In compliance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties, its Regulations, and the Guidelines of the Privacy Notice, CLA MX PS, S.C., (the “Controller”), with address at Arteaga 57, Colonia Center, c.p. 76000 Santiago de Querétaro, Qro, places this Privacy Notice (the “Notice”) is responsible for collecting the information provided by the owners of personal data for the services that this company offers to the general public. This information will be treated strictly confidentially, as well as the use and protection given to it, and to comply with the above, it is made available to any natural person (the “Owner”) concerning whom it processes personal data. This privacy notice may be consulted on the website https://www.claglobal.mx and/or at the above address.

I. PURPOSES.

The Controller may process the personal data of the Owner for the following purposes:

a) Clients: (i) Keep a record of the people who wish to enter the CLA MX PS, S.C. offices as visitors, confirming their identity, the reason for their visit and verifying the information provided; (ii) collect information from people who fill out the forms on our website; (iii) receive visitors and direct them appropriately to the indicated person when registering at the reception of the CLA MX PS, S.C offices; (iv) guarantee the safety of all people in the offices of CLA MX PS, S.C. and the facilities, based on the aforementioned visitor registry; (v) provide the services required by the Owner; (vi) fulfill the obligations contracted with or by the Owner; (vii) integrate a file as a client; (viii) report news and developments; (ix) provide information related to billing, account statements and collections; (x) to carry out surveys that allow us to know the quality of the services provided; (xi) in general for the due fulfillment of the services contracted between the Owner and the Controller.

b) Employees: (i) Carry out the personnel selection and recruitment process; (ii) Integrate the employment record of the Owner in case of hiring; and (iii) comply with the benefits and obligations derived from the employment relationship with the Owner.

In cases where the Controller intends to process personal data for a purpose other than those contained in this Privacy Notice, the Controller undertakes to inform the Owner and obtain their consent for the new processing.

II. PERSONAL INFORMATION.

The Controller may collect the following personal data from the Owner:

a) Clients:

● Identification / Contact / Property / Financial: name, address, email, telephone number, cell phone number, bank account numbers, handwritten signature, and Federal Taxpayer Registry (RFC).

b) Employees:

● Identification / Contact / Academic / Labor / Property / Financial: name, address, email, telephone number, cell phone number, handwritten signature, Federal Taxpayer Registry (RFC), Unique Population Registry Code (CURP), level of studies, title, professional license, position, employment references, social security number, loans contracted with government entities (INFONAVIT or FONACOT) and bank account number.

Personal property or financial data of the owner will be collected only when necessary to comply with the obligations derived from the relationship that the Owner maintains with the Controller.

The Controller states that it does not collect sensitive personal data from the Owner for the purposes indicated in this Notice.

III. CONSENT.

The consent of the Owner for the processing of their personal data under the terms of this Notice is understood to be granted when the Owner: (i) does not express any opposition once this Notice has been made available to him; (ii) expressly states it; and/or (iii) has a current relationship with the Controller.

IV. TRANSFERS.

The Controller states that the Owner’s personal data will not be transferred to third parties in any case unless the transfer is necessary for the fulfillment of the obligations derived from the legal relationship that he maintains with the Owner or one of the exceptions provided for by article 37 of the Federal Law on Protection of Personal Data Held by Private Parties is updated.

If the Owner does not agree to any transfers mentioned above, please inform us at [email protected].

V. RIGHTS OF THE OWNER.

The Owner has the right to (i) access their personal data and know the treatment given to them; (ii) rectify your personal data in cases where the information is inaccurate or incomplete; (iii) cancel your personal data when it is not required to carry out the purposes indicated in the Notice; has been used in violation of the provisions of the Notice; and/or the relationship for which they were collected has ended; (iv) oppose the processing of your personal data for specific purposes; (v) revoke his consent to the processing of his personal data; and (vi) limit the use or disclosure of your personal data.

To assert any of the rights indicated in the previous paragraph, the Owner must submit a written request to the address of the Responsible Party or to the following email address [email protected], which must contain: (i) name and address of the Owner: (ii) document that proves the identity of the Owner or the documents that prove his representation; (iii) a clear and precise description of the personal data concerning which he seeks to exercise any of the rights indicated in the previous paragraph; as well as, (iv) any other element that facilitates the identification of personal data, and, where appropriate, display the documentation that supports the origin of the corrections requested.

The Owner’s request will be attended to by the personal data protection department of the Controller, which must respond within 15 (fifteen) business days from the date of submission of the request, and this period may be extended by 10. (ten) additional days upon notification. The response will be sent to the address or email indicated by the Owner. In cases where the Owner exercises his right to access information, the Controller will comply by making personal data available to the Owner, issuing simple copies, electronic documents, or any other means allowing the Owner to access his personal data.

In addition to the above, in the case of requesting: (i) rectification, you must also indicate the modifications to be made and provide the necessary official documentation to support your request; (ii) the cancellation, must express the causes that motivate the elimination; and (iii) in the right of opposition you must indicate the reasons that justify the termination of the processing of personal data.

V.I MODIFICATIONS.

The Controller reserves the right to modify and/or update the Notice at any time in response to new legislative provisions and internal policies, which will be available at the Controller’s address.