Privacy Notice

“BANDALA, DÍAZ, MURCIO Y ASOCIADOS, S.C. and BANDALA + DGTL, S.C., commercially known as BANDALA (hereinafter BANDALA), located at Río Becerra 27, Piso 4, Oficina 404, Escandón I Sección, Benito Juárez, 03810, Mexico City, with telephone numbers 55 70 30 01 00 and 55 45 15 12 81; whose main purpose is to provide advisory, consulting, representation, defense and, in general, professional support services in legal, tax, accounting, financial and/or administrative matters to promote the growth of the businesses of its Clients or prospects, who may be individuals or legal entities, holders of personal data and confidential information (hereinafter referred to as the “Holders”).

By virtue of the foregoing, BANDALA is committed to the processing, transfer, control and use of the Personal Data and Confidential Information of the Data Subjects that, together, generate a database (hereinafter Personal Data) and that are provided to BANDALA through its official website https://bandala.mx/; application called BAsica https://app.basica.online/#/login/signin; Instagram with user @bandaladiazmurcio; Facebook with user @BandalaDiazMurcio; Twitter with user @bandalaabogados; Linkedin https://mx.linkedin.com/company/bandaladiazmurcio or; if applicable, through any other means of BANDALA (hereinafter Digital Media).

For this purpose, this Privacy Notice is made available to you, with the purpose of protecting the Personal Data in possession of BANDALA and to regulate the legitimate treatment of the same, in order to guarantee the right to privacy and the right to informative self-determination that corresponds to the Holder due to the entry into force of the Federal Law for the Protection of Personal Data in Possession of Private Parties (hereinafter Law) and its Regulations (hereinafter Regulations).

PURPOSE OF THE PRIVACY NOTICE

This Privacy Notice is made available to the Data Subject, prior to the processing of his Personal Data (any information concerning an identified or identifiable individual, as well as a legal entity, through its representative), in order for him to know how BANDALA protects, controls, uses, transfers, stores and processes the Personal Data in its possession, stores and treats the Personal Data in its possession, likewise, its purpose is that the Holder knows the rights that are available to him/her and how he/she can exercise them, in case he/she considers that he/she had a grievance due to the protection, control, use, transfer, storage and improper treatment of his/her Personal Data. In the absence of opposition by the Data Subject to the processing of his/her Personal Data, as provided in this Privacy Notice, it is understood that the Data Subject grants his/her consent for BANDALA to use his/her Personal Data in accordance with the terms and conditions set forth in this Privacy Notice and in the duly signed contracts or agreements between the parties.

Likewise, in compliance with the provisions of articles 12, 13, 15, 16, 17 and other related articles of the Law, the Data Subject is hereby informed that his/her Personal Data will be collected and processed in a lawful manner, based on the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility, as provided in the Law and its Regulations, as well as in other applicable regulations and in accordance with the following:

PURPOSES OF THE PROCESSING OF PERSONAL DATA

The Personal Data that BANDALA collects from the Data Subject are to fulfill the following Purposes:

a) Main Purposes: BANDALA uses Personal Data for various purposes, depending on the particular circumstances in which they are collected, always in accordance with the relationship that exists with the Data Subject; including, but not limited to, the following cases:

When the Holder visits BANDALA’s facilities:

– Control of access to the building belonging to a third party, as well as access to our offices.
– Maintain security in our facilities.
– Verify your identity.

When you contact BANDALA:

– To answer your questions and comments.
– Provide consulting or advisory services.
– Establish a legal relationship.
– Maintain contact with the Holder.
– Establish contact with the Holder and consider him/her as a prospect or Client.

When you register as a BAsica user:

– Access to the profile and site features developed exclusively for users.
– Customize the functions of your user account.
– Send you an email or message confirming your registration.
– Share the status and progress of your projects.

In general:

– Mainly, BANDALA collects Personal Data for the proper provision of the services for which it was hired.

– The Personal Data that BANDALA collects are used, stored and processed to process requests made by the Holder, regarding the services offered by BANDALA, to eventually be subject to a contractual relationship; to resolve queries, complaints or claims; so that the Holder is aware of the status of the contracted services, which may be through BAsica; to use them for statistical purposes, to offer, improve and promote products and services, as well as to send information of interest to the Holder, all of the above purposes are essential for the conclusion of the Contractual Legal Relationship for the provision of services by BANDALA.
– To safeguard the public interest or for the procurement or administration of justice.
– For the recognition, exercise or defense of a right in a judicial proceeding, as well as in cases specifically permitted by law.
– Respond to your comments, inquiries and/or provide you with the information you request.
– Protect or defend the rights and property of BANDALA, as well as its confidential information.
– Maintain the security of our Digital Media, our users and/or customers.

b) Secondary Purposes: The Personal Data that BANDALA collects may be used for BANDALA’s own commercial purposes, to send you our newsletters or, as the case may be, to update our services and; in general; to send you information of your interest. In BANDALA’s program of notification of promotions, offers, circulars and services through e-mail; this type of advertising is done through notices and promotional messages, which will only be sent to the Holder and to those contacts registered for such purpose.
In case the Data Subject wishes that his/her Personal Data not be processed for Secondary Purposes, from this moment on, he/she may communicate to BANDALA his/her opposition to the above, at the reception of BANDALA’s domicile and/or to the e-mail compliance@bandala.mx with the subject “Refusal Secondary Purposes”, addressed to the person in charge of Personal Data Protection of BANDALA.
PERSONAL DATA COLLECTED AND WHERE IT IS COLLECTED FROM

Personal Data

For the purposes stated in this Privacy Notice, we may collect the following Personal Data from the Data Subject through BANDALA’s Digital Media:

1. Identification Data: Name, Corporate Name or Corporate Name, Image, Trademark, Gender, Home Address, Occupation, Marital Status, Place and Date of Birth or Incorporation, Nationality, Age, Official Identification, Autographic Signature, Federal Taxpayers Registry Number (RFC), Unique Population Registry Number (CURP); as well as Official Identification, Articles of Incorporation, Powers of Attorney, Amendments to the Articles of Incorporation, Assembly Minutes, Lawsuits, Contracts, Agreements, Financial Statements, Account Statements, Registration of Trademarks and Patents and, in general, documentation and information that BANDALA’s internal specialists require for the beginning of the rendering of Professional Services in favor of the Holders.

2. Contact Information: Home Address; E-mail Address; Telephone Number; Phone Number; Mobile Phone Number; Fax.

3. Fiscal or Invoicing Data: Name of the Individual or Legal Entity to be invoiced; Name of the Individual or Legal Entity that will issue the Invoice or Receipt; Fiscal Address; Federal Taxpayers Registry (RFC); Name of the Banking Institution; Bank Account Number and Interbank CLABE Number; Amounts to be Paid; Forms of Payment; Advanced Electronic Signature and Fiscal Address.

4. Financial and Banking Data: Bank Account Information; Payment Method; Name of Bank; Branch Number; Bank Account Number and Interbank CLABE Number.

The information provided by the Holder must be truthful and complete. The Holder will be responsible, at all times, for the Personal Data provided and, in no case, BANDALA will be responsible for the veracity of the same.

The Data Subject declares to voluntarily provide his/her Personal Data to BANDALA, either in writing, verbally or electronically; through direct access to the Digital Media, filling out surveys, forms, requirements, forms, Know your customer (KYC) of BANDALA, sending electronic files or of any other nature, including, direct delivery of information, access to the Digital Media or that of its affiliates (where reference is made to this Privacy Notice), telephone calls, requests by e-mail, seminars, congresses, events or conferences.
EXCLUDED PERSONAL DATA AND SENSITIVE PERSONAL DATA

BANDALA Digital Media may include links to third-party websites, digital applications or web pages. If you access such links, you will leave BANDALA Digital Media, and BANDALA assumes no responsibility or liability in connection with such third-party websites, digital applications or web pages. Likewise, if the Registrant posts, comments or shares personal information, including photographs, in any public forum, social network, blog or other media, he/she should be aware that any personal information he/she posts may be read, viewed, collected or used by other users of such forums, websites, digital applications or third party web pages, and could be used to contact him/her, send him/her unsolicited messages or calls or for purposes that neither he/she nor BANDALA can control. BANDALA is not responsible for the personal information you choose to submit on these forums or third party websites, digital applications or web pages.

The category of personal data mentioned below is considered as Sensitive Data; which affects the most intimate sphere of the Data Subject, whose improper use may give rise to discrimination, which entails a serious risk for the Data Subject; the foregoing, in terms of Article 3, Section VI of the Law:

1. Origin or Ideological Data: Racial or ethnic origin, race; Religious, philosophical and moral beliefs or convictions; Political positions; Political affiliation; Union affiliation.

2. Health Data: Physical or Mental Health Status, present or future; Illnesses; Medical Disabilities; Genetic Information; Consumption of Toxic or Narcotic Substances; Consumption of Medications; Medical Justifications.

3. Data on physical or personal preferences or characteristics: Skin Color; Hair Color; Distinguishing Marks; Height; Complexion; Sexual Preference or Orientation; Social, Family, Emotional, Sports Behavioral Data.

4. Biometric Data: Fingerprint.

The Holder declares under oath that he/she has not provided and in no case will provide BANDALA with the aforementioned Sensitive Personal Data, that is to say, those intimate personal data or whose due or improper use may give rise to discrimination or entail a serious risk for the Holder.

BANDALA is a Firm committed to the confidentiality and privacy of minors and incapable persons; therefore, it does not intentionally collect or process personal data of minors and incapable persons without the express consent of their parents, guardians or legal representatives. If the Holder is the father, mother, guardian or legal representative of a minor or incapacitated person and has provided Personal Data to BANDALA, he/she may request that such Personal Data be cancelled by sending an e-mail to compliance@bandala.mx, with the subject “Cancellation of Minors and Incapacitated Persons”, addressed to the person in charge of Personal Data Protection at BANDALA.

TRANSFER OF PERSONAL DATA

BAsica is a free and freely accessible technological tool for internal and external stakeholders of BANDALA, through which the Holder can navigate easily and quickly, in any of their electronic devices, 24 hours a day, 7 days a week, 365 days a year; it was designed and structured so that customers, employees, partners, associates, advisors, coordinators, managers, officers, committee members and other users of our Digital Media, know the progress of the projects of each account. BAsica is owned by BANDALA and contracted a third party supplier for the development of BAsica with the latest technology; the maintenance of which depends on this third party company, which is not part of BANDALA. Due to the foregoing, BANDALA informs the Data Subject that the Personal Data and Confidential Information provided to the Digital Media will be immediately transferred to such third party provider company, its subsidiaries and affiliates, who are obliged to comply with the provisions of this Privacy Notice, the Law and its Regulations.

We contract with third party service providers to perform functions and services for the proper administration of Digital Media, for which reason, we share Personal Data with such service providers subject to confidentiality obligations consistent with this Privacy Notice and any other applicable confidentiality and security measures, as well as on the condition that the third party service providers use, solely and exclusively, the personal data to provide higher quality Digital Media.

Additionally, BANDALA may transfer the Personal Data to its controlling companies, subsidiaries or affiliates under the common control of BANDALA, or to a parent company or to any company of the same group of BANDALA that operates under the same processes and internal policies, as well as when the transfer is necessary by virtue of a contract entered into or to be entered into with BANDALA in the interest of the Data Subject, to third parties with which it maintains a legal relationship, authorities, notaries public, public agencies or any other for the proper provision of the services for which it was contracted and for the conclusion of any project of any account of the Clients, specifically in order to comply with the purposes described in this Privacy Notice.

Regardless of the above, BANDALA declares that it will not transfer any information of the Data Subject to national or foreign third parties, otherwise, the Data Subject will be informed by means of the publication of a new Privacy Notice and to which the Data Subject has expressed his/her consent. The foregoing in accordance with the provisions of Article 36 of the Regulations of the Law, however, BANDALA will only share the Personal Data of the Data Subject when it has been required by court order to comply with the procedural provisions. BANDALA may also transfer the Personal Data of the Data Controllers in the cases specifically provided for in the Law.

SECURITY MEASURES IN PLACE TO LIMIT THE USE OR DISCLOSURE OF PERSONAL DATA

BANDALA adopts practices as a Socially Responsible Firm and has a Corporate Governance that allows it to implement internal processes and procedures to collect the Personal Data of the Data Controllers in a secure manner, likewise, it obliges its collaborators and third parties who have access to the Personal Data, through the execution of contracts with clauses on Personal Data Protection, confidentiality and privacy of information; The foregoing, in accordance with this Privacy Notice and in terms of the Law and its Regulations, avoiding, at all times, that the latter collect the Personal Data of the Data Holders through misleading, unclear or fraudulent means.
For the peace of mind and security of the Data Subject in relation to his/her Personal Data; BANDALA has adopted mandatory and enforceable privacy policies and programs within BANDALA, among others: sensitizes its collaborators on the due treatment of Personal Data, has trained and made its personnel aware of the obligations regarding protection on the subject of Personal Data, Privacy and Confidential Information; has established administrative, digital and physical security measures, which translate into a set of technical and administrative actions, for the assurance of the Personal Data of the Data Subject, which allows BANDALA to guarantee compliance with the principles and obligations established by the Law.

The online services offered by BANDALA, use SSL (Secure Sockets Layer) encryption, during the use of the Digital Media by the Data Subject, in order to protect the confidentiality of the Personal Data of the Data Subject, for which reason, the Data Subject will be assured that the Digital Media are authentic, real and reliable to enter his/her Personal Data.

EXERCISE OF RIGHTS ARC

The Data Subject may exercise, by himself or through his legal representative, the rights of Access, Rectification, Cancellation or Opposition (hereinafter ARCO Rights), before the person in charge of the Protection of Personal Data of BANDALA, covering the requirements of the request indicated in Article 29 of the Law. For this purpose, the request may be submitted physically at the reception of BANDALA’s address, or if you prefer electronically, to the e-mail compliance@bandala.mx, addressed to the person in charge of the Protection of Personal Data of BANDALA. Likewise, the Data Subject may at any time express its refusal to the processing of its Personal Data for purposes other than those that are not specified in this Privacy Notice and/or revoke the consent granted through this Privacy Notice and that is necessary for the processing of its Personal Data, as well as limit the use or disclosure thereof, which may be done by any of the two means described above, complying with the following requirements:

1. The Holder’s name, address and e-mail address to communicate the response to your request.

2. Documents proving the identity of the Holder or his/her legal representative will only be accepted: Credential to Vote, Passport or Migratory Card, attached as an image to the mail on both sides that is clear and legible.

3. In case of natural persons, which is done through a representative, a power of attorney signed by two witnesses to act on behalf of the Holder shall be submitted, attaching the legible and clear document of the power of attorney.

4. In the case of legal entities, the power of attorney shall be submitted, evidencing the powers and sufficient faculties to act on behalf of the Holder; and, if applicable, the Registration Statement before the Public Registry, attaching the document legibly and clearly.

5. The relationship you had or have with BANDALA.

6. Clear and precise description of the Personal Data with respect to which it seeks to exercise any of the rights of access, rectification, cancellation or opposition thereto.

7. If applicable, the modifications to be made and provide the documentation supporting the request.

8. Any other element or document that facilitates the location of the respective Personal Data.

9. That the letter is addressed to the person in charge of Personal Data Protection at BANDALA.

10. Submit the application during the Customer Service hours from 9:00 a.m. to 6:00 p.m., Monday through Friday.

BANDALA will communicate to the Holder, within a term no longer than 20 (twenty) working days from the date on which the request for access, rectification, cancellation or opposition was received, the determination adopted to the same email address indicated. The moment in which BANDALA receives the Holder’s request is the moment in which it has entered its server, answering the same with an e-mail message indicating “Received”. The Application will not be valid if the above is omitted.

Once the answer has been sent within the indicated term, BANDALA will have 15 (fifteen) working days to execute the Access, Rectification, Cancellation or Opposition of the Personal Data of the Data Subject according to the request. The response, and if applicable, the sending of the information will be by e-mail. In case the Data Subject so decides and it is appropriate, the information will be sent to the address indicated for such purposes by the Data Subject, as long as the Data Subject requests it and pays the shipping or the cost of reproduction in copies or other formats.

LIMITING THE USE OR DISCLOSURE OF PERSONAL DATA

In order for the Data Subject to exercise his/her right to limit the use or disclosure of his/her Personal Data but with the intention to continue using BANDALA’s services, the Data Subject must express it by means of a written document, which may be presented physically at the reception of BANDALA’s domicile, or if he/she prefers electronically, to the e-mail compliance@bandala.mx, addressed to the person in charge of Personal Data Protection at BANDALA, such written document must contain the following:

1. The Holder’s name, address and e-mail address to communicate the response to your request.

2. Documents proving the identity of the Holder or his/her legal representative will only be accepted: Credential to Vote, Passport or Migratory Card, attached as an image to the mail on both sides that is clear and legible.

3. In case of natural persons, which is done through a representative, a power of attorney signed by two witnesses to act on behalf of the Holder shall be submitted, attaching the legible and clear document of the power of attorney.

4. In the case of legal entities, the power of attorney shall be submitted, evidencing the powers and sufficient faculties to act on behalf of the Holder; and, if applicable, the Registration Statement before the Public Registry, attaching the document legibly and clearly.

5. The relationship with BANDALA.

6. Any other element or document that facilitates the location of the respective Personal Data.

7. That the letter is addressed to the person in charge of Personal Data Protection at BANDALA.

8. Deliver the written document during the Customer Service hours from 9:00 a.m. to 6:00 p.m., Monday through Friday.

Any Personal Data that has been limited, that has been registered in a Public Registry or that has been subject to Opposition, will be given the same treatment expressed in this section and will be included in an exclusion list of BANDALA. Personal Data that have fulfilled their purposes, but cannot be cancelled and/or deleted by operation of law or contract, will be blocked from the purposes to which they were submitted, until they can be deleted. During such period, the Personal Data may not be subject to any processing greater than the conservation and safeguarding. The Application will not be valid if the above is omitted.

USE OF COOKIES OR ANY OTHER TECHNOLOGY TO COLLECT INFORMATION

The Holder, when accessing the Digital Media acquires the quality of user. Cookies are used in the Digital Media (hereinafter referred to as Cookies). Cookies are data files that are stored on the hard drive of a user’s computer equipment or electronic communications device when browsing an Internet site, which allow status information to be exchanged between the site and the user’s browser.
The status information may reveal user authentication or preferences, as well as any data stored by the browser with respect to the Internet site. Cookies cannot be used to obtain Personal Data from your hard drive, e-mail address or any other private information, but only to collect information about the user’s behavior while visiting the Digital Media.
Cookies are used for secondary purposes in order to learn the interests, behavior and demographics of those who visit Digital Media, and thereby better understand your needs and interests and better serve or provide you with related information, as well as to generate statistics regarding visits to Digital Media, time spent on Digital Media, and referring sites that may have brought you to Digital Media. This information is also used to maintain and update user profiles and to tailor or personalize the information provided by these means.

MODIFICATIONS TO THE PRIVACY NOTICE

BANDALA reserves the right to make changes or updates to this Privacy Notice at any time; in response to requirements; to its privacy and confidentiality practices; to changes in its business model, legislative developments, internal policies; new requirements for the provision or offering of its services or products; or for other reasons.

BANDALA undertakes to keep the Holder informed about the changes that this Privacy Notice may undergo and these modifications will be available to the public through BANDALA’s Digital Media.

MANIFESTATION OF THE HOLDER’S CONSENT

When the Data Subject visits our Digital Media and voluntarily provides us with his/her Personal Data and Confidential Information, he/she immediately grants his/her consent to BANDALA for the processing of his/her Personal Data and Confidential Information, in accordance with the terms of this Privacy Notice.
Given that the Personal Data is collected directly from the Data Subject and that this Privacy Notice has been made available to the Data Subject prior to the use of his/her Personal Data and that none of the Personal Data that BANDALA processes is sensitive or patrimonial, it will not be necessary for the Data Subject to express his/her consent, therefore, the Data Subject consents to this Privacy Notice in accordance with the Law and its Regulations and does not oppose it.

REVOCATION OF CONSENT

The Data Subject may revoke, at any time, his or her consent to this Privacy Notice and to the Processing of his or her Personal Data.
To revoke consent, the Holder must send a request, which may be submitted physically at the reception of BANDALA’s domicile, or if you prefer electronically, to the email compliance@bandala.mx, addressed to the person in charge of the Protection of Personal Data of BANDALA, must contain in writing the following requirements:

1. Documents proving the identity of the Holder or his/her legal representative, only will be accepted: Credential to Vote, Passport or Migratory Card, attached as an image to the mail on both sides that is clear and legible.

2. In case of natural persons, which is done through a representative, a power of attorney signed by two witnesses to act on behalf of the Holder shall be submitted, attaching the legible and clear document of the power of attorney.

3. In the case of legal entities, the power of attorney shall be submitted, evidencing the powers and sufficient faculties to act on behalf of the Holder; and, if applicable, the Registration Statement before the Public Registry, attaching the document legibly and clearly.

4. The relationship you had or have with BANDALA.

5. Any other element or document that facilitates the location of the respective Personal Data.

6. That the request is addressed to the person in charge of Personal Data Protection at BANDALA.

7. Submit the application during the Customer Service hours from 9:00 a.m. to 6:00 p.m., Monday through Friday.

BANDALA will issue a response in which it will confirm the revocation of consent, or in its case, will indicate the reasoning depending on the specific case, having 20 (twenty) days to issue this response. The moment in which BANDALA receives the Holder’s request, is the moment in which it has entered its server, answering the same with an Acknowledgement of Receipt. The Application will not be valid if the above is omitted.

PERSONAL DATA PROTECTION OFFICER OF BANDALA

The Data Subject may exercise his/her rights and make the consultations indicated in this Privacy Notice, in the Law and in its Regulations, through the person in charge of Personal Data Protection of BANDALA, to whom the Letters, Requests and Writings indicated in this Privacy Notice, in the Law and in its Regulations, should be sent by e-mail to compliance@bandala.mx.

APPLICABLE LAW AND DISPUTE RESOLUTION
For the interpretation, compliance or enforcement of the provisions herein, as well as for all matters arising from this Privacy Notice, the Holder submits to the applicable legislation regarding jurisdiction and competence of the competent Courts of Mexico City, reason for which, through this Privacy Notice, expressly waives any other jurisdiction that, by reason of its current or future domicile, may correspond to it, as well as for the update of any other cause that in the future generates a change of domicile.

PERSONAL DATA PROTECTION AUTHORITY

For any questions or additional information, as well as to exercise different types of rights and procedures in addition to those indicated in this Privacy Notice, the Holder may contact the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI), at Telephone 55 5004 2400 or at the official website https://home.inai.org.mx/.
In the event that this Privacy Notice is in other languages, the Spanish language shall prevail for its interpretation.
Last update: July 2023.