data.

The timeframes for exercising the ARCO rights, as well as the revocation of consent, are as follows:

The timeframes specified in the foregoing paragraph may be extended by the same amount of time indicated above for one single occasion on justified grounds.

The exercise of the rights stated herein shall be free of charge; however, in the case of the exercise of the right of access, the Data Subject may request submission -prior to the validation of their identity before the Controller-, through the issuance of non-certified copies or the submission of electronic documents, for which the Data Subject shall cover the expenses derived from shipping or copying, which will be notified to the Data Subject when appraised of the applicability of their right.

The information exchange with the Data Subject regarding the exercise of the relevant right will be carried out through the address or e-mail specified in the request.

A&L reserves the right to not fully fulfil a request for exercising ARCO rights submitted by the Data Subject when failing to provide reliable proof of their identity or that of their legal representative, in order to fully protect the Data Subjects.

Restriction and/or disclosure of personal data

The Data Subject may restrict the use or disclosure of their personal data by submitting their request via e-mail to [email protected]. If the request is accepted, it will be registered in the list that A&L keeps for this purpose.

Moreover, the restriction on the use and disclosure of personal data can be extended by registering the telephone number of personal Data Subjects in the Public Registry to Avoid Advertising (REPEP) https://www.repep.profeco.gob.mx under the supervision of the Federal Consumer Protection Agency (PROFECO), to ensure that data will not be used to receive advertising or promotions from companies offering goods or services.

Retention period

We keep personal data for as long as the commercial relationship between the Data Subject and the Data Subject remains, as well as for the time necessary to fulfill the purposes stated herein; after said time period, the data will be blocked for subsequent deletion, complying with the legal deadlines set forth for each case.

Regarding marketing activities, your data will be part of the relevant databases for as long as the Data Subject accepts our communications and will delete the Data Subject from our distribution lists upon request submitted to [email protected], or by unsubscribing directly through the link available for this purpose embedded in all our communications for marketing purposes.

The Data Subject is notified that, at any time, they may request the cancellation of their personal data, and is aware that such cancellation may mean that they will not receive any kind of information requested or that the services provided by A&L to the Data Subject may stop.

Data Security

We have implemented and keep physical, technical and administrative measures necessary to protect Personal Data from loss, misuse, alteration or unintentional deletion.

These measures include secure storage of information in our databases, along with strict authentication controls and restricted authorization for access to these databases.

Our collaborators, associates, managers and third parties linked to A&L who have access to the information provided by the Data Subject are subject to conform to the confidentiality of the information and not to disclose it, as well as to comply with the applicable data protection laws.

A&L has undertaken all the necessary physical, technical, and administrative security measures to ensure an adequate level of security and protect the personal data requested.

Use of Cookies

We inform you that our website uses its own cookies, as well as third-party cookies, as described below.

1. What are cookies? A cookie refers to information that a website stores on your computer through the use of a web browser. Cookies allow websites to record your browsing activities. The data collected by cookies can be merged to create a profile of your online activities.
2. Use of cookies on our website. We use cookies to collect information about your usage patterns when you browse our website, to enhance your personalized experience and understand usage behavior in order to improve our site, content, publications and services. The cookies we use on our site belong to the following categories:
   • Necessary cookies: necessary cookies help make a website usable by enabling basic functions such as page navigation and access to secure areas of the website. The website cannot perform properly without these cookies.
   • Preference cookies: these cookies allow the website to remember information that changes the way the site behaves or looks, such as your preferred language or the region where the Data Subject is located.
   • Statistical cookies: these cookies help website Data Subjects understand how visitors interact with web pages by collecting and providing information in an anonymously.
   • Marketing cookies: these cookies are used to track visitors on web pages in order to display relevant and appealing information to the individual user.
3. Cookie management options. Cookies can be disabled as follows:

On a PC: open your Internet browser, go to the “Tools” menu, go to “Internet Options”, choose the “Privacy” tab, move the Settings slider to “Block all Cookies”.

On a Mac: open the Internet application, go to “Preferences”, choose the “Security” option, choose “Never” in the “Accept Cookies” option. There are some browsers that allow you to install add-on software tools to block, delete or control cookies. Generally, security programs include options to streamline the control of cookies.

Changes to our Privacy Notice

We reserve the right to change our security and data protection measures. In such cases we will modify our Privacy Notice accordingly. Changes will be posted on our website, so we encourage you to regularly review this section.

Contact us

If you have any questions or comments regarding this Privacy Notice or our privacy and personal data protection policies, do not hesitate to contact our Personal Data Department: [email protected].

Consent

By continuing to browse our website, or by contacting us by any means provided for this purpose, as well as by providing us with your data, you acknowledge that you are aware of the content, scope, terms and conditions described above and expressly consent to the processing of your personal data in accordance with the uses and purposes set forth in this Privacy Notice.

Exceptions to the principle of consent

Pursuant to Article 10 of the Federal Law for the Protection of Personal Data Held by Individuals, and Article 17 of the Regulations of the aforementioned law, the Data Subject understands that their consent will not be necessary when:

1. It is provided for by law
2. The data is contained in publicly available sources;
3. The personal data is subject to a prior dissociation procedure;
4. The purpose is to comply with obligations stemming from a legal relationship between the Data Subject and the Controller;
5. There is an emergency situation that may potentially harm an individual or their property;
6. A resolution is issued by a relevant authority;
7. Derived from a legal relationship between the Data Subject and the Controller.

Last update : January 2023

[1]  If it is a right of Correction, please indicate the data to be corrected and the correction to be made. In case it is a right of Objection (opposition), if applicable, please indicate the secondary purposes for which you wish to exercise the right.