The Receiving Entity (subsidiary entity or entity that has an equity or shareholding or corporate relationship, of or with ECOM Agroindustrial Corporation, Ltd., with which it intends to have or has a commercial, business, service and legal relationship), such as UNITED AGROINDUSTRIES OF MEXICO, S.A. DE C.V. (AMSA), AGROINDUSTRIAS UNIDAS DE CACAO, S.A. DE C.V. (AMCO), CHIAPAS SPECIALTY COFFEE, S.A.P.I. OF CV. (CAFESCA), AGROFORESTAL VALLE DE NEJAPA, S.A. DE C.V. (NEJAPA), PROFESSIONAL AND OPERATIONAL SERVICES PROVIDER, S.A. DE C.V. (PRESPO), MEXICAN FOREST PARK, S.A. DE C.V. (PARFOMEX), AGRI TRUS, S.A. DE C.V., AGRO COVERAGE, S.A. DE C.V., LIOFILIZADOS MEXICANOS DE ALTURA, S.A. DE C.V., AGROBIOTECNOLOGIA INDUSTRIAL DE MEXICO, S.A. DE C.V. (ABIM) and/or AGROCACAO INDUSTRIAL, S.A.P.I DE C,V. (AGROCACAO), GRUPO AGROFORESTAL UUMBAL, S.A.P.I. DE C.V. (GAU), AGROFORESTAL UUMBAL CHIAPAS, S.A.P.I. DE C.V. (AUC), AGROFORESTAL UUMBAL VERACRUZ, S.A.P.I. DE C.V. (AUV), AGROINDUSTRIAL UUMBAL S.A.P.I. DE C.V. (AIU), FARM CARROLL DE MEXICO, S. DE R.L. DE C.V. (GCM) or any of its subsidiaries, affiliates or related entities, domiciled at BOSQUE DE ALISOS 45 A, PISO 2, COLONIA BOSQUES DE LAS LOMAS, DELEGACIÓN CUAJIMALPA, ZIP CODE 05120, MEXICO CITY, is responsible for the use and protection of your personal data, and in this regard we inform you of the following:


For what purposes will you use your personal data?

The personal data that we collect from you and the people related to you, will be used by the Receiving Entity for the following purposes that are necessary for the relationship that unites us, including those of a commercial, labor and service nature:
a) Identification and knowledge of workers, clients or potential clients and/or service providers or suppliers;
b) Identification, knowledge and contact of job candidates for the purpose of recruitment and selection, interviews, technical, trust, knowledge exams, related to the state and history of their own health, family members, and people related by reason of kinship, residence, marital status or coexistence, medical, socioeconomic and psychometric, analysis and evaluation of data, by us or a third party.
c) Provision of services;
d) Comply with the terms and conditions of the relationship that exists or will exist with you and with the obligations derived from it;
e) Comply with the legal provisions that are applicable to it;
f) Maintain safeguards of information in compliance with obligations;
g) Implement commercial, industrial and service relationships related to the corporate purpose and line of business of your company and carry out the analysis and due diligence reviews necessary for this purpose, including but not limited to reviews on tax matters, Prevention of Money Laundering or Combat to Terrorism, financial capacity, feasibility studies and convenience of establishing business relationships and other related, mainly related to the production, distribution and marketing of raw materials and agricultural products in general, including but not limited to research as well as the development of sustainable businesses , activities in the field of construction and the provision of associated financial services, contemplating the preparation of contracts, conventions, agreements and related acts to that effect.


To have an adequate knowledge of your person and corroborate your identity and conditions, as well as to comply with the tax, labor, social security or other provisions that are applicable to the Receiving Entity.

To document the file of the worker, client, supplier or counterparty and implement the operations, according to sound commercial and corporate practices and for the verification of the information for purposes of service quality, compliance and risk prevention.

To implement the legal and commercial acts that unite us.
Additionally, we will use your personal information for the following purposes that are not necessary for the requested service, but that allow and facilitate us to provide you with better service:
Incorporate you in the directories of potential clients and counterparties for purposes of advertising, marketing and commercial reference of the Recipient Entity or other subsidiary entities or that have a patrimonial relationship or shareholding or corporate relationship, of or with ECOM Agroindustrial Corporation, Ltd.
In case you do not want your personal data to be processed for these additional purposes, from this moment you can notify us of the above, by means of a written communication presented at our address.
The refusal to use your personal data for these purposes may not be a reason for us to deny you the services and products you request or contract with us.
What personal data will we use for these purposes?
To carry out the purposes described in this privacy notice, we will use the following personal data:

Identification data. Information concerning a natural person that allows to differentiate it from others in a community, such as: name; marital status; autograph and electronic signature; Federal Taxpayer Registry (RFC); Unique Population Registry Key (CURP); military card number; place and date of birth; nationality; Photography; age, among others.
Contact information. Information that allows you to maintain or contact its owner, such as: address; email; landline; cell phone, among others.
Labor data. Information concerning a natural person related to their employment, position or commission; job performance and professional experience, generated from recruitment, selection, hiring, appointment, evaluation and training processes, such as: position, work address, institutional email, institutional telephone; employment references; date of entry and exit from employment, criminal record, information related to dependents, beneficiaries and people related by reason of kinship, residence, marital status or cohabitation, among others.
Data on physical characteristics. Information about a natural person regarding their physiognomy, anatomy, traits or specific particularities, such as: skin, iris or hair color; particular signs; height; weight; complexion; scars, blood type, among others.
Academic data. Information concerning a natural person that describes their preparation, aptitudes, development and professional or technical orientation, endorsed by educational institutions, such as: educational trajectory; Titles; professional license; certificates; acknowledgments; among others.
Patrimonial or financial data. Information concerning a natural person related to their assets, rights, charges or obligations susceptible of economic valuation, such as: movable and immovable property; tax information; credit history; income and expenses; bank accounts; insurance; afores; bonds, credit card number, security number, among others.


In addition to the personal data mentioned above, for the purposes informed in this privacy notice we will use the following personal data considered sensitive, which require special protection:

ideological data. Information about the ideological, religious, philosophical or moral positions of a person.
Data on political opinions. Opinion of a person in relation to a political fact or about his political position in general.
Union membership data. Membership of a person to a trade union and the information derived from it.

Health data. Information concerning the health and hygiene of a natural person and persons related by reason of kinship, residence, marital status or coexistence related to the assessment, preservation, care, improvement and recovery of their physical or mental health, present, past or future, as well as genetic and habit information.
Data on sexual life. Information of a natural person related to their behavior, preferences, practices or sexual habits, among others.
Data of ethnic or racial origin. Information concerning a natural person regarding their belonging to a people, ethnic group or region that distinguishes them for their social, cultural and economic conditions and identities, as well as for their customs, traditions, beliefs.
Biometric data. Information about a natural person related to the image of the iris, fingerprint, palm of the hand or other analogs.
Without this information generating discrimination that has the purpose of preventing or annulling the recognition or exercise of the rights of real equal opportunities.


With whom do we share your personal information and for what purposes?
We inform you that your personal data is shared inside and outside the country with the following people, companies, organizations and authorities other than us, for the following purposes:
Recipient of personal data
Subsidiary entities, affiliates and with patrimonial nexus or administrative control with the issuer of this Notice, as well as entities with which they act jointly, provide complementary services or carry out related activities.
Country
Any part of the world.

Purpose

Analysis of information for the maintenance and upkeep of business relationships and their potential and monitoring of established business relationships.
We inform you that for the most obscure marking assumptions we require your consent. If you do not express your refusal for said transfers, we will understand that you have tacitly granted it to us for the cases that the law so allows.

The personal data may be kept by the receiving entity for up to the statute of limitations for the exercise of criminal and commercial civil actions that could be brought against the receiving company for purposes of demarcation of responsibilities, which in general is 10 years. counted from the termination of the relationship or the corresponding process.
How can you access, rectify or cancel your personal data, or oppose its use?
You have the right to know what personal data we have about you, what we use them for and the conditions of use we give them (Access). Likewise, it is your right to request the correction of your personal information in case it is outdated, inaccurate or incomplete (Rectification); that we remove it from our records or databases when it considers that it is not being used in accordance with the principles, duties and obligations provided for in the regulations (Cancellation); as well as oppose the use of your personal data for specific purposes (Opposition). These rights are known as ARCO rights.
To exercise any of the ARCO rights, you must submit the respective request in writing.

To know the procedure and requirements for the exercise of ARCO rights, you can call the following telephone number (52) (55) 52576500; or contact our Privacy Department, which will process requests for the exercise of these rights, and will address any questions you may have regarding the processing of your information. The contact details of the Privacy Department are as follows:
Bosque de Alisos 45 A, 2nd floor, Colonia Bosques de las Lomas, Cuajimalpa Delegation, Zip Code 05120, Mexico City, email capitalhumanomx@ecomtrading.com.
How can you revoke your consent to the use of your personal data?

You can revoke the consent that, if applicable, you have given us for the processing of your personal data. However, it is important that you bear in mind that not in all cases we will be able to attend to your request or terminate the use immediately, since it is possible that due to some legal obligation we may require to continue processing your personal data. Likewise, you must consider that, for certain purposes, the revocation of your consent will imply that we cannot continue providing the service you requested, or the termination of your relationship with us.
To revoke your consent you must submit your request in writing.
To learn about the procedure and requirements for revoking consent, you may call the following telephone number (52) (55) 52576500 or contact our Privacy Department.
How can you limit the use or disclosure of your personal information?
In order for you to limit the use and disclosure of your personal information, we offer you the following means:
Your registration in the Public Registry to Avoid Advertising, which is in charge of the Federal Consumer Protection Office, so that your personal data is not used to receive advertising or promotions from companies of goods or services. For more information on this registry, you can consult the PROFECO Internet portal, or contact it directly.

Your registration in the exclusion list “LIST OF PERSONS EXCLUDED FOR ADVERTISING PROSPECTING PURPOSES”, so that your personal data is not processed for marketing, advertising or commercial prospecting purposes by us. For more information call the telephone number (52) (55) 52576500, send an email to the following address capitalhumanomx@ecomtrading.com.
How can you find out about changes to this privacy notice?
This privacy notice may undergo modifications, changes or updates derived from new legal requirements; of our own needs for the products or services we offer; of our privacy practices; Changes in our business model, or other causes.
We promise to keep you informed about the changes that this privacy notice may undergo, through communication placed in an accessible way at the entrance of the Company’s address.

The procedure through which notifications about changes or updates to this privacy notice will be carried out is as follows:
Before 2 witnesses, the new Privacy Notice will be placed indicating its update date at the registered office, located at Bosque de Alisos 45 A, 2nd floor, Colonia Bosques de las Lomas, Cuajimalpa Delegation, Postal Code 05120, Mexico City.

Procedure to exercise the ARCO Rights

If you wish to exercise any of the rights of access, rectification, cancellation or opposition to the processing of your personal data, known as ARCO rights, it is important that you take into account that the right to protection of personal data is a very personal right, therefore that only you, as the owner of the personal data or, where appropriate, your legal representative may request it.
Next, we explain the procedure to follow for the presentation and attention of a request to exercise ARCO rights:


A. Requirements for submitting an application to exercise ARCO rights.

1. Submit the application to the Receiving Entity (understood in this case as the subsidiary entity or entity that has equity or shareholding or corporate relationship, of or with ECOM Agroindustrial Corporation, Ltd., with which it intends to have or has a commercial, business relationship , services and legal), such as AGROINDUSTRIAS UNIDAS DE MÉXICO, S.A. DE C.V. (AMSA), AGROINDUSTRIAS UNIDAS DE CACAO, S.A. DE C.V. (AMCO), CHIAPAS SPECIALTY COFFEE, S.A.P.I. OF CV. (CAFESCA), AGROFORESTAL VALLE DE NEJAPA, S.A. DE C.V. (NEJAPA), PROFESSIONAL AND OPERATIONAL SERVICES PROVIDER, S.A. DE C.V. (PRESPO), MEXICAN FOREST PARK, S.A. DE C.V. (PARFOMEX), AGRI TRUS, S.A. DE C.V., AGRO COVERAGE, S.A. DE C.V., LIOFILIZADOS MEXICANOS DE ALTURA, S.A. DE C.V., AGROBIOTECNOLOGIA INDUSTRIAL DE MEXICO, S.A. DE C.V. (ABIM) and/or AGROCACAO INDUSTRIAL, S.A.P.I DE C,V. (AGROCACAO), GRUPO AGROFORESTAL UUMBAL, S.A.P.I. DE C.V. (GAU), AGROFORESTAL UUMBAL CHIAPAS, S.A.P.I. DE C.V. (AUC), AGROFORESTAL UUMBAL VERACRUZ, S.A.P.I. DE C.V. (AUV), AGROINDUSTRIAL UUMBAL S.A.P.I. DE C.V. (AIU), FARM CARROLL DE MEXICO, S. DE R.L. DE C.V. (GCM), with address at BOSQUE DE ALISOS 45 A, PISO 2, COLONIA BOSQUES DE LAS LOMAS, DELEGACIÓN CUAJIMALPA, ZIP CODE 05120, CIUDAD DE MEXICO) that owns the personal data, through the means and mechanisms indicated in the notice of privacy, with the following information:
General information. Any request to exercise ARCO rights must contain the following information:

  • Name of the owner of the personal data.
  • Documents proving the identity of the holder.
  • If applicable, name of the legal representative of the holder and documents to prove his identity and personality.
  • Specify the means to receive notifications.
  • Clear and precise description of the personal data that you want to rectify, cancel or oppose to its treatment.
  • Description of the right to be exercised or what the owner requests.
  • If applicable, documents or information that facilitate the location of personal data, including the administrative unit responsible for processing.

Specific information. In addition to the general information indicated above, depending on the right you wish to exercise, you must include the following information in the request:

  • Right of ACCESS: the modality in which you prefer the requested personal data to be reproduced.
  • Right of RECTIFICATION: the modifications that you request to be made to the personal data, as well as providing the documents that support the request.
  • Right of CANCELLATION: the causes that motivate the request to delete the data from the files, records or databases of the data controller.
  • Right of OPPOSITION: the causes or the situation that lead you to request that the processing of your personal data be terminated, as well as the damage or harm that said processing would cause you to continue; or, you must indicate the specific purposes for which you wish to exercise this right.

It is important that you take into account that, if the request does not have the information described above, the Receiving Entity may request the missing information by means of a REQUIREMENT, which must be issued within a maximum period of 5 business days. from the day after the application is submitted, and you will have 10 business days, after receiving the warning, to provide the required information, otherwise your application will be considered not submitted.

2. When you submit your request, the person in charge must give you an ACKNOWLEDGMENT stating the date of receipt of the request.

Prove the identity of the holder and, where appropriate, that of his legal representative, as well as the personality of the latter.

The request must be accompanied by a simple copy of an official identification of you as the owner of the personal data, as well as of your legal representative, in case this is the one who submits the request.

Among the valid official identifications are: voting card, passport, military card, professional license, driver’s license and immigration document.

The personality of your legal representative, if any, can be accredited, in the case of a natural person, you can choose any of the following three options:

1) The presentation of a simple power of attorney signed before two witnesses, attaching a simple copy of their official identification; 2) By public instrument (document signed by a Notary Public); or, 3) Going you and your representative to testify in appearance before the person in charge.

It is important to bear in mind that the identity of the owner and his legal representative, as well as the personality of the latter, must be duly accredited prior to the exercise of the right in question, if applicable, by means of the presentation of the aforementioned original documents or a certified copy thereof, for comparison.

3. Take into account the following rules of representation in case of requests related to personal data of minors, people in a state of interdiction or disability declared by law.

For the exercise of ARCO rights of this group of holders, in addition to submitting the application with the information described in requirement 1, the following documents must be provided, as the case may be:

For requests to exercise the ARCO rights of personal data of minors:

If the parents exercise parental authority and they are the ones who present the request:

  • Document proving the identity of the minor.
  • Minor’s birth certificate.
  • Official identification of the father or mother, who intends to exercise the right.

If a person other than the parents is the one who exercises parental authority, and is the one who files the application:

  • Document proving the identity of the minor.
  • Minor’s birth certificate.
  • Legal document that proves the possession of parental authority.
  • Official identification of the person who submits the application and has parental authority.

When a guardian is the one who exercises parental authority:

  • Document proving the identity of the minor.
  • Minor’s birth certificate.
  • Legal document proving guardianship.
  • Official identification of the guardian.

For requests for ARCO rights of personal data of people in a state of interdiction or legal incapacity:

  • Document proving the identity of the owner of the personal data.
  • Legal instrument of appointment of the guardian.
  • Official identification of the guardian.
  • Letter stating, under protest to tell the truth, that he exercises guardianship, and that he is not within any of the legal assumptions of suspension or limitation of the same. ul>

B. Deadlines and procedure for handling requests to exercise ARCO rights.

Once the request has been submitted and that it complied with the requirements described above, the person in charge to whom it was submitted must do the following:

  • Within a period of 20 business days, counted from the day following receipt of the request, you must inform you whether or not the exercise of the requested right proceeds.
  • In the event that the exercise of the right has proceeded, you must carry out the necessary actions to make it effective, within a period of 15 business days, counted from the day after the previous response was notified.

The aforementioned deadlines can be extended for an equal period, when justified and you are informed of it.

The exercise of ARCO rights will be simple and free, charges may only be made to recover the costs of reproduction, certification of documents or sending of information.

Notwithstanding, if the same person repeats his request for access in a period of less than 12 months, the costs will not be greater than three days of the General Minimum Wage in force in Mexico City, unless there are substantial modifications to the notice. of privacy that motivate new consultations.

Lastly, when the provisions applicable to certain databases or treatments establish a specific procedure to request the exercise of ARCO rights, the provisions of those that offer greater guarantees to the owner, and do not contravene the provisions set forth, shall apply. in the Law.

C. Personal Data Deletion Procedure.

Once the request for deletion of personal data is received, the various areas of the Receiving Entity will be requested to proceed to attend to the request received, in order to carry out the reasonable actions necessary to carry out said deletion.

The area that will identify the applicant’s personal data will inform the Privacy Department of said situation and the data elimination treatment carried out.

The Privacy area will centralize the attention to the applicant regarding any doubt or question about the deletion of data carried out.