Security Policy & Privacy Notice

PRIVACY NOTICE related to personal data collected by B&S ASESORIA DE NEGOCIOS S. DE R.L. DE C.V. (hereinafter referred to as “B&S”).

1. General provisions.
1.1 B&S is a company committed to and respectful of the rights over personal data of individuals, as recognized in Article 16, section II of the Political Constitution of the United Mexican States, as well as in the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). For this reason, B&S makes this Privacy Notice available so that the data subject (“TITULAR”) is able to exercise their right to informational self-determination.

1.2 By accessing and using this website, whose domain names are www.bsasesoria.com and www.bstaxes.com (hereinafter jointly referred to as “THE SITES”), owned by B&S, you (the “TITULAR”) declare that you accept the terms and conditions contained in this Notice and expressly grant your consent using electronic means, in accordance with Article 1803 of the Federal Civil Code.

1.3 If the TITULAR does not absolutely and completely accept the terms and conditions of this Notice, they must refrain from sharing any kind of information with B&S by any means, including THE SITES: www.bsasesoria.com and www.bstaxes.com

1.4 If the TITULAR continues to use www.bsasesoria.com and/or www.bstaxes.com, either in whole or in part, such action shall be deemed as their absolute and express acceptance of the terms and conditions contained herein.

1.5 The mere use of THE SITES grants the general public the status of TITULAR and implies full and unconditional acceptance of each and every one of the general and specific conditions contained in this Privacy Notice in the version published by B&S at the time the TITULAR accesses the site.

The parties agree that, in the absence of error, deceit, bad faith or any other vice of consent that could invalidate this instrument, both agree to be bound by the following:

2. Definitions.
2.1 TITULAR: The individual to whom the personal data belongs or relates.
2.2 Sensitive personal data: Personal data that affects the most intimate sphere of the TITULAR, or whose improper use may give rise to discrimination or entail a serious risk to them.
2.3 Controller (Responsible): Private individual or legal entity (B&S) that decides on the processing of personal data.
2.4 Processor (Encargado): Individual or legal entity that alone or jointly with others processes personal data on behalf of the controller.
2.5 Processing: The collection, use (including access, handling, exploitation, transfer or disposal), disclosure or storage of personal data by any means.
2.5.1 Transfer: Any communication of personal data to a person other than the controller or processor.
2.6 ARCO Rights: Rights of Access, Rectification, Cancellation and Opposition.
2.7 Implied Consent: It shall be understood that the TITULAR has consented to the processing of their data when, having been made available this Privacy Notice, they do not express their opposition.
2.8 Primary purposes: Those main purposes for which the personal data is requested and which give rise to the relationship between B&S and the TITULAR.
2.9 Secondary purposes: Those purposes that are not essential for the relationship between B&S and the TITULAR, but whose processing contributes to the fulfillment of B&S’s corporate purpose.

3. Identity and address of the controller.
The controllers of the personal data are B&S ASESORIA DE NEGOCIOS S. DE R.L. DE C.V., who agree to abide by this Privacy Notice (the “Notice”), which is made available in compliance with the Federal Law on Protection of Personal Data Held by Private Parties (the “Law”) and applies to personal data of individuals which B&S obtains from prospective clients, clients, suppliers, prospective suppliers, business partners, visitors to its facilities and users of THE SITES.

For the purposes of this Notice, B&S establishes its address at: Av. Ejército Nacional 843-B, Antara I, 5th floor, Col. Granada, Miguel Hidalgo, Mexico City, C.P. 11520.

4. Data collected.
The TITULAR acknowledges and accepts that B&S may directly obtain the following personal data, depending on the nature of the relationship with each TITULAR:

General data: Full name, short name, date and/or place of birth, age, gender, nationality, immigration status, image and voice, fingerprint, marital status, signature, photograph, marital property regime, home address or delivery address, tax address, landline and/or mobile number, email address, Skype user, social security number, fax, CURP, driver’s license number, education level, client or supplier ID, job position, salary, department, emergency contact details, date and time of entry and exit to B&S premises. Data of parents, spouse and children (name, age, address and occupation). Data of economic dependents (name, relationship, age, main activity, school or university). Personal references or contact data (name, address, phone number, company).

Educational data: Highest level of studies, thesis title, institution, generation, GPA, degree obtained, current studies, schedule and institution, office skills, courses or seminars, institution and date, language skills, IT and office software skills, availability to travel.

Personal interests: Membership in civil associations, social or sports activities and how often they are carried out.

Professional experience: Companies, business lines, phone numbers, periods, last salaries, name and position of immediate supervisors. Assigned supplier number, Afore registry, area of work, birth certificate, copy of official ID, proof of address and last proof of studies.

Additionally, the following documents may be requested in copy: Official identification, CURP, updated CV, birth certificate, proof of studies or professional license, recent proof of address, photocopies of the last three account statements, three letters of recommendation (with contact details), copy of last tax return and copy of the credit bureau report.

4.2 B&S may also collect the following financial or property-related data: Federal Taxpayer Registry (RFC), tax regime, monthly income, monthly expenses, real estate in your name and whether you own or rent the property where you live, type of bank account, account number, bank and branch, tax regime, number of employees, payment method, commercial business, advanced electronic signature, lease agreements, employment or service agreements, accounting documentation such as tax returns and audits, cover sheet of account statements, total income, type of housing, property value, commercial and banking references and credit limits with such entities, primary economic activity, and bank card data.

4.3 The TITULAR hereby gives their express consent pursuant to Article 9 of the LFPDPPP so that B&S may process their personal, financial and/or property-related data contained in this section, in order to fulfill the purposes of this Privacy Notice.

4.4 B&S may obtain the TITULAR’s personal data from public sources in order to validate, update and contact the TITULAR, while respecting at all times the reasonable expectation of privacy referred to in Article 7 of the LFPDPPP.

4.5 B&S may use IP (Internet Protocol) information to analyze any kind of threats to THE SITES, as well as to collect demographic information. However, IP information will in no case be used to identify the TITULAR, except when there are signs of fraudulent activity.

5. Use of “cookies” and “web beacons”.
5.1 THE SITES may use cookies in connection with certain features or functions. Cookies are specific pieces of information that a website sends to the TITULAR’s hard drive to maintain records. Cookies can make website use easier by saving passwords and preferences while the TITULAR browses the internet.
5.2 THE SITES do not use or store cookies to obtain personal identification data from the TITULAR’s computer that was not originally sent as part of the cookie.
5.3 Web beacons are images embedded in a website or email that can be used to monitor a visitor’s behavior, such as storing information about the user’s IP address, interaction time on a page, and browser type, among others.
5.4 Although most browsers accept cookies and web beacons automatically, the TITULAR may configure their browser to not accept them.
5.5 To disable cookies, follow these steps:
5.5.1 On a PC: open the browser, go to “Tools” menu, “Internet Options”, choose the “Privacy” tab and move the slider to “Block all cookies”.
5.5.2 On a Mac: open the browser, go to “Preferences”, choose “Security” and select “Never” in “Accept Cookies”.

6. Purposes of the processing of personal data.
6.1 B&S acknowledges that it may process the TITULAR’s personal data directly or through processors, depending on the type of relationship:

a) TITULAR – Visitor:
1. Identify visitors at B&S facilities.
2. Register entry and exit of visitors, computer equipment and goods at B&S facilities.
3. Record audio and/or video of visitors at the facilities, kept for up to six months.
4. Store in a database the records of entries and exits for up to five years from registration.

b) TITULAR – Clients and/or Prospective Clients:
5. Contact by phone or email to answer and follow up on service requests.
6. Register and annually update data in internal software so authorized personnel may access them.
7. Create and store a physical file of the client during the relationship and up to ten years after termination.
8. Issue electronic invoices and credit notes for services provided by B&S.
9. Carry out transactions with financial institutions related to commercial operations.
10. Conduct procedures necessary to grant credit lines, such as requesting credit bureau references and verifying banking and commercial references.
11. Request “Charge Authorization Letters” and valid official ID for card payments, and verify data by phone.
12. Deliver workshops or training courses requested by the client.
13. Use cloud services to streamline internal processes.

c) TITULAR – Supplier and/or Prospective Supplier:
14. Create the supplier profile in internal software so authorized staff may access the data.
15. Contact by phone or email to follow up on services or products required by B&S.
16. Make bank transfers and data validation related to purchase orders issued by B&S.
17. Clarify payments when required.
18. Generate and update the supplier database for up to ten years.
19. Keep a physical and/or electronic file of the supplier for the duration of the relationship and ten years after termination.
20. Schedule payments in accordance with commercial conditions agreed with B&S.
21. Use cloud services to streamline internal processes.

d) TITULAR – User of THE SITES:
22. Contact by email to answer and follow up on messages or requests in the “Contact” section of THE SITES.
23. Locate the B&S offices closest to the user.
24. Send marketing emails.
25. Store personal data in internal systems for the duration of the relationship and up to five years afterwards.

6.2 B&S may also process the TITULAR’s personal data for the following secondary purposes:
26. Evaluate the quality of services provided by B&S and the quality of customer care.
27. Send communications or newsletters with advertising or marketing content about B&S products or services.
28. Perform internal studies on consumer habits and behavior at branches or franchises.
29. Provide additional communications, information and promotions such as newsletters, event invitations or greetings.
30. Inform by email about changes or new products related to the services requested by the TITULAR.
31. Contact the user to inform about website updates, service messages and security notices.
32. Generate internal reports on the use of THE SITES.
33. For clients and suppliers, generate records in B&S databases for up to ten years.
34. Send mass marketing emails.
35. Conduct telephone or email surveys about clients’ interests and expectations regarding products or services.
36. Manage and follow up on requests or comments on B&S social media profiles.

6.3 If the TITULAR does not wish their data to be used for some or all of the secondary purposes listed in 6.2, they must send a request specifying which purposes they wish to opt out of to: privacidad@bsasesoria.com

6.4 Except for the cases indicated in 6.1 and 6.2, all personal data stored in physical media will be kept for five years after the purpose for which they were collected has ended, and then destroyed. For data in electronic media where no storage period is indicated, they may be kept for up to ten years after the purpose has concluded.

7. Limitations on access to and disclosure of personal data.
B&S undertakes to make its best effort to protect the security of the TITULAR’s personal data through legal mechanisms, technological tools and restricted access to facilities and databases, treating all information as confidential and under strict privacy.
B&S will also take the necessary measures to ensure that any processors (encargados) comply with this Notice.

8. ARCO request contact.
If the TITULAR wishes to revoke their consent, or exercise their ARCO rights (Access, Rectification, Cancellation and Opposition), they must contact the person designated by B&S:
Responsible: Salvador Zamora Ornelas
Email: privacidad@bsasesoria.com

9. Means to revoke consent.
The TITULAR may revoke their consent to this Notice by following this process:
9.1 Send an email to the Responsible mentioned in section 8.
9.2 Include in the request:
9.2.1 Full name, address and email of the TITULAR to receive the response.
9.2.2 Reason for the request.
9.2.3 Arguments supporting the request.
9.2.4 Official ID proving the TITULAR’s identity.
9.2.5 Date from which the revocation should become effective.

9.3 B&S will respond within a maximum period of 20 days from receipt of the request. If appropriate, it will become effective within 15 days after the response, notifying the TITULAR that B&S has ceased processing their personal data.

10. ARCO rights procedure.
To exercise ARCO rights, the TITULAR must:
Send an email to the Responsible (section 8) including:
10.2.1 Full name, address and email of the TITULAR to receive the response.
10.2.2 Reason for the request.
10.2.3 Arguments supporting the request.
10.2.4 Official ID proving the TITULAR’s identity.
10.2.5 Clear description of the personal data involved and any other element that helps locate them.
10.2.6 For rectification requests, the TITULAR must indicate the modifications to be made and attach supporting documents.

10.3 B&S will respond within 20 days from receipt of the request. If appropriate, the ARCO right will be enforced within 15 days after the response. For access requests, delivery will be made after the requester’s or legal representative’s identity has been verified.

11. Transfer of personal data.
B&S may transfer the TITULAR’s personal data to third parties or authorities when necessary to provide its services or comply with this Notice.
B&S undertakes not to transfer personal data for purposes other than those stated in this Notice.
If the TITULAR does not express opposition to such transfers, it will be understood that they have given their consent.

If any security breach occurs at any stage of the processing that significantly affects the TITULAR’s moral or property rights, B&S will notify the TITULAR by email as soon as possible so that they may take appropriate measures, and B&S will be released from liability if the breach is not attributable to it.

12. Modifications.
B&S may modify this Notice at any time, in line with new legal or privacy requirements. Updated versions will be available on THE SITES and may be notified by email so that the TITULAR can, if desired, exercise their ARCO rights.

13. Applicable law and jurisdiction.
This Notice shall be governed by the laws of the United Mexican States, particularly by the Federal Law on Protection of Personal Data Held by Private Parties and its Regulations.

Any dispute arising from the interpretation or enforcement of this Notice shall first be submitted to mediation before the Alternative Justice Center of Mexico City, in accordance with the Alternative Justice Law of the Superior Court of Justice of Mexico City and its Internal Regulations.

If no agreement is reached, the parties agree to submit themselves to the jurisdiction of the administrative authorities or courts of Mexico City, expressly waiving any other jurisdiction that might correspond to them because of their present or future domiciles.

This English version is provided for informational purposes only. In case of discrepancy or interpretation issues, the original Spanish version shall prevail.