Comprehensive Privacy Notice

Smithers, Garralda & Segovia, S.C. (hereinafter, the “Firm” or the “Data Controller”), with its address at Avenida Insurgentes Sur 1388, 8th Floor, Benito Juárez Borough, Zip Code 03230, Mexico City, Mexico, is responsible for the processing and protection of the personal data it collects from its clients and prospective clients, suppliers and service providers, candidates and personnel, visitors, website users and, in general, any individual whose personal data is processed by the Firm (the “Data Subject”).

This Privacy Notice is issued in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”), its Regulations and any other applicable provisions.

Depending on the relationship between the Data Subject and the Firm, the following categories of personal data may be collected and processed:

1. Identification and contact information: name, signature, address, date and place of birth, nationality, official identification, CURP, RFC, telephone number, email address and any other information necessary to identify or contact the Data Subject.
2. Professional, academic and employment information: occupation, company or institution to which the Data Subject belongs, position, professional and employment history, academic background, degrees, professional license, curriculum vitae, references and other related information.
3. Tax, financial and asset-related information: tax and billing information, tax status certificate, bank accounts, information relating to payments, assets, operations, transactions and any other information necessary for the corresponding legal relationship.
4. Legal information and information related to professional matters: information contained in agreements, powers of attorney, files, judicial or administrative proceedings, communications, documents, background information and any other information provided or collected in connection with the provision of legal services.
5. Visitor and security-related information: name, company or institution of origin, purpose of visit, entry and exit records, and images captured through video surveillance systems, when such systems are operated or controlled by the Firm.
6. Information obtained through electronic means: IP address, browser type, operating system, device used, access and browsing records, and information obtained through cookies or similar technologies when used by the Firm’s website.

Due to the nature of the legal services provided or certain employment or professional relationships, the Firm may process sensitive personal data, including information that may reveal matters such as racial or ethnic origin, present or future health status, genetic information, religious, philosophical or moral beliefs, political opinions, sexual preference or other information whose improper use could give rise to discrimination or entail a serious risk to the Data Subject.

The processing of sensitive personal data shall be limited to cases in which it is strictly necessary and shall be carried out in accordance with applicable legal provisions. Where required, the Firm shall obtain the Data Subject’s express written consent.

Financial or asset-related data shall be processed with the Data Subject’s express consent whenever such consent is required under the Law.

The Firm may process personal data for the following primary purposes, which are necessary for the corresponding legal relationship:

1. To identify and contact the Data Subject.
2. To respond to inquiries, requests for information and communications received through any means.
3. To assess the possibility of establishing a professional or legal relationship with the Data Subject, including conflict-of-interest checks, know-your-client procedures, due diligence and compliance reviews, where applicable.
4. To provide the legal services requested or retained and carry out the activities necessary for their proper performance.
5. To prepare, review, manage and retain agreements, arrangements, service proposals, files and other documentation related to the services provided.
6. To carry out proceedings, filings and actions before administrative, judicial, tax or other authorities whenever necessary for the provision of services.
7. To maintain communications with clients, prospective clients, representatives, counterparties and other persons related to matters entrusted to the Firm.
8. To carry out billing, collection, payment and administrative processes.
9. To manage relationships with suppliers and service providers.
10. To conduct recruitment, selection and hiring processes and, where applicable, manage the employment or professional relationship with the Firm’s personnel.
11. To control access to the premises and maintain the security of persons and property located therein.
12. To comply with legal, tax, regulatory, contractual and professional obligations applicable to the Firm.
13. To respond to requests from competent authorities and to exercise or defend the rights of the Firm or its clients.
14. To maintain the administrative, accounting, legal and security controls, files and records necessary for the Firm’s operations.

Where any of these purposes falls within a circumstance in which the Law permits processing without the Data Subject’s consent, the Firm may carry out such processing pursuant to the corresponding legal exception.

In addition, the Firm may process certain identification and contact information for the following secondary purposes:

• To send publications, newsletters, legal alerts and updates.
• To communicate invitations to events, conferences or other activities organized or promoted by the Firm.
• To conduct surveys regarding the quality of services.
• To carry out institutional communications, positioning, marketing or professional prospecting activities.

These purposes are not necessary to maintain the legal relationship with the Firm and require the Data Subject’s consent.

Where implied consent is permitted under the Law, such consent shall be deemed granted if, after this Privacy Notice has been made available to the Data Subject, the Data Subject does not express any objection.

The Data Subject may, from this moment or at any later time, refuse or withdraw consent for these purposes by sending an email to soporte@smithers.com.mx, without affecting the principal relationship maintained with the Firm.

When the Data Subject provides the Firm with personal data relating to third parties, the Data Subject must have the authority, authorization or consent that may be required to provide such information and must inform such third parties of the existence of this Privacy Notice where applicable.

The Firm shall process such data only to the extent necessary for the purposes set forth in this Privacy Notice and in accordance with applicable provisions.

For purposes of fulfilling the purposes described in this Privacy Notice, the Firm may make domestic or international transfers of personal data to third parties other than persons processing such data on behalf of the Firm.

Such transfers may be made, as applicable, to correspondent attorneys or external legal professionals, notaries public, commercial brokers, experts, translators, auditors, consultants, competent authorities and other professionals or third parties whose involvement is necessary for the provision of legal services or compliance with obligations of the Firm.

The Data Subject’s consent shall not be required where the transfer falls within any of the circumstances permitted by the Law, including where:

• It is provided for under a law or treaty to which Mexico is a party.
• It is necessary pursuant to an agreement entered into or to be entered into in the interest of the Data Subject between the Firm and a third party.
• It is necessary or legally required to safeguard a public interest or for the administration or procurement of justice.
• It is necessary for the recognition, exercise or defense of a right in judicial proceedings.
• It is necessary for the maintenance or performance of a legal relationship between the Firm and the Data Subject.

Where a transfer does require the Data Subject’s consent, the Firm shall request such consent in accordance with the Law before carrying out the transfer.

For such transfers, the Data Subject may indicate acceptance or refusal at the time the personal data is collected or by sending a communication to soporte@smithers.com.mx, as follows:

I Accept [ ] / I Do Not Accept [ ] the transfer of my personal data for the purposes set forth in this Privacy Notice with respect to those transfers that require my consent under the Law.

Any third party receiving personal data through a transfer shall be subject to the purposes and conditions set forth in this Privacy Notice and to the obligations applicable under law.

The Firm may also engage service providers that process personal data on behalf of and under the instructions of the Data Controller, including providers of technology, storage, communications, administrative, accounting and security services. Such processing shall be subject to the corresponding confidentiality and data protection obligations.

The Data Subject may exercise at any time the rights of Access, Rectification, Cancellation and Objection (the “ARCO Rights”) with respect to his or her personal data.

To exercise such rights, the Data Subject must submit a request to soporte@smithers.com.mx.

The request must contain:

1. The Data Subject’s name and address, email address or other means for receiving notices.
2. Documents evidencing the Data Subject’s identity or, where applicable, the identity and authority of his or her representative.
3. A clear and precise description of the personal data with respect to which the Data Subject seeks to exercise any ARCO Right, except in the case of the right of access.
4. A description of the ARCO Right to be exercised or of the relief requested.
5. Any element or document that facilitates the location of the personal data.

Where rectification of personal data is requested, the Data Subject must indicate the changes requested and provide supporting documentation.

The Firm shall notify the Data Subject of its determination within a maximum period of twenty business days from receipt of the request and, if the request is granted, shall make it effective within the fifteen business days following the date on which the response is communicated.

The foregoing periods may be extended once for an equal period where the circumstances of the case so justify.

The exercise of ARCO Rights shall be free of charge, without prejudice to reproduction, copying or shipping costs that may apply pursuant to the Law.

The Firm shall have an internal area responsible for handling requests related to personal data protection, which may be contacted through soporte@smithers.com.mx.

The foregoing is without prejudice to the Data Subject’s right to seek relief before the Ministry of Anti-Corruption and Good Government (Secretaría Anticorrupción y Buen Gobierno) in the cases and pursuant to the procedures provided under the Law.

The Data Subject may at any time request the withdrawal of consent previously granted for the processing of personal data, as well as request a limitation on its use or disclosure, by submitting a request to soporte@smithers.com.mx.

Withdrawal of consent shall not have retroactive effect and may not be immediately enforceable where a legal obligation requires the Firm to continue processing or retaining certain personal data.

Where a request for limitation is granted, the Firm shall adopt the corresponding measures and may include the Data Subject in any exclusion lists maintained for such purposes.

Personal data shall be retained for the period necessary to fulfill the purposes for which it was processed and for any additional periods required to comply with legal, contractual, tax or professional obligations, as well as to address potential liabilities.

Once the personal data is no longer necessary for such purposes and the applicable retention periods have expired, it shall be blocked and subsequently deleted in accordance with the Law.

The Firm shall maintain the administrative, technical and physical security measures necessary to protect personal data against damage, loss, alteration, destruction, unauthorized use, access or processing.

Partners, attorneys, personnel, suppliers and any other persons involved in any stage of the processing shall maintain the confidentiality of the personal data to which they have access, and such obligation shall survive the termination of the corresponding relationship.

The foregoing is separate from and in addition to any professional secrecy and confidentiality obligations applicable to the provision of legal services.

The Firm’s website may use cookies and other similar technologies to enable its operation, maintain its security, obtain statistical information regarding its use and improve the browsing experience.

Through these technologies, information such as the IP address, browser used, operating system, access device and information relating to interaction with and browsing of the website may be collected.

The Data Subject may configure his or her browser or device to limit, block or delete such technologies. Disabling certain cookies may affect the operation of certain features of the website.

Except where the Law permits processing without consent, the processing of personal data shall be subject to the Data Subject’s consent.

As a general rule, consent may be implied when, after this Privacy Notice has been made available to the Data Subject, the Data Subject does not express his or her objection.

Where the Law requires express consent, including the processing of financial or asset-related data where no legal exception applies, the Firm shall implement the necessary mechanisms to obtain such consent.

In the case of sensitive personal data, the Firm shall obtain the Data Subject’s express written consent whenever legally required.

Consent may be withdrawn at any time pursuant to the procedure provided in this Privacy Notice, without retroactive effect.

The Firm may amend or update this Privacy Notice as a result of legislative or regulatory changes, modifications to its personal data processing practices or requirements arising from its operations.

Any amendment or update shall be made available to Data Subjects through the Firm’s website.

For any questions regarding this Privacy Notice or the processing of personal data, please contact soporte@smithers.com.mx.