Comprehensive Privacy Notice – Customers and Prospects

Bello, Gallardo, Bonequi y García, S.C. (hereinafter “bgbg”) is the data controller for your personal data. Bgbg designates the following address for service of process and receipt of notifications: Avenida Santa Fe, No. 428, Tower 1, 14th Floor, Cuajimalpa de Morelos Municipality, Postal Code 05348, Mexico City, Mexico.

To fulfill the purposes described in this Privacy Notice, bgbg will process the following categories of personal data:

• Identifying and contact information.
• Employment data.
• Financial and asset data.
• Electronic data.

To comply with the purposes of this Privacy Notice, bgbg does not process sensitive personal data.

By requesting and/or purchasing services from bgbg, you consent to the processing of your personal data for the following purposes:

Primary objectives:

1. Contact you via physical and electronic means to offer you bgbg products.
2. Identify them as a prospect or customer.
3. Verify their identity and, if applicable, their legal status.
4. Prepare and submit a business proposal and/or quotes to the prospect or client.
5. Follow up on requests for information, business proposals, and/or quotes.
6. Manage activities related to contracting services with bgbg.
7. Create, monitor, and manage the documents that document the business relationship and obligations between the parties.
8. Where applicable, provide support, diagnosis, and resolution for incidents, failures, or technical issues related to the services provided by bgbg.
9. Submit reports on the services contracted with bgbg.
10. Manage, issue, and send the documents supporting payment for services purchased from bgbg.
11. Issue, validate, approve, and cancel invoices supporting payment for products purchased from bgbg.
12. Data analysis using analytics, artificial intelligence, and/or big data technologies to obtain historical and statistical information about the products and services purchased by our customers/users, their consumption habits, and ways to tailor our product and service offerings to their interests.
13. Historical and statistical records of our clients.
14. Comply with applicable legal and regulatory obligations, including those related to taxation, anti-money laundering, and personal data protection.
15. Comply with requests for information made by competent authorities in the course of their duties.
16. Protect and defend bgbg's rights and interests in judicial, administrative, or any other proceedings.
17. Receipt, processing, and management of inquiries, clarifications, or complaints regarding contracted services, through the physical and/or electronic channels provided by bgbg for such purposes.
18. Manage the collection, whether through legal or out-of-court means, of outstanding debts related to the services provided.

The primary purposes of personal data processing listed above do not require your consent, as they fall under the exceptions set forth in Article 9 of the Law, in accordance with Article 15, Section III.

Secondary purposes:

1. Sending information about our services, products, and promotions.
2. Invite you to participate in raffles, giveaways, contests, events, and incentive programs.
3. To conduct surveys and evaluations to improve our services.

You may object to the processing of your personal data for secondary purposes at any time after accepting this Privacy Notice, by following the procedure outlined in the “ARCO Rights” section.

Your personal data may be transferred within or outside of Mexico to the recipients and for the purposes identified below:

• Federal, state, and/or municipal governments and authorities; commissions; institutes; regulatory agencies; judicial or administrative authorities; and domestic and/or foreign government entities; in compliance with obligations established under applicable law and/or with well-founded and substantiated requests made by any of such entities.
• In such cases, subsidiaries and/or affiliates of bgbg that operate under the same internal processes and policies; for the purpose of centralized information management.

The transfers of personal data described above do not require your consent, as they fall under the exceptions set forth in Article 36 of the Law. Any transfer of your personal data that does require your consent will be disclosed in advance through the appropriate notice and by updating this Privacy Notice.

As the subject of personal data, you may exercise any of your rights of access, rectification, erasure, or objection (hereinafter, “ARCO Rights”). These rights include:

• Access: the right to know what personal data we hold about you, as well as information about how we process or share it.
• Correction: the right to request, at any time, the correction of your data if it is inaccurate or incomplete.
• Deletion: the right to have the processing of your personal data ceased, beginning with the blocking of such data and followed by its deletion.
• Right to object: the right to object, on legitimate grounds, to the processing of your personal data.
  To exercise any of your ARCO rights, you may submit a request by sending an email to datospersonales@bgbg.mx

Your application must include:

1. Your full name and address, or another way to receive a response to your request.
2. A copy of a document proving your identity and, if applicable, proof of legal representation if someone is exercising this right on your behalf.
3. A clear and precise description of the ARCO rights you wish to exercise and the personal data related to your request; and
4. If applicable, any other information or documents that help us identify your personal data or support your request in cases where you are requesting a correction or objecting to the processing.

Bgbg will respond to your request within 20 (twenty) business days of the date it is submitted and received. If the request is deemed valid, we will process it within 15 (fifteen) business days of the date we communicate our response. If the information and/or documentation provided in your request is incomplete, erroneous, and/or insufficient, or if the necessary documents to verify your identity or legal representation are not included, we will request that you correct and remedy these deficiencies so that we may process your request. You will have 10 (ten) business days to comply with the request and correct the application; otherwise, it will be deemed not to have been submitted.

The use of electronic means to exercise your ARCO rights authorizes bgbg to respond to your request via the same means, unless you clearly and explicitly specify another method of contact in your request.

The right to erasure is not absolute. Please note that bgbg must retain certain information to comply with various legal obligations and, in doing so, may share your personal data with other entities or organizations. In such cases, you may need to exercise your right to erasure by contacting the entity that received your personal data.

In some cases, you may withdraw your consent to the processing of your personal data; however, this withdrawal cannot have retroactive effect, meaning it cannot affect situations, procedures, or transfers that took place before you withdrew your consent.

Please note that there may be public policy provisions requiring bgbg to retain your information for a minimum legal period; in such cases, we will retain your information solely to comply with those legal provisions.

If you wish to withdraw your consent, you may submit a request by following the instructions for exercising your ARCO rights and sending an email to datospersonales@bgbg.mx

You may restrict the use or disclosure of your personal data by submitting a request to our Personal Data Department, following the procedure and instructions applicable to the exercise of ARCO rights.

Bgbg has the means and procedures in place to ensure that certain data is included in its own opt-out lists, thereby preventing the disclosure of such data. In such cases, we will provide data subjects who request to be added to the list with the corresponding proof of registration.

Bgbg reserves the right to modify, update, expand, and/or change the content and scope of this Privacy Notice at any time and at its sole discretion. In such cases, you may request the most recent version of the Privacy Notice from our Personal Data Department by emailing: datospersonales@bgbg.mx