In accordance with the applicable federal legislation in force for the Protection of Personal Data in Possession of Individuals and, in particular, with the Federal Law for the Protection of Personal Data in Possession of Individuals published in the Official Gazette of the Federation on July 5, 2010 (hereinafter the "Law") and its Regulations published in the Official Gazette of the Federation on December 21, 2011 (hereinafter the "Regulations"), we ask you to read the Terms and Conditions contained in this document, since the simple delivery or transmission of your Personal Data or Sensitive Personal Data (hereinafter "Sensitive Data") constitutes your acceptance of the same: 
 

IDENTITY OF THE PERSON RESPONSIBLE FOR PROCESSING THE PERSONAL DATA. 

1. Ortiz & Ramírez Abogados, S.C., with fiscal domicile in Cerrada de Manzano 95, Colonia Florida, Álvaro Obregón, C.P. 01030, Ciudad de México, (hereinafter "O&R" or "Responsible"), shall be responsible for collecting Personal Data, including sensitive data, if required, from any third party that makes use of its services, whether obtained now or in the future by any of the means of collection provided in the following paragraph, and therefore, shall also protect such information confidentially.

O&R may obtain your Personal Data through any of the following ways: 

a. Personally, that is, when the Personal Data is obtained personally when You (in your capacity as "Data Subject") provide it to O&R or to the natural person designated by him/her, with the physical presence of both. 
b. Directly, that is, when you (Data Subject) provide them by any means that allows their direct delivery to O&R, among them, electronic, optical, sound, visual or any other technology, such as Internet or telephone, among others:

c. Indirectly, that is, when O&R obtains them without You (Data Subject) having provided them personally or directly, such as through a publicly available source or a transfer. 
 

2. The terms "Personal Data" and "Sensitive Data" shall have the meaning defined in Article 3 of the Law; notwithstanding the foregoing, by way of illustration but not limitation, it is specified that: 
Personal Data means identification and contact data; migratory, academic and/or labor data, as well as your patrimonial and/or financial data or information.
Sensitive Data means data related to your personal characteristics and/or physical conditions; your health status, including your medical history (both diseases, visual problems, as well as current or previous ailments); your biometric data; your hobbies and/or if you have any current or previous addiction; sexual preference and/or religious belief you profess; your ideological data, ethnic origin and/or union and/or political affiliation. 
Now, it is specified that in the event that you provide the Responsible Party with the Personal Data of third parties derived from personal references and/or employment references, you must inform such third parties about the transfer and purpose of their personal data. 

PURPOSES AND TREATMENT OF PERSONAL DATA. 
 

3. The Personal Data and/or Sensitive Data that You may provide to the Responsible will have the treatment and purpose, including but not limited to, as described below: 

a. Main purposes: 
- Verify, confirm and validate your Identity; 
- Access, use, handle, store or dispose of your Personal Data, especially to identify you, locate you, communicate with you, contact you, send you information; 
- It is agreed that You accept the transfer, that is to say, the transmission and disclosure, that the Responsible Party may make to third parties by any means permitted by law for the purpose of having an adequate provision of services or for any purpose for which the Responsible Party is contacted; as well as for the purpose of corporate or fiscal audits of the Responsible Party. 
b. Secondary purposes: 
- You authorize the use of your Personal Data for marketing, advertising and/or commercial prospecting purposes exclusively carried out by O&R.

It will be understood that the Data Subject tacitly consents to the processing of his/her Personal Data, when having made this Privacy Notice available to him/her, he/she does not express his/her opposition by any of the means indicated in this Privacy Notice, as well as the Law and/or its Regulations. 
The use and handling of Personal Data and Sensitive Data will be directly related to the contractual relationship you have with O&R as a user of its services, which will run from the date on which you provided them to the Responsible Party and of course you may object at any time you deem appropriate. 

4. In the collection of Personal Data, O&R follows all the principles set forth in article 6 of the Law: legality, consent, information, quality, purpose, loyalty, proportionality and responsibility. 

5. O&R declares that it will keep your personal data for the duration of the provision of services or in accordance with the provisions of the applicable legislation on the Protection of Personal Data in Mexico.
 

TRANSFER OF PERSONAL DATA. 

6. Your Personal Data will not be disclosed or shared with third parties for a use other than that indicated in point 3 above, except in the following cases, in which case it may be transferred without the need for your consent, in terms of Article 37 of the Law a:
i. The parent company(ies), affiliate(s) and/or subsidiary(ies) of O&R at national or international level, regarding any communication between them; compliance with information and transparency obligations and/or performance of corporate audits, among others, in which case, the Data Subject expressly states his/her consent to the Responsible Party to carry out such transfer if necessary.
ii. Third party service providers, by virtue of the fulfillment of contractual obligations with O&R in which such third parties participate in the execution of the services performed by the former; attend and ensure compliance with judicial or administrative requirements issued by competent authorities derived from the services rendered to O&R, among others.
iii. Law firms for any other type of litigation, so that in the name or on behalf of O&R, they may manage legal proceedings in case of breach of contract by the Holder or because of the obligations arising from the legal relationship between O&R and the Holder.
iv. Public agencies or competent authorities, whether federal, state or municipal; as well as for compliance with information and transparency obligations; compliance with judicial or administrative requirements issued by competent authorities, among others.
v. Bodies, entities or authorities abroad, for the purpose of complying with requirements or requests with effects in Mexican territory or enforceable under International Treaties to which Mexico is a party. 
vi. In the delivery of information to the Data Subject, when exercising any of their ARCO rights.
vii. When there is a change in this Privacy Notice.
In any of such cases, O&R will ensure that such third parties, processors and any entity receiving the Personal Data, assume the same obligations and/or responsibilities that correspond to O&R in terms of privacy of Personal Data and that they comply with the provisions of this Privacy Notice, the Law and/or its Regulations.
The Data Subject who generates any request to enter into a legal relationship with O&R in terms of this Privacy Notice, accepts the transfer of his/her Personal Data, as described herein.
 

PROTECTION AND CONSERVATION OF PERSONAL DATA.

7. Once You provide the Responsible Party with your Personal Data or Sensitive Data, they will be stored in different secure media, whose access will be limited only to those individuals and/or legal entities that are strictly necessary. The Responsible Party will have the security measures it deems appropriate to protect the use of your Personal Data and/or Sensitive Data by unauthorized third parties.  In case of requirement of any authority, the Personal Data and/or Sensitive Data may be made available to such authority, in strict compliance with the Law and/or its Regulations. 
 

PROCEDURE FOR REQUESTING OR EXERCISING YOUR ARCO RIGHTS. 

8. You will have at all times access to your Personal Data and/or Sensitive Data to exercise any of your ARCO rights (access, rectification, cancellation and/or opposition) and may request the rectification, cancellation or opposition of the same either in writing or electronically, including via email or telephone, by sending your message to Ortiz & Ramírez Abogados, S.C. at the following address: Cerrada de Manzano 95, Colonia Florida, Alvaro Obregon, C.P. 01030, Ciudad de México or email address: informes@oyr.com.mx, to the attention of the person in charge of Personal Data, or to the telephone number 55 5524 5041, on business days and hours, meaning, from Monday to Friday, from 08:00 to 18:00 hours. 

For this purpose and considering that the exercise of each of your ARCO rights is i) independent of each other, that is, it is not necessary to exhaust one to exercise any of the other three, and ii) it is a very personal right, so you, in your capacity as Data Subject or, where appropriate, your representative, may request it considering the following: 

I. Submit the Application to the Responsible, in terms of the first paragraph of this point, with the following: General information:
- Name of the Data Subject of the Personal Data and/or Sensitive Data.
- Documents proving the identity of the Holder.
- If applicable, name of the Holder's representative and documents to prove his/her identity and personality. - Address or any other means to receive notifications.
- Clear and precise description of the Personal Data and/or Sensitive Data that you wish to rectify, cancel or oppose to its processing.
- Description of the right to be exercised or what the Data Subject is requesting.
- If applicable, documents or information that facilitate the location of the Personal Data and/or Sensitive Data, including the area responsible for the processing.
Specific information: In addition to the general information listed above, depending on the right you wish to exercise, you must include the following information in the Request:
- Right of Access: Specify the way in which you prefer the requested Personal Data and/or Sensitive Data to be reproduced.
- Right of Rectification: Specify the modalities you request to be made to the Personal Data and/or Sensitive Data, as well as provide the documents supporting your Request.
- Right of Cancellation: Specify the Data Subject's data to be cancelled and the causes that motivate the request to have the data deleted from the files, records or databases of the Data Responsible Party.
- Right of Opposition: Specify the causes or situation that lead you to request that the processing of your Personal Data and/or Sensitive Data be terminated, as well as the damage or harm that would be caused to you if such processing were to continue, or you must indicate the specific purposes for which you wish to exercise this right.
II.   To prove the identity of the Data Subject and, if applicable, that of his representative, as well as the personality of the latter, i.e., you must attach a simple copy of your official identification as Data Subject of the Personal Data and/or Sensitive Data, as well as that of your representative, in case the latter is the one who submits the Request.  For this purpose, you must attach a simple copy of your official identification, as well as that of your representative, in case he/she is the one submitting the Request.
O&R will notify you within 20 (twenty) business days from the date it receives your Request of the determination made. If your Request is granted, it will be effective within 15 (fifteen) business days from the date O&R has informed you of the granting of your Request. 
In the event that the information provided in your Request is insufficient or erroneous or has not been accompanied by the necessary documents to prove your identity or the identity of your representative, O&R, within 5 (five) business days from the date of receipt of your Request, will require you to correct such deficiency(ies) in order to process the same (prevention). In this case, you will have 10 (ten) business days to address such prevention, counted from the day after you have received the same. Your Request will be considered as not submitted if You do not respond within such term.
It is specified that the use of electronic means for the exercise of your ARCO rights authorizes O&R to respond to the corresponding Request through the same means, unless you or your representative clearly and expressly indicate in your Request another means.
You may obtain the Personal Data(s) and/or Sensitive Data(s) requested through simple copies, electronic documents in formats (e.g. word, PDF, excel, among others), or through any legitimate means allowed by the Law and/or its Regulations that guarantee and accredit the effective exercise of the right requested to O&R, when applicable.

9. Taking into consideration that it is important for O&R to keep your Personal Data and/or Sensitive Data updated, as indicated in this Privacy Notice, in order to guarantee the veracity, validity and accuracy of such data, you are requested to inform O&R at all times of any change in such data.
 

MODIFICATION OR UPDATING OF THIS PRIVACY NOTICE. 

10. In the event that the Responsible Party requires to use your Personal Data and/or Sensitive Data for purposes other than those indicated in this Privacy Notice, it will contact you either in writing, by telephone, electronically, or by any optical, sound, visual or other means that technology allows now or in the future and will explain the new uses it intends to give to such information in order to obtain your authorization, either through your autograph signature, electronic signature, or any authentication mechanism established for such purpose.

11. O&R reserves the right to change this Privacy Notice at any time, which will be communicated to you in any of the following ways: (a) by sending you an e-mail to the account registered in its systems or to the account that you indicate to us from time to time and/or (b) by posting a visible notice within our facilities or via e-mail and/or (c) on our web site: https://www.oyr.com.mx/.
We will not be liable if You do not receive notice of a change in the Privacy Notice if there is a problem with Your e-mail account or Internet data transmission or if You did not promptly notify the Responsible Party in writing of the change in Your e-mail account.
 

SENSITIVE DATA.

12. In order to comply with the purposes set forth in this Privacy Notice, Sensitive Data may also be collected and processed, in terms of the provisions of point 2 of this Privacy Notice, in which case, O&R undertakes that such data will be processed under the strictest security measures to ensure its confidentiality.
In accordance with the provisions of article 9 of the Law and paragraph III of article 15 of the Regulation, we require your express consent for the processing of your Sensitive Data, so we ask you to indicate whether or not you accept the processing.
I consent to the processing of my Sensitive Data in accordance with the terms and conditions of this Privacy Notice.

Name and signature of the Holder:
13. If you have any questions, concerns or comments regarding this Privacy Notice, please contact person indicated in point 8 above or, if you choose, write to us at our fiscal address: Cerrada de Manzano 95,  Colonia Florida, Alvaro Obregon, C.P. 01030, Ciudad de México.