PRIVACY NOTICE

I. Responsible of Personal Data

Alliax, S.A. de C.V. (“Alliax”) is responsible for the processing of personal data, with corporate address at Avenue Pedro Ramírez Vázquez 200, Building 13, Floor 7, Valle Oriente, 66269, San Pedro Garza García, Nuevo León; in accordance with Article 15 of the Federal Law on the Protection of Personal Data in Possession of Private Parties.

II. Personal Data Subject to Processing

The personal data subject to processing by Alliax consists of the following information of the owner, whether customer (active, potential or previous), supplier, employee, candidate or visitor: full name, email, address, RFC, CURP, telephone, financial and patrimonial data, among others. It is understood that the personal data subject to processing may include information of the owner related to his identification, contact, work experience, physical characteristics, academic history, patrimonial, ideology and health, depending on the case. The data collected by third parties for access control purposes is not processed by Alliax unless it is shared for this specific purpose.

III. Purpose of the Processing of Personal Data

The purpose of the processing of personal data by Alliax is distinguished based on the classification of the owners of such personal data, whether they are customers (active, potential, or former), suppliers, employees, candidates, and visitors.

  1. Client.- The primary purpose of the processing of personal data of customers by Alliax consists of the following: identification and access; registration process when validating their financial documentation before banking and government entities; registration as a customer in the electronic systems that Alliax uses; all activities that are necessary for the legal relationship between Alliax and the owner; commercial movements as a customer; contact and sending of information on matters relating to the business relationship; and updating of the Alliax customer database. In addition, personal data may be used for the following secondary purposes that are not necessary for the requested service, but that allow and facilitate the provision of better service: service satisfaction surveys, as well as promotion and dissemination through physical and electronic means of Alliax’s services.
  2. Supplier.- The primary purpose of the processing of personal data of suppliers by Alliax consists of the following: identification and access; evaluation as a potential supplier; registration as a supplier in the electronic systems that Alliax uses; preparation and execution of contracts that may be required; compliance with obligations arising from the legal relationship established with the supplier; acquisition,  receive the required services and/or products; validate compliance with internal regulations and safety of required jobs; comply with labor law issues; and evaluate the quality of products and/or services. In addition, personal data may be used for the following secondary purposes that are not necessary for the requested service, but that allow and facilitate the provision of better service: service satisfaction surveys.
  3. Employee.- The primary purpose of the processing of employees’ personal data by Alliax consists of the following: identification and access; job bank; recruitment and selection of personnel; socioeconomic, psychometric and/or medical evaluations; personnel administration; payroll management; prevention of occupational risks; clinical history; compliance with the obligations and labor benefits offered by Alliax or requested by the owner;  complement a procedure requested by the owner; information on matters relating to the employment relationship; to comply with requests from the authorities or to protect and defend the rights of Alliax; and statistical purposes.
  4. Candidate.- The primary purpose of the processing of candidates’ personal data by Alliax consists of the following: identification and access; job bank; recruitment and selection of personnel; socioeconomic, psychometric and/or medical evaluations; payroll management; to complement a procedure requested by the owner; and statistical purposes.
  5. Visitor.- The primary purpose of the processing of personal data of visitors by Alliax consists of the following: identification and access.

Personal data will be kept under confidential measures and may not be used for anything other than those mentioned above. In the event that the owner does not wish the personal data to be used for the secondary purposes indicated, the owner must write to the Human Resources Department at the Alliax offices located at Avenue Pedro Ramírez Vázquez 200, Building 13, Floor 7, Valle Oriente, 66269, San Pedro Garza García, Nuevo León, Monday through Friday from 9:00-13:00 and from 14:30-18:00.  on business days, as appropriate, specifying that the owner does not consent to the personal data being used for said purpose.

IV. Collection of Personal Data

For the collection of personal data, we follow all the principles set forth in Article 5 of the Federal Law on the Protection of Personal Data in Possession of Private Parties, such as legality, quality, consent, information, purpose, loyalty, proportionality, and responsibility.

Personal data will be collected directly from the owner personally or through other optical, sound, visual means, or by any other lawful technology such as our website or online services, among others. Alliax may obtain information about the owner from other lawful sources such as telephone directories, company or individual references, public databases of any public or private entity or agency and on social networks.

Alliax may use cookies or web beacons on its website to facilitate navigation and to obtain greater efficiency by facilitating the personalization of the services offered to visitors. The cookies or web beacons used on Alliax websites do not provide references that allow you to be identified and cannot read data from your hard drive or include viruses in your texts. It is also not possible to read the cookies implanted on the visitor’s hard drive from other servers. To disable the use of cookies, please refer to the help section of your browser. The processing of user data on social networks will be governed by the conditions provided for in the terms and conditions of the social networks themselves.

V. Choices and Means to Limit the Use or Disclosure of Personal Data

Alliax has the necessary security, administrative, technical, and physical measures in place to protect personal data against damage, loss, alteration, destruction, use, access, or unauthorized processing. Personal data is safeguarded in databases and computer equipment that have the necessary security, including tools in information systems such as physical and logical access controls, environmental controls, perimeter protection systems (Firewall), antivirus protection tools and web filtering. These tools are supported by an internal information security policy that explains to employees the security attention they should consider when using a computer system. Likewise, the owners of personal data have the option of requesting the limitation of the use or disclosure of their personal data subject matter of this Privacy Notice, in accordance with the provisions of the following section and in accordance with Article 15 of the Federal Law on the Protection of Personal Data in Possession of Private Parties.

VI. Mechanism for Exercising ARCO Rights

In the event that you wish to limit the use or disclosure of personal data by the owner, or want to exercise your ARCO rights (access, rectification, cancellation and opposition), or seek to revoke your consent, the owner must write to the Human Resources Department at the Alliax offices located at Avenue Pedro Ramírez Vázquez 200, Building 13, Floor 7, Valle Oriente, 66269, San Pedro Garza García, Nuevo León, Monday through Friday from 8:00 a.m. to 1:00 p.m. and from 2:30 p.m. to 5:00 p.m., on business days, as appropriate.

To process any request for access, rectification, cancellation, or opposition (“ARCO Application”), it must be received at the address indicated, as well as contain the following information and accompany the following documentation:

  1. The name of the owner of the personal data, address, and/or any other means to communicate the response to your request.
  2. Documents proving the identity or, where appropriate, the legal representation of the holder; as a voting credential issued by the National Electoral Institute; professional license; passport; National Military Service identity card released; Medical services credential from a public health or social security institution, with a photograph canceled with the official seal of the institution, signature and position of the person issuing it. In the case of credentials in digital format, they may be accepted even if the stamp does not cancel the photograph.
  3. The clear and precise description of the personal data with respect to which you seek to exercise any of said rights.
  4. Any other element or document that facilitates the location of the owner’s data.
  5. The reason for the request and whether the request is for access, rectification, cancellation, or opposition.
  6. The modifications to be made, in the event that the request is for the rectification of personal data and provide the documentation that supports your request.

In the event that the information provided in the ARCO Application is insufficient or erroneous to comply with it, or the necessary documents are not accompanied to process it, Alliax will require the owner of the data or their legal representative, within 5 business days following receipt of the ARCO Application,  for a single time, that provides the necessary elements or documents to process it. The owner of the data or their legal representative will have 10 business days from the day after receiving the request, to respond to it. Alliax will respond to the ARCO Request with the determination reached within 20 business days from receipt of the request, or in case additional information or documents have been requested, within 20 business days from the day following the submission of the response to the request. If the ARCO Request is admissible, Alliax will make the determination reached effective within a period of 15 business days from the date the response is communicated to the owner of the data or their legal representative.

In the case of ARCO Requests on the right of access to personal data, the delivery of the same will be made after accreditation of the identity of the owner of the data or their legal representative. Alliax may extend the deadlines to respond to an ARCO Request, and/or to make effective the determination reached, on a one-time basis, for periods equal to those indicated in each case, if it considers that the circumstances of the case justify it. In such cases, Alliax will notify the owner of the data or its legal representative, the circumstances that justify the extension, within each of the original deadlines to respond or make effective the determination reached. The responses to the ARCO Requests will be delivered to the owner of the data or to his legal representative in simple copies or in an electronic file depending on the type and quantity of documents in question in each case.

Alliax may deny access, rectification, cancellation, or opposition to the processing of the same, in accordance with article 33 of the Federal Law on the Protection of Personal Data in Possession of Private Parties, in the following cases:

  1. When the applicant is not the owner of the personal data, or the legal representative is not duly accredited to do so.
  2. When the applicant’s personal data is not found in its database.
  3. When the rights of a third party are infringed.
  4. When there is a legal impediment, or the resolution of a competent authority that restricts access to personal data or that does not allow the rectification, cancellation, or opposition of the same.
  5. When the rectification, cancellation or opposition has been previously made.
  6. When it is personal data necessary for the existence, maintenance, and compliance of the legal relationship with the owner of the data.

VII. Transfer of Personal Data

The owner accepts that his/her data will be transferred to Alliax’s subsidiaries, subsidiaries, affiliates, suppliers and/or controllers within the national territory or abroad, respecting at all times the purposes set forth in this Privacy Notice and in the following cases, in accordance with Article 36 of the Federal Law on the Protection of Personal Data in Possession of Private Parties:

  1. When the transfer is provided for in a law or treaty to which Mexico is a party.
  2. When the transfer is necessary for medical prevention or diagnosis, the provision of health care, medical treatment, or the management of health services.
  3. When the transfer is made to holding companies, subsidiaries, or affiliates under the common control of the responsible party, or to a parent company or to any company of the same group as the responsible party that operates under the same internal processes and policies.
  4. When the transfer is necessary or legally required for the safeguarding of a public interest, or for the procurement or administration of justice.
  5. When the transfer is necessary for the recognition, exercise, or defense of a right in a judicial proceeding.
  6. When the transfer is necessary for the maintenance or fulfilment of a legal relationship between the controller and the owner.

VIII. Consent of the Owner of the Personal Data

In terms of the provisions of Article 8 of the Federal Law on the Protection of Personal Data in Possession of Private Parties, it will be understood that the owner consents to the processing of their personal data, when having made this Privacy Notice available to them, they do not express their opposition.

IX. Modifications to the Privacy Notice

Alliax may make the necessary modifications to adapt, update, improve or comply with new legal provisions to this Privacy Notice at any time, in accordance with Article 15 of the Federal Law on the Protection of Personal Data in Possession of Private Parties. Therefore, the owner of the personal data is recommended to regularly review the content of this Privacy Notice in any of the following means:

  1. Personnel registration of new employees.
  2. On the website: http://www.alliax.com.