Comprehensive Privacy Notice

I. Identity and Domicile.

Galicia Abogados, S.C. (hereinafter referred to as the “Data Controller”) in compliance with the Federal Law on Protection of Personal Data Held by Private Parties, its regulations and the Guidelines for the Privacy Notice (hereinafter the “Law”) provides this Privacy Notice (the “Notice”), to inform of the terms and conditions for the processing of the personal data and sensitive personal data that, from time to time, may be collected.

For purposes of this Notice, the Data Controller appoints as domicile the one located in Boulevard Manuel Ávila Camacho, number 24-7, Colonia Lomas de Chapultepec, 11000, México, Federal District.

II. Personal Data subjected to Processing and its Purpose.

All personal information you provide or make available to the Data Controller, will be used for the following purposes: (i) contact you; (ii) update your profile in the Data Controller’s database; (iii) make the corresponding charges or payments; (iv) to provide the settled services and/or benefits; (v) in general to meet the purpose of the relationship that has given rise to the processing of personal data.

For the purposes mentioned above, Data Controller may need to obtain the following personal data: full name, corporate name, addresses, country of residence, gender, date of birth, email address, phone number, cell phone number, Tax Registry (RFC), Unique Population Registry Code (CURP), institution where you study, grade point average and location (s) where you work or have worked (the “Personal Data).

III. Sensitive Personal Data and Financial Data subjected to Processing and its Purpose.

Data Collector may need to collect sensitive and/or financial data such as: bank account numbers, credit and/or debit card information, financial statements, general health status (the “Sensitive Personal Data”).

The Sensitive Personal Data may be collected with the purpose of hiring personnel or subcontractors, to conduct payroll payments, any other payment related to the rendering of the services or for issuing the corresponding invoices and to meet the purpose of the relationship that has given rise to the processing of personal data.

The Sensitive Personal Data will not be transferred unless strictly needed. Data Controller guarantees that the Sensitive Personal Data collected, will be processed under the strictest security measures to ensure the confidentiality.

IV. Means to collect Personal Data and Sensitive Personal Data.

Personal Data and Sensitive Personal Data is collected through: email, telephone communication with authorized personnel, the voluntary provision of information and personal data on interviews with authorized personnel, correspondence, the voluntary provision of information and personal data through the webpage www.galicia.com.mx and providing data to enter the premises of the Data Controller for identification purposes.

V. Transfers and Purposes.

 In order to comply with contractual and administrative obligations, the Data Controller may need to share your Personal Data or Sensitive Personal Data with third parties with whom it has a professional or business relationship or with service providers such as public notaries, financial, tax and/or legal advisors, governmental entities, amongst others.

For the transfer of your personal data, we need your express consent in accordance with the provisions of Article 36 the Law, so please indicate whether you accept this transfer”.

I authorize ð do not authorize ð my personal data to be transferred pursuant to the terms and conditions of this Notice

The Data Controller may transfer the obtained data to his agents, correspondents and foreign firms or national partners who share processes and internal policies for corporate governance.

 

VI. Means to access, ratify, cancel and/or oppose the processing of data.

If you have any questions or concerns about how the Data Controller processes the Personal Data, or if you want to access, rectify, delete, copy, limit the use or cancel the Personal Data and / or Sensitive Personal Data or request that cease of processing, according to the Law, please contact the Data Privacy Board sending an email to comitededatospersonales@galicia.com.mx or call 5540-9256 specifying your name, address and the subject of your request. The Data Privacy Board must acknowledge receipt of your request the same day it is received. Your request will be analyzed pursuant to the Law, its regulations and internal privacy policies. No later than five working days after the day on which the request was received, the Data Privacy Board will issue the corresponding response in affirmative or negative form and being duly justified.

Please be advised that certain Personal Data may be extent from such access, rectification, suppression, copying, and deleting according to the applicable Laws.

 

VII. Withdrawal of Consent to the Processing.

In case that you want to cancel the consent for the processing of your Personal Data and/or Sensitive Personal Data, please contact the Data Privacy Board specifying your name, address, and your request. Your request will be analyzed pursuant to the Law, its regulations and internal privacy policies. No later than five working days after the day on which the request was received, the Data Privacy Board will issue the corresponding response in affirmative or negative form and being duly justified.

 

VIII. Personal Data Department.  

The Data Controller by means of the Personal Data Board will take the appropriate measures to protect the Personal Data and Sensitive Personal Data according to the applicable laws and regulations on security and privacy data, including administrative, technical and physical measures, sharing them with third parties linked with the terms of this Notice to have the necessary measures to ensure the protection, confidentiality and security of the Personal Data and Financial Personal Data. Please be advised that the security measures used by the Data Controller are the same used to protect Data Controller’s information. Based on the nature of the services provided by Data Controller, all Personal Data is considered confidential information pursuant to the strictest confidentiality obligation.

 

IX. Means to change the privacy notice.

 This Notice may be amended in order to implement improvements, incorporating new security measures provided in the Law, its Regulations and other legislation. Any amendment to this notice will be notified through our webpage www.galicia.com.mx. The amended Notice will be implemented 7 (seven) business days after its publications.