Identity and Address of the Data Controller

Calderón, González & Carvajal S.C. (hereinafter, the “Controller”), located at Campos Elíseos 400, Suite 701, Lomas de Chapultepec, Miguel Hidalgo, Mexico City, Mexico, C.P. 11000, email: recepción@cgctax.com , in accordance with the Federal Law on Protection of Personal Data Held by Private Parties, its Regulations, the Guidelines for Privacy Notices, and pursuant to the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality, and responsibility, is responsible for your Personal Data and provides this Privacy Notice to inform you of the purposes for which your Personal Data and any information you may provide through various means and/or forms—including our website, social networks, digital platforms, and in connection with the use of our services—will be processed and managed.

Personal Data Subject to Processing

For the purposes set forth in this Privacy Notice, the Controller may require the following Personal Data from the Data Subject:

Identification Data: (i) full names and surnames; (ii) date of birth; (iii) country of origin, nationality, and citizenship; (iv) Unique Population Registry Code (CURP) or its equivalent for other countries or jurisdictions; (v) country or jurisdiction of residence for tax purposes; (vi) type and number or code of official identification; (vii) Federal Taxpayer Registry (RFC) or its equivalent for other countries.
Contact Data: (i) email address; (ii) telephone numbers; (iii) home address; and (iv) tax address.
Financial Data: (i) information regarding income and expenditures, taxable acts or activities, or other relevant tax information in Mexico or abroad; (ii) information concerning salaries and wages of the Data Subject or their employees; (iii) bank account statements; (iv) information regarding compliance with regulations in Mexico in various administrative matters; and (v) credit rating obtained through Credit Information Companies.
Employment and Social Security Data: (i) Social Security Number; (ii) union membership; and (iii) Employer Registration Number, if applicable.
Sensitive Personal Data

Sensitive personal data that may be processed include: (i) marital status; (ii) full names and surnames of spouses or domestic partners; (iii) marital property regime; (iv) confirmation of participation as a partner or shareholder in legal entities, trusts, or any other legal structure; (v) union membership; (vi) facial recognition features as part of office access control; and (vii) present or future health status.

Purposes of Personal Data Processing

Personal Data provided or that may be provided will be used by the Controller for the following purposes:

Those that are essential for fulfilling the legal relationship involving the provision of legal, accounting, and advisory services between the Controller and the Data Subject.
To conduct investigations and actions deemed necessary by the Controller.
To comply with legal, accounting, regulatory, and contractual obligations of the Controller and the Data Subject.
For rendering our services.
Means to Limit Use or Disclosure of Personal Data

The Data Subject may limit the use or disclosure of their information by submitting a request to the Controller via email at recepción@cgctax.com  or in writing to the address at Campos Elíseos 400, Suite 701, Lomas de Chapultepec, C.P. 11000, Mexico City, Mexico. The request must include: (i) full name of the data subject; (ii) means and address for notifications; (iii) clear description of the requested limitation; and (iv) valid document proving identity or, if applicable, legal representation.

Requests will be addressed provided there is no legal impediment, no applicable provision is contravened, and third-party rights are not affected. If the requested information involves another data subject’s data, delivery may be denied unless express consent or applicable legal authorization is provided.

Mechanisms, Means, and Procedure to Exercise Rights of Access, Rectification, Cancellation, and Opposition (ARCO Rights)

Our Personal Data Protection Department is available for you to exercise your ARCO Rights regarding your Personal Data at any time. To exercise Access, Cancellation, or Opposition Rights, send an email to recepción@cgctax.com , with the subject line containing your full name followed by “ARCO Rights Request.” The request must include: (i) full name; (ii) address, email, or other means for notifications; (iii) valid document proving identity; (iv) clear and precise description of the Personal Data regarding which the ARCO Right is to be exercised; (v) clear and precise description of the ARCO Right to be exercised or the specific request; and (vi) any other document or element facilitating the location of the Personal Data. For Rectification, also indicate the modifications to be made and provide supporting documentation.

Requests may require in-person submission at our offices to verify identity. The Controller may update personal data only with documentation and evidence supporting that the information in our records is not accurate, complete, correct, or updated, considering the latest information provided by the Data Subject or competent authority.

ARCO Rights may be fully addressed provided there is no legal impediment, no applicable provision is contravened, and no third-party rights are affected. If the requested Personal Data involves another data subject, delivery may be denied unless express consent is provided.

The Controller will communicate the response to your request via the contact method provided within a maximum of twenty business days from receipt. The response will refer exclusively to the information and Personal Data requested, in compliance with Article 98, second paragraph of the Regulations of the Federal Law on Protection of Personal Data Held by Private Parties. The period may be extended once for an equal period if circumstances justify it.

Transfer of Personal Data

To fulfill the purposes established in this Privacy Notice, the Controller may transfer, within and outside national territory, all or part of the Data Subject’s Personal Data in the following cases:

With the Controller’s business partners.
With authorities or regulators, in which case only the necessary data will be transferred to comply with regulatory or contractual requirements and always in accordance with this Privacy Notice.
With auditors and/or acquiring companies of all or part of the Controller’s business or related parties, or other third-party data recipients by virtue of merger, acquisition, or consolidation, for the purpose of completing such transactions.
In cases established by applicable regulations.
When such transfer is necessary to comply with legal, accounting, regulatory, or contractual obligations of the Controller.
The Controller may also send Personal Data to third-party service providers when necessary to fulfill legal, accounting, regulatory, or contractual obligations; to third parties providing IT, operations, administration, maintenance, or installation services. These transfers may include, but are not limited to, contractors, service providers, suppliers, consultants, notaries, public brokers, experts, translators, auditors, insurers, and/or advisors of any nature.

Options and Means to Revoke Consent

At any time, the Data Subject may limit the use or disclosure of the data provided and revoke consent for the processing of their Personal Data by sending an email to recepción@cgctax.com , with the subject line containing their full name followed by “Request for Limitation of Use or Disclosure and/or Revocation of Consent.” The request must include: (i) full name; (ii) address, email, or other means for notifications; (iii) valid document proving identity; and (iv) a clear and precise request to revoke consent for processing the corresponding Personal Data.

Changes to the Privacy Notice

Calderón, González & Carvajal S.C. reserves the right to update this Privacy Notice. Any changes or modifications will be communicated through any of the following means: 1) personally at the Controller’s address; 2) by email if the Data Subject provides an email address when initiating the relationship; and 3) via notices on the Website. It is recommended that the Data Subject review the Privacy Notice at least every six months to stay informed of its terms and conditions. The notice is available at the Controller’s address, on the Website, and in the Personal Data Protection Department.

Consent
If the Data Subject does not agree with this Privacy Notice, they should refrain from providing any information or Personal Data, from using or requesting the Controller’s services, and from accessing, browsing, or using the Controller’s website functions and services. Consent for the processing of Personal Data under the terms of this Privacy Notice will be deemed granted tacitly if, after being provided with this Privacy Notice, no objection is expressed. Any provision of information, as well as access and use of the Controller’s platforms or participation in forums and events, will be considered as manifestation of consent and acceptance of this Privacy Notice.

This Privacy Notice is available at www.cgctax.com/aviso-de-privacidad/  and in the format in which your consent is specifically obtained.

Our website (https://cgctax.com/ ) collects cookies. Cookies enable the Website to function; if you wish to disable them, please check your browser settings.