1. Objective 

The objective of this privacy notice is to establish the conditions under which Velderrain Sáenz & Asociados S.C. (hereinafter, VS&A) collects, uses, retains, and protects the personal data that you provide to us, in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), amended in March 2025. The purpose is to ensure that your data is processed in a legitimate, controlled, and informed manner, guaranteeing your privacy and the right to informational self-determination.

  1. Scope

This document is applicable to all operations of VS&A in Mexico, as well as to the processes that are subject to the Information Security Management System (SGSI).

COMPREHENSIVE PRIVACY NOTICE

In accordance with the provisions of Articles 10, 11, 12, 14, 15, 16, 17,19, and 32 of the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), VS&A makes the following Privacy Notice available to you.

Responsible for the Processing of Personal Data

VS&A, with address at Vito Alessio Robles 51, Exhacienda de Guadalupe Chimalistac, Alvaro Obregon, 01050, Mexico City, contact phone: (55) 2978-0007, email: [email protected], is responsible for the use and protection of your personal data, and in this regard, we inform you of the following:

The processing of your personal data is a priority for VS&A. This Privacy Notice complements any other simplified or short privacy notice that has been made available to you and informs you about the purposes or which your personal data will be processed. 

In the event that we do not have your personal data, we will not be able to conduct the purposes for which they are required, and we will not have any responsibility derived from this. 

Purposes of the Processing of Personal Data 

The personal data we collect from you will be used for the following purposes:

Clients: If you are our client, your data will be used to conduct the necessary activities to provide you with the requested services, including the preparation of proposals, attention, and follow-up to the services provided by VS&A.

Suppliers: If you are a supplier or are in the process of becoming one, your data will be used for the commercial legal relationship with VS&A, the evaluation, hiring, and management of suppliers, as well as for the registration and control of payments. 

Employees or Job Candidates: If you work at VS&A or are in the selection process, we will use your personal data to comply with obligations derived from the employment relationship, personnel management, payroll payment, assignment of work equipment, training, audits, creation of work email accounts,; preparation of the company directory; assignment of accesses and passwords, assignment of work tools; ensuring compliance with confidentiality obligations and other labor obligations.

The processing of your personal data is conducted based on the following grounds: consent, contractual relationship, legal obligations, legitimate interest, and, where applicable, protection of vital interests. 

By this notice, it is confirmed that your personal information will not be used for purposes other than those mentioned above and will be safeguarded under the strictest confidentiality, unless there is a change in this privacy notice. 

Once the purpose of the personal data processing is fulfilled, they will be blocked with the sole purpose of determining possible responsibilities related to their processing, until the legal or contractual prescription period of these. During said period, personal data may not be processed, and once the period has passed, they will be canceled in the corresponding database.

Secondary Purposes of the Processing of Personal Data 

In addition to the primary purposes mentioned, VS&A may process your personal data for the following secondary purposes: 

Marketing, advertising, or commercial prospecting purposes. 

To generate operational, statistical, or historical reports. 

To create commercial guidelines and institutional advertising. 

To send information about events, training sessions, or activities organized by VS&A.

Collection of Personal Data and Sensitive Personal Data

We collect personal data directly from you or through legally permitted means, such as website, job applications, résumés, interviews, psychometric evaluations, amongst others. Sensitive personal data will only be processed when the data subject gives express consent, except for legal exceptions. If the data subject does not provide sensitive data that is not essential, they may continue in the processes that do not require them. In case the data collected are from minors, the consent of their parents or legal guardians will be indispensable. 

Personal Data We Collect 

To fulfill the mentioned purposes, we collect the following data: Full name, marital status, signature, RFC, CURP, nationality, immigration status, place and date of birth, photograph, address, email, contact phone numbers, professional licenses, and degrees. 

Retention, Blocking, and Cancellation of Data 

Personal data will be retained only for the time necessary to fulfill the purposes that justified their processing. Once said objective is fulfilled, they will be blocked for the legal or contractual prescription period, and subsequently permanently canceled. 

In Compliance with the current legislation, data will be retained for the necessary time according to their nature and purpose: 

  • Labor: up to 5 years after the termination of the relationship. 
  • Fiscal and accounting: up to 10 years according to applicable law.
  • Commercial and suppliers: as long as the contractual relationship lasts and until the prescription of obligations. 

Limitation of the Use or Disclosure of Personal Data  

To limit the use or disclosure of your personal data, you may send a request to the person in charge of processing them via email to [email protected] or in writing to the established contact address.

Use and Protection of Sensitive Data 

The information you provide will be treated confidentially and will be used exclusively for purposes related to your evaluation in the selection process. Under no circumstances will it be used for purposes other than those mentioned, and it will only be shared with those responsible for talent development, under strict security and confidentiality measures. 

In accordance with current legislation, sensitive personal data will not be processed without your explicit consent, except for legal exceptions. If you do not provide this information, you may participate in the selection process, as long as it is not an essential requirement for the position or to comply with applicable regulations.

Website

The information we receive and store from our website when you interact with our site is mainly your internet protocol address, your computer’s operating system and browser type, the address of a referring website, if applicable, and the path you follow during your navigation through our website.

We inform you that the website has implemented SSL security locks, cookies, and other tracking tools. 

Use of Cookies – The proper functioning of VS&A’s website requires the enabling of “cookies” in your internet browser. “Cookies” are small data files transferred by the website to your computer’s hard drive when you browse the site. Cookies can be session based or permanent. The personal data that may be obtained through these technologies include IP addresses, browser type, operating system, interaction time, and pages visited. 

In most browsers, cookies are automatically accepted by default settings; you can adjust your browser preferences to accept or reject cookies. 

Exercise of ARCO Rights (Access, Rectification, Cancellation, and Opposition)

You have the right to know what personal data we have about you, what we use it for, and the conditions of its use (Access). Additionally, you may request the correction of your data if it is outdated or incorrect (Rectification), or that we delete it from our databases (Cancellation). You may also oppose automated processing that produces adverse legal effects or significantly affects your rights and freedoms (Opposition). 

To exercise your ARCO rights, you must send a request via email to the person in charge of personal data processing at [email protected], accompanied by the necessary documents to prove your identity: 

  • Full name and address. 
  • Identification proving your identity (INE, valid Passport, Professional License, or if you are a foreign national, your valid immigration document). 
  • If the request is not made by the data subject, a document proving representation, such as a public instrument or power of attorney signed before two witnesses, along with the identification of the data subject and the legal representative (INE, valid Passport, Professional License, or valid immigration document if foreign). 
  • Clear and precise description of the personal data for which you seek to exercise any of the ARCO Rights, which right you wish to exercise, and the reasons for doing so. 
  • Any document or information proving that your personal data is in possession of VS&A. If requesting data rectification, the modifications to be made must be indicated and documentation supporting your request must be provided (birth certificate, proof of address, or any document that justifies the charge to be made to your personal data). 

VS&A will respond to your request via email or in person at the address indicated above, within 20 (twenty) business days from the acknowledgment of receipt. 

VS&A may request that you present the original documents submitted with your request for verification at the address described above, within 5 (five) business days of being requested. If you do not present the documents within this period, your request will be archived, and the Privacy Notice will remain in effect until a new request is submitted. 

VS&A may deny the exercise of ARCO Rights in the following cases: 

  • When you are not the owner of the personal data or have not proven representation of the owner.
  • When your personal data is not in VS&A’s database. 
  • When the rights of a third party are affected. 
  • When there is a legal impediment or a resolution from a competent authority that restricts your ARCO Rights. 
  • In case of cancellation, when personal data is processed for prevention or medical diagnosis or health service management. 
  • When rectification, cancellation, or opposition has already been previously conducted. 

Transfer of Personal Data 

VS&A may use and transfer your Personal Data when it is necessary to complete a transaction with you or to conduct something you have requested. To fulfill the purposes described in this Privacy Notice. In no case will your personal data be transferred to unrelated third parties without prior consent, except in cases expressly permitted by law, including requests from the competent authority. 

Security Measures Implemented 

VS&A has implemented physical, administrative, and technical security measures to protect your personal data and prevent its loss, alteration, unauthorized access, or disclosure. These measures include access controls, antivirus protection, and intrusion protection systems. 

Personal data is safeguarded in databases and computer equipment that have the necessary security to prevent information leaks. Physical and logical access controls, environmental controls, intrusion protections systems (IPS, Firewall), antivirus protection tools, and web filtering are some of the tools used to maintain data security in information systems. 

The IT security tools mentioned in the previous paragraph are supported by an internal information security policy that explains to employees the security considerations they must consider when using a computer system and are constantly reinforced. 

Use of Images and Sound Collected Through Our Internal Video Surveillance Systems 

For the security and protection of our administrative facilities and operational branch, as well as of the people who work inside them and of the people who visit us from time to time and for analogous or compatible purposes with those ends, we may capture images and, in some cases, sounds considered personal data, through our internal monitoring and video recording systems, which will be processed and protected by VS&A under the terms provided in this Privacy Notice. 

Modifications to the Privacy Notice

This Privacy Notice may be modified and/or updated for distinct reasons, including legal ones. Therefore, VS&A will make the updated version available to the public at its offices or on its website. 

Right to Promote Procedures for the Protection of Rights 

In case you consider that your rights have been violated in relation to the processing of your personal data, you may file a complaint with Transparencia para el Pueblo (Secretariat of Anti-Corruption and Good Government), the guarantor body in matters of personal data protection.

Consent 

By providing your personal data, you give your express consent for its processing according to the purposes established in this Privacy Notice. Said consent must be free, specific, and informed, and may be revoked at any time without retroactive effects that harm the data subject. 

Cordially,

VS&A

Last update on 10/10/2025 (October tenth, 2025)