Privacy Notice – Clients

COMPREHENSIVE PRIVACY NOTICE for Clients
Last updated: June 2024.

Identification of the Data Controller and their Contact Details

González Calvillo, S.C. (indistinctly “we” or the “Data Controller”), also known as Pérez-Llorca-Gonzalez Calvillo, with address at Calle Montes Urales 632, Piso 3, Colonia Lomas de Chapultepec, Miguel Hidalgo, C.P. 11000, Mexico City, Mexico, and with a website address of www.perezllorca.com/en-mx/ is responsible for processing the personal data that you provide us with and that we collect from you, which we will protect in accordance with the provisions of the Federal Law on the Protection of Personal Data Held by Individuals, its Regulation and other applicable legislation.

For the purposes of this Privacy Notice, the “Pérez-Llorca Group” means the group made up of (i) Pérez-Llorca Abogados, S.L.P., (ii) Gonzalez Calvillo, S.C., and (iii) the dependent companies/subsidiaries within the scope of consolidation of Pérez-Llorca Abogados, S.L.P.

What personal data do we collect?

For the purposes described in this Privacy Notice, we may collect the following categories of personal data relating to you (interchangeably, “You” or the “Client”) and which are necessary for the purposes that form the basis of the legal relationship between the Controller and the Client:

• Identification and contact details;
• Unique Population Registry Code (CURP);
• Federal Taxpayer Registry (RFC number), foreign tax identification number or other tax information (such as a proof of tax situation document or a proof of tax residency document);
• Identification-related responses contained in Know Your Customer (KYC) questionnaires; and
• Financial and equity information.

Please note that we will not collect or process sensitive personal data.

What do we use your personal information for?

We will process the personal data we collect for the following purposes:

Primary and necessary purposes for the existence, maintenance and fulfilment of the legal relationship between the Data Controller and the Client:

1. responding to requests for quotes for the provision of services;
2. providing the services contracted by the Client;
3. maintaining, developing, controlling and executing the professional relationship that, within the framework of the provision of services, the Client has with the Data Controller;
4. creating, uploading and updating a profile in the Pérez-Llorca Group’s database;
5. carrying out collection, invoicing, administration and other activities related to the relationship with the Data Controller;
6. creating databases to improve Client service;
7. generating statistics, preparing reports, etc. necessary for the Pérez-Llorca Group’s internal operations;
8. managing, controlling, administrating and updating the communication between the Data Controller and the Client;
9. complying with the legal and ethical obligations derived from the activities of the Data Controller and the Client, such as those derived from the requirements of competent authorities, the regulations for the prevention of money laundering and the financing of terrorism, verifying the Client’s identity and carrying out background checks against national and international sanctions lists, and activities related to compliance and due diligence; and
10. collecting, structuring, storing, consulting, collating, modifying, extracting, interconnecting, limiting, destroying and/or communicating personal data.

Secondary purposes:

1. offering additional services provided by the Pérez-Llorca Group;
2. sending, directly or through third parties, newsletters, legal briefings, communications regarding events, news or current issues;
3. conducting surveys to measure the satisfaction and/or quality of the services;
4. communications for advertising purposes, actions to promote the Pérez-Llorca brand, as well as commercial prospecting actions; and
5. academic purposes or for the dissemination of legal knowledge.

If you do not wish your personal data to be processed for any of the secondary purposes described above, you can send us an e-mail to dpo@perezllorca.com, indicating that you do not wish your data to be processed for whichever of the secondary purposes that you desire.

Personal data will be processed for one year. If this year passes without a reply from the potential client, the data may be blocked for a period of up to ten years in order to meet any obligations that may arise from the processing described in this section. Following the expiry of this retention period, the personal data will be deleted.

In the event of a contractual relationship with the potential client, personal data may continue to be processed for the duration of the contractual relationship. At the end of this contractual relationship, personal data may be retained for a period of 10 years. At the end of this period, the personal data will be deleted

Who do we transfer your personal data to?

We may transfer your personal data within the national territory and abroad, in accordance with the following:

How can you access, rectify, cancel or oppose the processing of your personal data (ARCO rights)?

You can exercise your ARCO rights by submitting a free and duly signed letter addressed to the Data Protection Officer by email to dpo@perezllorca.com with the following details:

• Data subject’s name, address, telephone number and email address;
• A copy of the subject’s valid official identification (voter ID, passport, or military ID) and, if applicable, that of their representative;
• If you are acting as the data subject’s representative, a copy of the public instrument that contains your authority to act or a power of attorney signed by the data subject, their representative, and two witnesses;
• A clear and concise description of the data that you want to access, rectify, cancel, or oppose. If you need to rectify your personal data, please provide specific details of the requested modification and attach supporting documentation;
• Any information that will aid in locating your personal data.

You may obtain the personal data requested through electronic documents in conventional formats or by any other legitimate means that guarantees and accredits the effective exercise of the right requested.

The Data Protection Officer is responsible for responding to requests from data subjects to exercise their ARCO rights, and will do so within a maximum of twenty (20) working days from the receipt of the request, via the email address indicated by the data subject in said request.

If appropriate, the Data Protection Officer will comply with the request within fifteen (15) working days of the initial response to their request. It is understood that, after notifying the person who made the request, these time limits may be extended by up to a further twenty (20) working days if the circumstances so warrant.

If the information provided in the request is incorrect or insufficient, or if the relevant supporting documents are not provided, we may, within five (5) working days of receipt of the request, ask for the information or documents necessary to process it. Ten (10) working days will be given to respond to our request, starting from the day following the day it is received. Failure to respond within this time limit will be considered as a non-submission of the request.

If you wish to know more details about the procedure for exercising these ARCO Rights, you can send an e-mail to the Data Protection Officer at the abovementioned e-mail address.

How can you withdraw your consent to the processing of your personal data?

You may revoke any consent that you may have given us for processing your personal data by sending a duly signed letter addressed to the Data Protection Officer by email to dpo@perezllorca.com with the following details:

• Data subject’s name, address, telephone number and email address;
• A copy of the subject’s valid official identification (voter ID, passport, or military ID) and, if applicable, that of their representative;
• If you are acting as the data subject’s representative, a copy of the public instrument that contains your authority to act or a power of attorney signed by the data subject, their representative, and two witnesses;
• A clear and precise description of the personal data for which consent is to be withdrawn;
• Any information that will aid in locating your personal data.

The Data Protection Officer is responsible for responding to requests from data subjects and will do so within a maximum of twenty (20) working days from the receipt of the request, via the email address indicated by the data subject in said request.

If appropriate, the Data Protection Officer will comply with the request within fifteen (15) working days of the initial response to their request. It is understood that, after notifying the person who made the request, these time limits may be extended by up to a further twenty (20) working days if the circumstances so warrant.

If you wish to know more details about the procedure for exercising these rights, you can send an e-mail to the Data Protection Officer at the abovementioned e-mail address.

How can you limit the use or disclosure of your personal data?

You may limit the use or disclosure of your personal data to prevent it from being used or disclosed for purposes other than those which gave rise to, or are necessary for, your legal relationship with the Data Controller. If you wish to limit the use or disclosure of your personal data, you must send an email to dpo@perezllorca.com in order to be added to the internal opt-out list maintained by the Data Controller.

How do we protect your personal data?

The Data Controller has adopted the security levels of personal data protection legally required by current legislation, and has installed the administrative, physical and technical measures available to ensure the security of your personal data and prevent its destruction, loss, misuse, alteration, unauthorized access and theft. In determining these measures, criteria such as the risk inherent in the type of personal data, the sensitivity of the data, the possible consequences of a breach, the scope, context and purposes of the processing and technological developments have been taken into account.

If the Client considers that their right to the protection of personal data has been violated, they may file a complaint with the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (www.inai.org.mx).

How can you find out about changes to this Privacy Notice?

This Privacy Notice may be modified, changed or updated as a result of new legal requirements, our own needs for the services we offer, our privacy practices, or for other reasons.

If there is a change to this Privacy Notice, we will notify you via our website https://www.perezllorca.com/en-mx/ in the Privacy Notice section.