This Appendix constitutes the Privacy Notice under the terms of the Federal Law on the Protection of Personal Data Held by Third Parties (the “LFPD”) and all requirements deriving or related to it. The present Privacy Notice has the following terms and conditions:
"Personal Information" has the meaning used in the LFPD.
"ARCO Rights" means the right of each user to access, rectify, cancel or oppose the use of their personal information, in accordance with the LFPD and subject to the exceptions established therein and in this Privacy Notice, as described below:
RIGHT OF ACCESS: This right of each User to know what personal information is held by the Administrator or their representatives, who this information has been shared with and to what end.
RIGHT OF RECTIFICATION: Each User has the right to rectify their personal information when it is inexact or incomplete.
RIGHT OF CANCELLATION: Each User has the right, at all times, to request that their personal information be deleted, which will occur at the expiration of a period in which their personal information is blocked. This block implies the identification and conservation of their personal information, once the use for which it was collected has been fulfilled, and has the purpose of identifying possible responsibilities involved in its treatment up until the contractual or legal limitation. Their personal information will not be handled during this period and will be deleted from the corresponding databases once this period has expired. Once the corresponding information has been deleted, the Administrator will notify the User. In the event that their personal information had been delivered to third parties prior to the date of the notification of rectification or cancellation, the Administrator will inform said third parties of the rectification or cancellation so they can carry it out.
RIGHT OF OPPOSITION: The User has, at all times, the right to request, provided they have just cause, that the Administrator stop handling their personal information.
"Administrator" means the person or party who receives the User’s personal information.
"User" means the person or party to whom the personal information corresponds, or the representative authorized to deliver their personal information to a third party, in accordance with all applicable laws, and who delivers said personal information to the Administrator.
This consent may be revoked by the User at any time, which does not have retroactive effects, under the terms and according to the procedures established below.
Notwithstanding any of the terms of this Privacy Notice, each User acknowledges that their consent is not required for the handling of their personal information by the corresponding Administrator or third party in any of the cases indicated in Article 10 (ten) of the LFPD.
The Administrator will collect and handle the personal information of the User, that is, that information that can identify them: their first name and name; their date of birth; their address, whether personal, work or fiscal; their email address, whether personal or work; their social media handles; their phone number, whether home or work; their cell phone number; their credit card number; their Taxpayer Identification Number (RFC); their Population Registry Code (CURP); their Mexican Social Security Institute (IMSS) number; and their consumer and web browsing preferences. The collection of personal information may be carried out when the User visits the Administrator’s points of sale or those of their affiliates or authorized distributors; communicates with the Administrator or their representatives (including customer service centers) by telephone, email and/or text message (SMS); visits their websites and voluntarily provides information through the site’s dialogue boxes or through the use of automatic data capture methods; or by directly providing information to the administrator. These tools allow information to be sent to a website through the browser, such as the type of browser used, the User’s language, the access time, the IP address and the websites used to access the site of the Administrator or their affiliates or representatives.
The Administrator may also collect personal information from publicly available sources and other sources available on the market to which the User has given their consent to share their personal information, or to which they have provided anonymous geographical information associated with a determined geographic area.
The personal information of each User is collected and handled by the Administrator or their representatives to allow the User to carry out the following activities, whether in person, by phone or fax, printed forms, web-based forms or email:
The Administrator, whether directly or through their representatives, may also use the User’s personal information for the following purposes:
For the purposes established in this section, but subject to the terms of its last paragraph, the Administrator must inform each User that, with the goal of being able to deliver products, services and solutions to their clients, consumers, employees, suppliers and other users of their services, they and/or their representatives or affiliates have signed or will sign a variety of commercial agreements with providers of products and services, both foreign and domestic, to supply, among other services, landline telephone service, long distance telephone service, Internet, television, cell phone service and other telecommunication services. The authorization granted by each User, in accordance with this section, allows the Administrator and/or their representatives to transmit their personal information to these suppliers on the understanding that they are contractually obliged to maintain the confidentiality of the personal information provided by the Administrator and/or their representatives and to obey the terms of this Privacy Notice. The Administrator and/or their representatives may transfer the User’s personal information to their parent or controlling company, as well as the subsidiaries or affiliates under their control or any other company in the same corporate group, whether foreign or domestic, that operates with the same internal policies and procedures. They may also transfer this personal information to third parties that assist it in fulfilling its contractual or legal obligations towards the User.
Nevertheless, under the terms of this section and the Privacy Notice as a whole, the User acknowledges and accepts that the Administrator does not require their authorization nor their confirmation to transfer their personal information, domestically or abroad, in the cases established in Article 37 (thirty-seven) of the LFPD, or in any other exceptional case mentioned in the LFPD or other applicable legislation.
6. Department of Personal Information / Privacy Office; Management. The Administrator will make the Department of Personal Information / Privacy Office available to each User in order to receive, register and respond to their requests to exercise their ARCO rights, as well as their right to limit the use or transfer of their personal information, and all other rights mentioned in the LFPD.