Privacy Notice

WACH LEGAL, S.C., commercially known as “WACH LEGAL” (hereinafter, “The Controller”), with its registered office at Sierra Candela 111, Floor 9, Suite 901, Lomas de Chapultepec V Secc., Miguel Hidalgo, 11000 Mexico City, Mexico, and website www.wach-legal.com (“WEBSITE”), is responsible for the use and protection of your personal data and makes this privacy notice available to you (hereinafter, the “Privacy Notice”) in compliance with the provisions of the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter, the “Law” or the “LFPDPPP”), the Regulations to the Law (the “Regulations”) and the Privacy Notice Guidelines (the “Guidelines”), among other applicable provisions.

By this means, You expressly and consciously authorize, for all legal purposes, the processing and collection of your personal data once it has been provided to us. Said information will be processed by The Controller under the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality and accountability, in accordance with the provisions of article 5 of the Mexican Federal Law on the Protection of Personal Data Held by Private Parties.

I. Identification of the Controller and processing of your personal data

WACH LEGAL, S.C. is responsible for the processing of your personal data under the terms described in this Privacy Notice, in its capacity as The Controller.

II. Definitions

Personal Data.: Data about a living natural person who can be identified from those data (or from those data and other information in our possession or likely to come into our possession).
Usage Data.: Data collected automatically, whether generated by the use of the Service or by the Service infrastructure itself (for example, the duration of a page visit).
Confidentiality.: The Controller shall maintain absolute reserve and strict confidentiality of all personal data and information provided to us, and they will be protected with the administrative, physical and technical security measures established in the applicable regulations.
ARCO Rights.: The rights of Data Subjects to Access, Rectification, Cancellation and Opposition, in accordance with the Privacy Notice and applicable legislation.
Primary Purposes.: Primary Purposes for the processing of personal data shall be understood as those processing purposes that give rise to the legal relationship between the Data Subjects and The Controller; that is, the information without which The Controller would be unable to sell its products and/or offer its services.
Secondary Purposes.: Secondary purposes for the processing of personal data shall be understood as those which, while not essential to carry out the sale of products and/or offer services, contribute to their continuous improvement and allow The Controller to offer its customers and suppliers a wide range of products with higher quality standards.
Data Subject.: The natural person to whom the personal data collected, used, stored, transmitted or processed by The Controller belong, under the terms set forth in the LFPDPPP.
Controller.: The natural or legal person who (either alone, jointly or in common with other persons) determines the purposes for which, and the manner in which, any personal information is, or shall be, processed. For the purposes of this Privacy Policy, we are The Controller of the processing of your Personal Data.
Data Processors.: Any natural or legal person who processes data on behalf of the Controller. We may use the services of various Service Providers in order to process your data more efficiently.
Revocation.: Consent may be revoked by its Data Subject, except in cases where, due to a legal or contractual obligation, it is not possible to grant the revocation request, whether partial or total. The Data Subject must specify whether it is a partial or total revocation, as well as whether it concerns data with Primary Purposes, Secondary Purposes or both. To learn the procedure for revoking consent, consult the section on means and procedures for exercising ARCO rights and requesting revocation of consent.
Interested Party or User.: Any living natural person who uses our Service and is a Data Subject of Personal Data.
Cookies.: Text files that are automatically downloaded and stored on the hard drive of the Data Subject’s computer when navigating a specific Internet page, which allow the Internet server to remember certain data about that Data Subject, including their preferences for the display of pages on that server, username and password.
Web beacons.: Images embedded in an Internet page or email, which can be used to monitor a visitor’s behavior, such as storing information about the Data Subject’s IP address, duration of interaction on said page and the type of browser used, among others.

III. Intent of the Privacy Notice

This Privacy Notice is made available to the Data Subject with the intent that, in accordance with the LFPDPPP, as the “Data Subject” of the personal data provided, they may be informed of the processing that will be given to such data, as well as to provide accurate information for the exercise of their ARCO rights, which are described below:

The Data Subject has the right to access their personal data held by The Controller, except in the cases provided by Law.
The Data Subject has the right to rectify their personal data when it is inaccurate or incomplete.
The right at any time to cancel their personal data. The Controller may deny the cancellation of the data under the terms established by Law.
The right at any time and for legitimate cause to oppose the processing.

It is important to inform you that the LFPDPPP aims to protect your personal data held by private parties, in order to regulate its legitimate, controlled and informed processing, so as to guarantee the privacy and the right to informational self-determination of natural persons, in compliance with article 16 of the aforementioned regulatory body.

This Privacy Notice is applicable to Data Subjects of Personal Data obtained directly, indirectly or in person by The Controller, its representatives and/or employees, through contracts, letters, information requests, as well as through the various forms contained in the WEBSITE or any other medium specified for such purposes that refer to this Privacy Notice.

IV. Means of obtaining your information

The Controller obtains, stores and processes your personal information by virtue of the current or future legal relationship existing with the Data Subject, as well as from the registrations and form submissions made through the WEBSITE.

Likewise, The Controller may obtain your data in person when you physically deliver it to any of our employees or authorized representatives, directly when You or your legal representative send it to us through the technological or correspondence means designated for such purpose, as well as through the WEBSITE and indirectly through public databases or third parties who provide it to us.

V. The information we collect

The personal data that The Controller obtains directly, indirectly and/or personally from its Data Subjects, customers, suppliers and/or any person related to its services are:

Identification Data: full name, email address, landline, mobile phone, address, State, Province, postal code, City, Cookies and Usage Data, and your Federal Taxpayer Registry (RFC).

VI. Usage Data

We may also collect information about how the Service is accessed and used (“Usage Data”). This Usage Data may include information such as your computer’s Internet Protocol address (IP address), browser type, browser version, the pages of our Service you visit, the date and time of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

VII. Use of personal data

The personal data we collect from our customers will be used for the following primary purposes, which are necessary for the provision of the service and/or the sale of the requested products:

To attend to, process and follow up on requests related to the provision of legal services;
To verify and confirm the identity and data provided by customers;
To prepare and formalize contracts relating to the provision of legal services;
To prepare quotes and respond to requests for legal services;
To process payments, make charges and apply refunds linked to the provision of legal services;
To comply with commercial, tax, accounting and regulatory obligations arising from the legal relationship with customers, suppliers and distributors;
To attend to requirements of competent authorities, whether administrative, tax or judicial, within the scope of their legal powers;
To provide customer service;
To maintain an updated internal registry of customers and suppliers;
To comply with the exercise of ARCO rights (Access, Rectification, Cancellation and Opposition);
To comply with the legal and regulatory provisions applicable to the provision of legal services.

Additionally, we may process your personal data for the following secondary purposes, which are not essential to the legal relationship but allow us to offer you a better experience:

To send communications informing you of legislative changes, regulatory updates, research and similar information;
To invite you to events, training sessions or activities organized by WACH LEGAL;
To provide you with information about new products, promotions and offers related to the goods and services we provide.

The User may freely opt in or out and revoke consent at any time through clear and simple mechanisms such as accept/decline checkboxes in forms or via the following email: info@wach-legal.com.

VIII. Data retention

The Controller will retain your personal data only for as long as necessary to fulfill the purposes set forth in this Privacy Notice.

In any case, the data will be retained for the time strictly necessary to comply with applicable legal obligations, attend to authority requirements, resolve disputes and enforce the rights arising from the legal relationship established, as well as for compliance with and observance of our policies and legal agreements.

IX. Transfer of Personal Data

The Controller, for the correct provision of its services, may disclose and/or transfer your personal information to third parties, whether domestic or foreign, in whole or in part, for the fulfillment of any of the purposes set forth in this Privacy Notice, in the following cases:

To third parties in charge of processing payments, since transactions are carried out through external providers (e.g., banking institutions, credit or debit card payment platforms, electronic transfers, PayPal or other payment methods), to whom the data necessary to authenticate and authorize such transactions may be transferred.
To persons affiliated with and/or related to The Controller for verification, audit and certification purposes in tax and administrative matters;
To the Tax Administration Service (SAT) and companies providing electronic invoicing services, by virtue of the processes for issuing and sending Digital Tax Receipts via Internet (CFDIs).
To third parties to protect and defend the interests and rights of the Data Subject, The Controller and/or other third parties;
To third parties, to protect the safety and/or interests of the Data Subject, personnel and/or affiliates, its customers and suppliers or the general public;
To various authorities for the discharge of requirements or for the purpose of complying with any legislation or regulations;
To send notifications of offers, notices and/or promotional messages; communications for marketing, advertising and/or telemarketing purposes regarding new or existing products and/or services; conduct statistical surveys; market research on consumption habits, interests and behavior; carry out benefit and incentive programs; participate in social networks, chats and/or discussion forums; participate in events, trivia contests, raffles, games and/or sweepstakes; evaluate service quality; and, in general, for any activity aimed at promoting, improving and evaluating our services and/or products.
The Controller may transfer the personal data held in its databases to any of its affiliates and/or subsidiaries, and even to third parties or foreign persons, unless the respective Data Subjects expressly state their opposition, under the terms of the LFPDPPP.

X. Privacy of minors

Our Service is not directed to persons under 18 years of age (“Minors”).

We do not knowingly collect personally identifiable information from any person under 18 years of age. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us through the following means: by sending an email to the following electronic address: info@wach-legal.com.

If we become aware that we have collected Personal Data from minors without verification of parental consent, we will take steps to remove that information from our servers.

XI. Options to limit the use or disclosure of your personal data

You, as the Data Subject of your personal data, may limit the use and disclosure of your personal information to express your refusal to continue receiving communications or promotions from The Controller through the following means: by sending an email to the following electronic address: info@wach-legal.com.

In addition, you may register in the Public Registry to Avoid Advertising (REPEP), a mechanism aimed at facilitating consumers’ exercise of their rights not to be disturbed by unwanted advertising and to ensure that their information is not processed for purposes other than those expressly authorized by their Data Subject. This mechanism may be exercised through the website of the Mexican Federal Consumer Protection Agency (PROFECO) at the following address: https://repep.profeco.gob.mx/.

Likewise, The Controller has implemented systematic security measures to protect your personal data from use or disclosure. In the case of becoming aware of personal data of minors or of persons in a state of interdiction or incapacity, its processing shall be carried out in accordance with the law.

Notwithstanding the foregoing, The Controller may be obliged to disclose your Personal Data if required by law or in response to valid requests from authorities (for example, an administrative and/or jurisdictional authority).

XII. Data security

The security of your personal data is of utmost importance to The Controller; however, it is important to note that no method of transmission over the Internet, nor any electronic storage system, is completely secure.

Notwithstanding the foregoing, we implement reasonable and commercially acceptable administrative, technical and physical security measures aimed at protecting your personal data against damage, loss, alteration, destruction or unauthorized use, access or processing.

XIII. Disclaimer of liability

Our WEBSITE may contain links, hyperlinks and/or hypertexts (“links”), banners, buttons and/or Internet search tools that, when used by Data Subjects, transport them to other portals or Internet sites that may be owned by third parties. The Controller does not control such sites nor is it responsible for the Privacy Notices they display, the personal data that Data Subjects may provide through these portals or Internet sites other than the WEBSITE, which must be verified in the Privacy Notice of each site accessed.

Likewise, we may provide on our website social media features that allow you to share WEBSITE information on your social networks and interact. The use of these features may involve the collection or sharing of information about Data Subjects, which will depend on each specific feature. We recommend that you review the settings and privacy policies of the social media sites with which you interact to ensure that you understand the information that could be shared on said sites.

XIV. Means to revoke consent and exercise ARCO rights

You may revoke your consent and exercise your rights of access, rectification, cancellation and opposition for the processing of your personal data by means of a written request or by email, addressed to Customer Service at the email address info@wach-legal.com. If, subsequent to revocation, you request confirmation of the same, The Controller will respond expressly.

Access.: The Data Subject has the right to obtain from The Controller their personal data, as well as information relating to the conditions and general aspects of the processing.
Rectification.: The Data Subject may at any time request that The Controller rectify their personal data that is inaccurate or incomplete.
Cancellation.: Cancellation implies the cessation of processing by The Controller, beginning with the blocking of the data and its subsequent deletion.
Opposition.: The Data Subject may, at any time, oppose the processing of their personal data or demand that it cease for specific purposes in the cases set forth in article 109 of the Regulations.

The request must be accompanied by (i) a valid official identification such as INE (Mexican voter ID) and/or passport, or, where applicable, the documents accrediting legal representation; (ii) your address to receive notifications; (iii) any document or information that facilitates the location of your personal data; (iv) a clear and precise description of the personal data regarding which you seek to exercise any of the rights of access, rectification, cancellation and opposition; (v) in the case of requesting rectification of data, you must also indicate the modifications to be made and provide the documentation supporting your request.

The Controller, within a term of 20 (twenty) business days counted from the date of receipt of the request, will resolve on the merits of such request, making it effective within the 15 (fifteen) business days following the date on which the response is communicated. The terms granted herein may be extended for an additional equal period, provided the circumstances of the case justify it. In any case, the revocation of consent for the processing of your personal data will result in the termination of the legal relationship between The Controller and You.

The exercise of ARCO rights is free of charge; however, the costs of shipping or the cost of reproduction of copies or other formats and, where applicable, the cost of certification of documents shall be borne by you.

It is important to mention that, in the process of attending to your request, it will be considered that the exercise of such rights does not obstruct compliance with any law in force or judicial mandate, or compliance with the obligations arising from the legal relationship between the Data Subject and The Controller. In this regard, please bear in mind that your request will not be admissible in all cases, nor will it be possible to immediately conclude the use of your personal data.

To facilitate your request, we provide below a model text for exercising your ARCO rights:

(Place and date)

Personal Data Department

REFERENCE: Request to exercise Rights regarding Personal Data.

Dear Sirs,

I hereby request: _______ (Brief, clear and precise description of the personal data with respect to which you intend to exercise a right, as well as the right you wish to exercise), provided in the domain or name ____ (Indicate the website on which the aforementioned data were provided), for which I identify myself with ______ (Indicate and attach a simple copy of the document with which you identify yourself). All of the foregoing in accordance with the privacy notice of your company.

Sincerely,

Name — where applicable, and signature of the data subject or their legal representative — (In this case, the corresponding identification document or the document evidencing the powers of the representative may be requested).

The response time for a request to exercise ARCO rights is 15 calendar days.

XV. Authority

If the Data Subject considers that their rights regarding the protection of personal data have been violated, they have the right to seek recourse before the corresponding authority to enforce such rights. The authority is the Anti-Corruption and Good Government Secretariat (Secretaría Anticorrupción y Buen Gobierno); its website is: https://www.gob.mx/buengobierno.

XVI. Updates and/or modifications

The Privacy Notice may undergo modifications, changes or updates arising from new legal requirements; from our own needs regarding the products or services we offer; from changes in our business model, or for other causes.

Any modification or update to this Privacy Notice will be published on the WEBSITE with at least 15 calendar days’ notice, or when applicable legislation so indicates, so that, should you consider it necessary, you may express your opposition to the new processing that would be given to your personal data.

XVII. Acceptance of terms

This statement is subject exclusively to the terms and conditions of The Controller’s WEBSITE, which constitutes a legal agreement between the Data Subject and The Controller. If the Data Subject uses the services on any of The Controller’s sites, it means that they have read, understood and agreed to the foregoing terms.

You acknowledge having read this Privacy Notice and do not express your opposition to your personal data being processed or transferred; it shall be understood that you have granted your consent for such processing. If the Data Subject uses our services, it means that they have read, understood and agreed to the foregoing terms.

XVIII. Use of cookies, mechanisms in remote or local means of electronic, optical or other technology of communication

We use cookies and similar tracking technologies for the purpose of ensuring the proper functioning of our Website, facilitating the sale of products, storing and managing session data, as well as analyzing browsing activity and improving your user experience, in accordance with the provisions of our Cookies Policy.

The information we may collect through cookies includes: the type of browser and operating system you use; the Internet pages you visit before and after accessing our Website; the links you follow and the time spent on our site; your IP address; the location from which you visit us, and general browsing statistics.

You can configure your browser to reject all cookies or to receive a notification when a cookie is sent. However, if you decide not to accept them, it is possible that some functions of our Website or the product purchase process may not be available or may not work correctly.

Examples of cookies we use:

Session cookies. We use Session cookies to operate our Service.
Preference cookies. We use Preference cookies to remember your preferences and various settings.
Security cookies. We use Security cookies for security purposes.

In the case of cookie usage, the “help” button found in the toolbar of most browsers will tell you how to avoid accepting new cookies, how to make the browser notify you when receiving a new cookie, or how to disable all cookies.

Likewise, these technologies may be disabled by following the procedures of the Internet browser you use. See, for example, Google Chrome at: https://support.google.com.