This document constitutes the Privacy Notice for purposes of the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (the “LFPDPPP”) and the provisions arising therefrom or related thereto. This Privacy Notice applies to personal information collected about the Data Subject by XIGNUX, S.A. de C.V., in its capacity as Data Controller, with address at Av. Arq. Pedro Ramírez Vázquez No. 200-2, Col. Parque Corporativo Ucaly, San Pedro Garza García, Nuevo León, and its Affiliate or Subsidiary companies, hereinafter XIGNUX. For purposes of this Privacy Notice, any terms not defined herein shall have the meaning attributed to them under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). The purpose of this Privacy Notice is to establish the terms and conditions under which XIGNUX (or the Processor it designates) will receive and protect the Data Subject’s Personal Data in order to maintain its privacy; will use the Data Subject’s Personal Data and/or, where applicable, transfer the Data Subject’s Personal Data to third parties.
1. CONSENT OF THE DATA SUBJECT.
For purposes of the provisions of the LFPDPPP and, in particular, Article 17 thereof, the Data Subject states that:
- 1.1. This Privacy Notice has been made available to the Data Subject by the Data Controller.
- 1.2. The Data Subject has read, understood and agreed to the terms set forth in this Privacy Notice and therefore grants consent to the processing of their Personal Data in accordance with the provisions of the LFPDPPP and applicable legislation.
- 1.3. In the event that the Personal Data collected includes sensitive or financial Personal Data, whether provided in printed format or through electronic means, such actions constitute the Data Subject’s express consent in accordance with the second paragraph of Article 8 of the LFPDPPP and other applicable legislation.
- 1.4. The Data Subject grants consent for XIGNUX and/or its Affiliates or Subsidiaries, through their Processors, to transfer Personal Data to domestic or foreign third parties, with the understanding that the processing of the Data Subject’s Personal Data by such third parties must comply with the provisions of this Privacy Notice.
- 1.5. If the Data Subject does not object to the terms of the Privacy Notice, its content shall be deemed agreed to and consented to, and the Data Subject’s consent may be revoked at any time by the Data Subject.
Notwithstanding any provision of this Privacy Notice, the Data Subject acknowledges that their consent will not be required for the processing of Personal Data by the Processor or third parties in any of the cases set forth in Article 10 of the LFPDPPP.
2. COLLECTION OF PERSONAL DATA.
Personal Data may be collected through telephone communications with the Data Controller or its Processors or employees, through direct delivery to the Data Controller, through the use of email and/or short text messages, through the use of its websites, or through the use of automatic data collection tools, which make it possible to collect information sent by your browser to such websites, such as the type of browser used, the user’s language and the IP address of the websites used to access the Data Controller’s or Processors’ websites.
The following are examples, by way of illustration and not limitation, of information that the Data Controller may collect: first and last name; date of birth; address, whether residential, work or tax address; email address, personal or work; social media username; telephone number, personal or work; mobile telephone number; bank account number; Federal Taxpayer Registry (RFC) number; Unique Population Registry Code (CURP).
Documentation that may be collected by XIGNUX to verify the identity of the Data Subject includes the voter identification card; released National Military Service Card; professional license; passport; immigration form; RFC registration certificate; CURP registration certificate; proof of address; and special credit report issued by a Credit Information Company.
In the case of job applicants, the following may also be requested, among other documents: birth certificate; proof of studies; Retirement Fund Administrator (Afore) account statement; tax withholding statement; as well as psychometric, medical and socioeconomic studies conducted by XIGNUX.
The Personal Data of family members, dependents or beneficiaries and the corresponding supporting documentation may also be requested.
3. PURPOSE OF PERSONAL DATA.
The Data Subject’s Personal Data is collected and processed by the Data Controller or its Processors for the purpose of allowing the Data Subject to carry out the following activities with the Data Controller:
- A) Request, purchase, contract, change or cancel services, or return products offered by XIGNUX.
- B) Make online payments; request an invoice or digital tax receipt; request a quote for products and services; request delivery, repair or fulfillment of product warranties; contact Customer Service; participate in surveys; use the various services of the corresponding Websites, including downloading content and forms.
- C) Share comments or suggestions regarding products and services.
- D) Process payments and perform any other activity of a similar nature to those described in the preceding paragraphs.
Likewise, the Data Controller, directly or through its Processors, may use your Personal Data for the purpose of:
- A) Conducting studies on the interests and behavior of its customers, consumers, suppliers and other third parties with whom it conducts business.
- B) Conducting market and consumer studies for the purpose of acquiring and offering personalized products and services, as well as advertising and content better suited to the needs of its customers, consumers, suppliers and other third parties with whom it conducts business.
- C) Preparing internal statistics indicating the services and products most valued by the different segments of its customers, consumers and suppliers.
- D) Formalizing the transactional process with its customers, consumers, suppliers and other third parties with whom it conducts business.
- E) Managing the process of requisitioning, evaluating and awarding suppliers and other third parties with whom it conducts business.
- F) Where applicable, verifying the Data Subject’s credit and/or payment capacity, which may be carried out through credit information companies, in accordance with the Law Regulating Credit Information Companies.
- G) Verifying commercial transactions carried out by the Data Subject with the Data Controller.
In the case of applicants for employment with XIGNUX, the following activities will be carried out:
- A) Conduct the personnel recruitment and selection process.
- B) Conduct the hiring process.
4. COLLECTION OF DATA WHEN BROWSING XIGNUX WEBSITES AND WEB PAGES.
The automatic data collection tools used by XIGNUX on its websites and web pages include cookies, Web beacons and links in emails. Links in XIGNUX emails allow XIGNUX to determine whether you activated such link and visited the destination website, and this information may be included in your profile. If you prefer that XIGNUX not collect information about your interaction with such links, you may choose to modify the format of XIGNUX communications, for example, so that the message is received in text format rather than HTML format, or you may disregard the link and not access its content.
5. DATA TRANSFERS.
Having read, understood and agreed to the terms set forth in this Privacy Notice, the Data Subject grants consent for the Data Controller or any Processor to transfer Personal Data to domestic or foreign third parties, with the understanding that the processing of the Data Subject’s Personal Data by such third parties must comply with the provisions of this Privacy Notice.
6. LIMITATION ON THE USE AND DISCLOSURE OF INFORMATION.
The Data Controller and/or its Processors will retain the Data Subject’s Personal Data for the time necessary to process requests for information, products and/or services, as well as to maintain accounting, financial and audit records in accordance with the LFPDPPP and applicable commercial, tax and administrative legislation. In addition to controlling the disclosure of such data or information to business partners. The Data Subject’s Personal Data collected by the Data Controller and/or its Processors will be protected by appropriate administrative, technical and physical security measures against unauthorized damage, loss, alteration, destruction, use, access or processing, in accordance with the LFPDPPP and the administrative regulations arising therefrom. Notwithstanding the foregoing, XIGNUX does not guarantee that unauthorized third parties will not be able to access the physical or logical systems of the Data Subjects or the Data Controller, or electronic documents and files stored in its systems. Consequently, XIGNUX shall under no circumstances be liable for damages that may arise from such unauthorized access.
7. PERSONAL DATA DEPARTMENT; ADDRESS.
For any communication regarding our Privacy Notice, please contact our Personal Data Department: XIGNUX, S.A. DE C.V. Ave. Arq. Pedro Ramirez Vazquez No. 200-2, Parque Corporativo Ucaly, San Pedro Garza Garcia, N.L. avisoprivacidad@XIGNUX.com. For purposes of the provisions of Section I of Article 16 of the LFPDPPP, the address of the Data Controller is the address established in Section 7 of this Privacy Notice.
8. PROCEDURE FOR EXERCISING ARCO RIGHTS AS A PERSONAL DATA SUBJECT.
You have, at all times, the right to access, rectify and cancel your Personal Data, as well as to object to its processing or revoke the consent you have provided for such purpose by submitting a request with the following information and documentation:
- 8.1. Name of the Data Subject, address, telephone number and email address.
- 8.2. Documents proving their identity, a simple copy in printed or electronic format of their voter identification card, professional license, passport or Immigration Form, or, where applicable, the legal representation of the Data Subject, a simple copy in printed or electronic format of the simple power of attorney bearing the handwritten signatures of the Data Subject and the representative, together with their corresponding identification documents.
- 8.3. A clear and precise description of the Personal Data with respect to which the Data Subject seeks to exercise any of the Rights.
- 8.4. Any other element or document that facilitates the location of the Data Subject’s Personal Data.
In the case of requests for rectification of Personal Data, the respective Data Subject must also indicate the modifications to be made and provide the documentation supporting their request. The Data Controller or its Processors will respond to the respective Data Subject within a maximum period of twenty business days from the date on which the request was received. The aforementioned periods may only be extended in accordance with the LFPDPPP. Personal Data will be provided free of charge, and the Data Subject will only be responsible for covering justified shipping costs or the cost of reproduction in copies or other formats. If the Data Subject repeats their request within a period of less than twelve months, they must cover the corresponding costs equivalent to 1.5 days of the current Unit of Measurement and Update (UMA), in accordance with the LFPDPPP, unless there are substantial modifications to the Privacy Notice that give rise to new inquiries. For purposes of requests for cancellation of Personal Data, in addition to the provisions of this Privacy Notice, the provisions of Article 26 of the LFPDPPP shall apply, including the cases of exception to the cancellation of Personal Data set forth therein. The submission of a request by the Data Subject to object to the use of Personal Data will grant the Data Controller the authority to cease using the Personal Data provided by the Data Subject to the objecting party.
9. CHANGES TO THE PRIVACY NOTICE.
XIGNUX reserves the right to periodically update this Privacy Notice to reflect changes in our information practices. It is the Data Subject’s responsibility to periodically review the content of the Privacy Notice on https://www.xignux.com where any changes will be published together with the date of the latest update. The Data Controller understands that unless otherwise stated, this means that the Data Subject has read, understood and agreed to the terms set forth therein, which constitutes their consent to the changes and/or updates regarding the processing of their Personal Data. The Client, supplier, applicant, employee, etc. declares that they have read and understood the Privacy Notice which, in compliance with the provisions of the Federal Law on Access to Information and Protection of Personal Data Held by Private Parties, is available https://www.xignux.com/aviso-de-privacidad/ and agrees to be bound by it with respect to the handling of the data they have provided to XIGNUX, as applicable, and which remains in its custody, under the terms set forth in said Privacy Notice.
