I. Identity of the Firm.

Ibarra, del Paso, y Gallego, S.C. (the “Firm”) with address at Paseo de los Tamarindos 400-A, Floor 27, Colonia Bosques de las Lomas, C.P. 05120, Mexico City, is responsible for the collection, use, and protection of your personal data in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”), as well as its Regulations and Guidelines (hereinafter collectively referred to as the “Personal Data Legislation”) and informs you of the following:

The Firm is a law firm that provides various services related to legal advice in different areas of law, hereinafter referred to as the “Services.” For the offer, quotation, and provision of the Services, the Firm needs to collect and transfer personal data (including sensitive personal data, as well as financial or asset data) to assess legal contingencies, prepare documents related to clients’ operations, contract services with third parties, such as public notaries, process and obtain official documentation from various government institutions at the municipal, local, and federal levels, coordinate with third parties with whom their clients conduct operations, perform legal audits on assets or persons, as well as plan, execute, and follow up on the necessary processes and procedures for their clients, in relation to the Services offered by the Firm.

One of the Firm’s most important priorities is its commitment to the privacy and protection of the personal data it collects from its data subjects, whether prospects or clients of any of its Services (collectively the “Data Subjects”). Therefore, the Firm makes this Privacy Notice (the “Privacy Notice”) available to the Data Subjects, which is a commitment that regulates the processing of their personal data (including its collection, use, disclosure, or storage) by any means to guarantee their privacy and the right to informational self-determination. Accordingly, the Firm will take the necessary and sufficient measures in accordance with the Law to ensure that this Privacy Notice is always complied with by the Firm itself or by third parties with whom it has a legal relationship.

II. Collection of personal data.

The Firm collects personal data, which it processes in accordance with this Privacy Notice, in the following ways: (i) when the Data Subjects provide it to us directly by any means; (ii) when they visit our website; (iii) by subscribing to our Newsletter; (iv) by applying for a position at the Firm through our website; and (v) when we obtain information from other sources permitted by the Law.

We collect your personal data directly when you, as the Data Subject, provide it to us by various means, such as when you give us information for us to prepare a Services quotation, provide you with a legal Service, or give you legal representation.

The personal data we obtain through these means may include, but is not limited to: (i) Federal Taxpayer Registry; (ii) place and date of birth; (iii) nationality; (iv) marital status and property regime; (v) description of certain assets; (vi) documentation of certain operations you carry out, have carried out, or intend to carry out; (vii) tax and/or financial information; (viii) place and date of issuance and expiration of your identification; (ix) tax address; (x) contact details such as phone number and email address; (xi) social security number; (xii) Unique Population Registry Code (CURP); (xiii) description of your employment, legal, business, and compliance practices; (xiv) Advanced Electronic Signature (FIEL) issued by the Tax Administration Service (SAT); (xv) office phone and fax; and (xvi) estimated annual income, as well as any information that the Firm considers appropriate or generally requires for the provision of the Services and/or related activities.

We inform you that we use Cookies and Web Beacons to obtain personal information from you, such as the following: (i) your type of browser and operating system; (ii) the web pages you visit; (iii) the links you follow; (iv) your IP address; and/or (v) the site you visited before entering ours. These cookies and other technologies can be disabled, to learn how to do so, please email us at: [email protected].

The personal data we collect through other sources permitted by the Law include business cards that are given or sent to us, whether printed or electronic, by the Data Subjects themselves, or the information they provide to us when they call us by phone or send us by email.

III. Newsletter.

By subscribing to the Newsletter, you agree to provide the following personal data: (i) full name; (ii) email address; and (iii) the company you belong to.

The personal data collected will be used for the following purposes: (i) identifying the person; (ii) subscription to the Firm’s Newsletter; (iii) sending periodic newsletters with relevant news from the Firm; (iv) creating an internal database of subscribers to the Firm’s news program.

If you wish to stop receiving emails with the most relevant news from the Firm, you can request it in the «Unsubscribe» section of our website or by emailing: [email protected].

IV. Application for a position at the Firm.

By applying for a position at the Firm, you agree to provide the following personal data: (i) full name; (ii) personal address; (iii) email address; (iv) phone number; and (v) curriculum vitae.

The personal data collected will be used for the following purposes: (i) identifying the person; (ii) creating an internal database of potential candidates for positions at the Firm; (iii) sending emails to request personal or work information, schedule job interviews, and/or send job proposals.

If you wish to stop receiving emails related to job applications at the Firm, you can request it by emailing: [email protected].

V. Sensitive and asset-related personal data.

The Firm informs you that, in order to fulfill some of the purposes outlined in this Privacy Notice, sensitive and asset-related personal data will be collected, such as: (i) your racial or ethnic origin; (ii) current and future health status; (iii) genetic information; (iv) union affiliation; (v) nationality; (vi) marital status; (vii) financial capacity; (viii) economic solvency and, if married; (ix) the property regime, as well as information regarding certain assets or resources that may be involved in the operations intended to be carried out. Furthermore, the Firm commits to the Data Subjects of such sensitive and asset-related personal data that it will be treated under security measures that guarantee its confidentiality, in accordance with the Personal Data Legislation and other applicable laws.

VI. Purposes.

The information that the Firm collects from the Data Subjects, whether prospects or clients, will be used for the following legitimate commercial purposes:

1. To provide information related to the Services requested or contracted by the Data Subjects;
2. To evaluate and analyze the information received for the provision of Services in which the Firm specializes;
3. To know the profile of the Data Subjects in their capacity as clients or prospects of the Firm;
4. To comply with the legal relationship contracted with the Data Subjects or other clients, even after such relationship ends, during the time in which actions arising from such relationships may prescribe according to the Law;
5. To inform the Data Subject about changes, complements, or expansions in the Services, whether they have already been contracted by the Data Subject or which the Firm considers may be of interest;
6. For internal purposes, such as evaluating the quality of the service provided to the Data Subject or conducting internal studies, such as statistical, actuarial, consumer profile, and consumption habits information; as well as to compare the information received with similar cases in which the Firm participates at any time;
7. To leverage and enrich the Firm’s infrastructure at local and international levels, as well as for the supervision and monitoring of the performance of different clients and alliances with other law firms of the Firm (both locally and internationally); to reflect the Data Subject’s information in the Services that the Firm prepares for them;
8. For advertising and promotion purposes on the Firm’s website and in various materials and media that we produce and update from time to time for such purposes;
9. To immediately notify the Data Subjects in the event of a security breach occurring in the databases that significantly affects their property or moral rights. If there is a breach in the security measures implemented to protect personal data, the Firm will immediately notify the Data Subjects via email, so that they can exercise their legal rights and protect their interests;
10. To comply with any obligations (whether administrative, regulatory, or normative) to which the Firm, the Services, or the Data Subjects are subject before any competent authority, including without limitation the Federal Law for the Prevention and Identification of Operations with Illicit Resources, its Regulations, and the General Rules referred to by said law; and

11. To communicate to the Data Subjects any changes that the Firm may make to this Privacy Notice.

VII. Consent.

The Data Subject grants the Firm their consent for the information they have provided to the Firm to be processed in accordance with this Privacy Notice and applicable legal provisions. The Data Subject also grants the Firm the authority to obtain, use (the use may encompass any action of access, management, utilization, transfer, or disposal of personal data), disclose, or store their personal data by the means the Firm deems appropriate, for the necessary time subject to the limits established by the Law, to fulfill the purposes set forth in this Privacy Notice and comply with the applicable legal provisions to which the Firm, the Services, or the Data Subjects are subject.

VIII. Transfer of Personal Data.

Through this Privacy Notice, the Firm informs the Data Subjects that their personal data may be transferred and processed both within and outside the country, to persons other than the Firm. Such transfers may be made to persons who are not related parties of the Firm, as well as law firms and other service providers, such as public accountants, business analysts, surveyors, expert translators, public notaries, trainers, and other professionals or suppliers that may be required for the provision of the Services and related activities and services, directly related to the Firm, who will be informed about the limitations and purposes of this Privacy Notice, when necessary to:

1. Evaluate and analyze the application for the execution of any Service offered by the Firm;

2. Perform the necessary actions for the Firm to fulfill its obligations to those who request a Service and with whom the Firm maintains a relationship for such purposes;

3. Conduct inquiries, investigations, and reviews related to the Services provided by the Firm;

4. Establish, maintain, or comply with a legal relationship contracted with the Data Subjects or other clients, even after such relationship ends, during the time in which actions that may arise from such relationships may prescribe; and

5. For internal purposes of the Firm, such as information comparison for study purposes, internal training, or others.

Accordingly, the Data Subject’s information may be shared with public notaries, Public Registry of Property and/or Commerce offices of different states or at the federal level, governmental agencies of all kinds, including but not limited to the secretariats of the executive branch of both the federal government and the states of the Mexican Republic, municipal authorities or other authorities, third parties with whom the Data Subject intends to establish, has established, or has established commercial relationships of any kind and/or with their advisors, various service providers, including but not limited to national and international couriers, certifications, validations, verifications, attestations, apostille procedures, and formalization of any kind, advisory firms with which the Firm maintains strategic alliances, financial institutions, and insurers. The Firm will ensure that third parties are aware of, understand, and comply with the provisions set forth in this Privacy Notice.

If you, as a Data Subject, do not express your opposition to the transfer of your personal data, it will be understood that you authorize and consent to it from this moment.

IX. Principles.

The Firm undertakes to take the necessary measures to ensure that the processing of personal data is carried out in accordance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility established by the Law. Likewise, the Firm undertakes to keep accurate the personal data contained in its databases, so that they are pertinent, correct, and updated for the purposes for which they were collected, and to process them in the manner that is necessary, adequate, and relevant in relation to the purposes herein provided and as agreed in this Privacy Notice.

The time the Firm will retain the personal data it collects will be the necessary period to fulfill the purposes of this Privacy Notice and the obligations the Firm has contracted with the Data Subjects of such personal data.

X. Security Measures.

The Firm maintains and will adopt the necessary administrative, physical, and technical security measures, actions, procedures, and mechanisms that prioritize the interests of the Data Subject and ensure the proper treatment and protection of the personal data it collects, in the same way it safeguards its own.

XI. Exclusion Lists.

If you wish to stop receiving promotional emails or postal mail from the Firm, you can request it in the “Unsubscribe” section of our website or request it via the following email: [email protected].

XII. Exercise of Access, Rectification, Cancellation, and Opposition Rights (hereinafter “ARCO Rights”) to the processing of the Data Subject’s personal data.

The Firm informs you that it is your right to request the correction of your personal information if it is outdated, inaccurate, or incomplete (Rectification); that we delete it from our records or databases when you consider that it is not being used in accordance with the principles, duties, and obligations provided in the regulations (Cancellation); as well as to oppose the use of your personal data for specific purposes (Opposition). These rights are known as ARCO rights.

 To exercise any of the ARCO rights, you must do so through the procedure described below:

1. ARCO Rights must be exercised by the Data Subject or their representative, as follows:

a) The Data Subject must prove their identity by presenting a copy of their identification document, and showing the original for verification.

b) By the Data Subject’s representative, upon proving:

• The identity of the Data Subject;
• The identity of the representative; and
• The existence of the representation, through a public instrument or power of attorney signed before two witnesses, or a declaration in the personal presence of the Data Subject.

2. The Data Subject or their representative must submit a request, in free writing, addressed to the person responsible for personal data at the Firm, at its offices located at Paseo de los Tamarindos 400-A, Floor 27, Colonia Bosques de las Lomas, C.P. 05120, Mexico City, with phone number 52 (+55) 5202-0717 or to the email [email protected], which must contain the following information:

a) Name of the Data Subject, address, phone number, or email address, so that the person in charge of personal data at the Firm can communicate a response.

b) Clear and precise description of the personal data for which the Data Subject seeks to exercise any right.

c) Any element or document that facilitates the location of the personal data in our databases.

d) In the case of requests for rectification of personal data, the Data Subject must also indicate the modifications they intend to make and provide the documentation supporting their request.

3. The Firm will inform the Data Subject of the decision it adopts within a maximum period of 20 (twenty) days from the date it received the request.

4. If the decision mentioned in the previous point is appropriate, the Firm will make it effective within 15 (fifteen) days following the date on which it communicates the response to the Data Subject.

5. The Firm may deny access, rectification, or cancellation of personal data, or oppose their processing in the cases indicated by Article 34 of the Law, which in its relevant part states:

“[…] The responsible party may deny access to personal data, or the rectification or cancellation or grant the opposition to the processing thereof, in the following cases:

I. When the applicant is not the Data Subject of the personal data, or the legal representative is not duly accredited for that purpose;

II) When the personal data of the applicant is not found in its database;

III) When the rights of a third party are affected;

IV) When there is a legal impediment, or the resolution of a competent authority, that restricts access to personal data, or does not allow their rectification, cancellation, or opposition; and

V) When the rectification, cancellation, or opposition has been previously carried out […]”

The Firm designates Victor Leyva as the person responsible for personal data, who will be available at the Firm’s address indicated above, at phone number 52 (+55) 5202-0717, and email [email protected].

XIII. Modifications to the Privacy Notice.

 The Firm reserves the right to make modifications or updates to this Privacy Notice at any time, to address legislative, jurisprudential, internal policy updates, or new requirements for the provision or offering of Services or other reasons. These modifications will be available to the public through the Firm’s website in the “Legal Notices” and/or “Privacy Notice” section or, where appropriate, will be circulated to the last email address provided by the Data Subject. Alternatively, such modifications may also be available through visible announcements at our office, or in brochures or leaflets available at our office.