This Privacy Policy is issued in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter referred to as the "Law") and its regulations, and the other provisions related to the Treatment of Personal Data in effect in Mexico (hereinafter referred to as the "Applicable Legislation"). It shows the commitment of Grupo Lamosa, S.A.B. de C.V. (hereinafter referred to as "Grupo Lamosa") and its subsidiaries and affiliates to protect all information concerning any individual provided to the company, either directly or indirectly, verbally or through printed, electronic, digital, optical, audio or visual means, and/or by any other means (hereinafter referred to as the "Personal Data") by any of the following: (A) suppliers and customers, (B) those individuals who (i) apply for employment with any of the Grupo Lamosa subsidiaries or affiliates by filling out a job application, regardless of whether it is on a formal application form or in a manner unauthorized by the corresponding subsidiary or affiliate, and/or by delivering additional documents requested or provided in relation to the job selection procedure and (ii) have been hired to occupy a position in any of the subsidiaries or affiliates of Grupo Lamosa. This Privacy Policy establishes the terms and conditions under which the Personal Data found in the database controlled by the Data Steward (as defined later in this document) will be obtained, used, stored, disclosed and, where necessary, transferred (hereinafter referred to as the "Use") and utilized by the subsidiaries and affiliates of Grupo Lamosa.
It is made known herein that, despite the fact that the Personal Data of a given individual are delivered or directed to Grupo Lamosa and/or its subsidiaries and/or its affiliates, Servicios Administrativos Lamosa, S.A. de C.V., a subsidiary of Grupo Lamosa (hereinafter referred to as the "Data Steward"), will act as the entity that will process the Personal Data on behalf of Grupo Lamosa in the terms of the Applicable Legislation. Said entity has its official domicile at Av. Pedro Ramírez Vázquez 200 -1, Colonia Valle Oriente, 66269 San Pedro Garza García, Nuevo León, which will be used to hear and receive notifications.
Personal Data Used by Grupo Lamosa
In order to fulfill the purposes indicated in this Privacy Policy, Grupo Lamosa will use the Personal Data indicated in, but not limited to, the following list: (i) full name, (ii) date of birth, (iii) e-mail, (iv) telephone(s), (v) workplace, (vi) address and (vii) any other information that is furnished to the company in accordance with the stated purposes.
In the event that the legal relationship between an individual and Grupo Lamosa so requires, it is hereby stated that Grupo Lamosa may use Personal Data that affect the most intimate sphere of their owner, or whose use may give rise to discrimination or entail a serious risk to the owner, including, but not limited to: (i) clinical history (including, but not limited to: (a) medical history, (b) medical and/or surgical treatments and (c) allergies, among others), (ii) present or future state of health, (iii) genetic information and (iv) union membership (hereinafter "Sensitive Personal Data"). We hereby state that Grupo Lamosa will only use Sensitive Personal Data in order to facilitate compliance with the obligations derived from the legal relationship that Grupo Lamosa has with an individual and for the fulfillment of the purposes explained later in this document.
Additionally, Grupo Lamosa may collect from an individual the financial information and/or data on personal assets that are necessary and/or convenient to comply with the obligations of Grupo Lamosa derived from the legal relationship that exists between Grupo Lamosa and the individual (hereinafter “Data on Personal Assets” and/or “Personal Financial Information”), with the understanding that said Personal Financial Information and/or Data on Personal Assets will be used in accordance with the provisions of this Privacy Policy. Personal Financial Information and/or Data on Personal Assets may include, without being limited to: (i) type and number of a bank account, (ii) name of a bank, (iii) interbank CLABE (standardized bank account code) and (iv) name of the beneficiary.
Purpose of the Use of Personal Data
Personal Data will be handled and used in accordance with this Privacy Policy, and will be used in a general way and as necessary to fulfill all or any of the following purposes, depending on each case:
(A).- Clients and Suppliers: Grupo Lamosa may use Clients’ and Suppliers’ Personal Data, Sensitive Personal Data and/or Personal Financial Information and/or Data on Personal Assets for the following purposes: (1) the evaluation of a possible commercial relationship between the Client or Supplier and any of the subsidiaries or affiliates of Grupo Lamosa, such that, if said relationship were to materialize or be formalized, the Personal Data, Sensitive Personal Data and/or Personal Financial Information and/or Data on Personal Assets would be stored and used to comply with the purposes and commitments assumed by the respective subsidiary or affiliate of Grupo Lamosa including, without being limited to, disclosing or transferring Personal Data, Sensitive Personal Data and/or Personal Financial Information and/or Data on Personal Assets to third parties not related to Grupo Lamosa that/who require knowledge of the personal data to enable the fulfillment of the aforementioned purposes and commitments; (2) marketing products and/or providing services by the respective subsidiary or affiliate of Grupo Lamosa; (3) developing and implementing service or product improvement programs; (4) developing and implementing commercial or marketing strategies related to the products and/or services offered by any of the subsidiaries and/or affiliates of Grupo Lamosa; (5) the security of the Client or Supplier concerned, that of our offices and/or that of the people who visit us; (6) to send updating information or information on events that Grupo Lamosa deems relevant and that relates to the products and/or services offered by any of Grupo Lamosa’s subsidiaries and/or affiliates; and (7), where applicable, to process a payment, to request a payment from a financial institution, and/or to make a payment derived from, or related to, the legal relationship that exists between Grupo Lamosa and a given Client or Supplier (hereinafter the “Primary Purposes for Clients and Suppliers”).
(B).- Employees and Potential or Contracted Workers: Grupo Lamosa may process Personal Data, Sensitive Personal Data and/or Personal Financial Information and/or Data on Personal Assets of Employees and/or Potential or Contracted Workers for the following purposes: (1) the consideration, evaluation and selection of candidates for a position in any of the subsidiaries and/or affiliates of Grupo Lamosa; (2) the creation, storage and consultation of a database of potential candidates to occupy a position in the future in any of the subsidiaries and/or affiliates of Grupo Lamosa; and/or (3) in cases where the owner of the Personal Data, Sensitive Personal Data and/or Personal Financial Information and/or Data on Personal Assets has been selected and hired to occupy a position in any of the subsidiaries or affiliates of Grupo Lamosa, to comply with the labor obligations that result from the employment relationship and also when the owner of the data is being considered to occupy a different position in the same or another subsidiary or affiliate of Grupo Lamosa; (4) to protect the security of the Employees and/or Potential or Contracted Workers, that of our offices and/or that of the people who visit us; (5) to send updating information or information on events that Grupo Lamosa deems relevant for the legal relationship between the Employees and/or Potential or Contracted Workers and Grupo Lamosa; and (6), where appropriate, to process a payment, to request a payment from a financial institution, and/or to make a payment derived from, or related to, the legal relationship that exists between Grupo Lamosa and the Employee and/or Potential or Contracted Worker (hereinafter, the “Primary Purposes for Employees”).
Notwithstanding the foregoing, and only in those cases where the owner of the information does not expressly state otherwise for this purpose, Grupo Lamosa may use the Personal Data of Employees and/or Potential or Contracted Workers for purposes that do not derive directly from the fulfilling of the obligations inherent in the legal relationship between Grupo Lamosa and the individual, such as in informational, advertising and/or promotional media (hereinafter the "Secondary Purposes”).
The fulfilling of any of the purposes established above will include, without being limited to, disclosing or transferring Personal Data, Sensitive Personal Data and/or Personal Financial Information and/or Data on Personal Assets to third parties not related to Grupo Lamosa who/that require knowledge of the Personal Data, Sensitive Personal Data and/or Personal Financial Information and/or Data on Personal Assets to enable the fulfilling of the aforementioned purposes and commitments.
Security Measures for the Protection of Personal Data
Grupo Lamosa, aware that Personal Data, Sensitive Personal Data and/or Data on Personal Assets and/or Personal Financial Information may include private and confidential information concerning the owner thereof, recognizes the importance of protecting the privacy and confidentiality of said Personal Data, Sensitive Personal Data and/or Data on Personal Assets and/or Personal Financial Information, so it is obliged to maintain the privacy and/or confidentiality of said information, adopting the same protection measures that Grupo Lamosa uses regularly to preserve the confidentiality of its own information, with the purpose of restricting the Use of Personal Data, Sensitive Personal Data and/or Data on Personal Assets and/or Personal Financial Information exclusively to the purposes for which they were collected, as well as to protect them from unauthorized loss, alteration and destruction.
Use of Personal Data
The Use of Personal Data, Sensitive Personal Data and/or Data on Personal Assets and/or Personal Financial Information will be limited exclusively to those personnel of Grupo Lamosa or its subsidiaries and/or affiliates who, by virtue of the functions they perform within the organization, require access to the Personal Data, Sensitive Personal Data and/or Data on Personal Assets and/or Personal Financial Information to comply with the purposes established in this Privacy Policy, as appropriate.
The Use of Personal Data, Sensitive Personal Data, Data on Personal Assets and/or Personal Financial Information will be in accordance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility, as provided in the Applicable Legislation. Grupo Lamosa does not intend to market Personal Data, Sensitive Personal Data, Data on Personal Assets and/or Personal Financial Information to third parties in any way. However, in those cases established by the Law, the Use or transfer of personal data may be carried out without the consent of the owner.
Transfer of Personal Data
Grupo Lamosa would like to clarify that, in certain cases, in order to comply with the purposes established in this Privacy Policy, Personal Data, Sensitive Personal Data, Data on Personal Assets and/or Personal Financial Information may be shared with, or transferred to, as the case may be, the subsidiaries and/or affiliates of Grupo Lamosa or to a third party that provides any type of service related to, or necessary for, the legal relationship between Grupo Lamosa and the owner of the said data, with the sole purpose of fulfilling the purposes described in this Privacy Policy. The respective transmission will be made, either physically or electronically (except in the case of confidential information, in which case the transmission will always be made physically), using the security measures that Grupo Lamosa regularly uses to treat its own confidential information. If the owner of the said data wishes to express his/her opposition to this purpose, said owner should contact Grupo Lamosa by sending an email to privacidad@lamosa.com. (as explained in the next section). Grupo Lamosa, within a maximum period of 20 (twenty) business days, counted from the date the request is received, will contact the owner with the answer to the request.
Any third party that receives Personal Data, Sensitive Personal Data and/or Data on Personal Assets and/or Personal Financial Information from Grupo Lamosa is aware of the terms and conditions of this Privacy Policy and, therefore, is subject to them in accordance with that established in Article 36 (thirty-six) of the Law.
ARCO Rights of the Owner of Personal Data
The owner of the Personal Data, Sensitive Personal Data and/or Data on Personal Assets and/or Personal Financial Information, either directly or through a legal representative, may at any time revoke the consent that he/she has granted to Grupo Lamosa for the Use of his/her Personal Data, limit the Use or disclosure of the same, object to the purposes for which the Personal Data might be used and exercise the right to Access, Rectify, Cancel and/or Oppose the Use of the said data (hereinafter the "ARCO Rights"), in accordance with the terms and subject to the exceptions established in the Applicable Legislation. If the owner wishes to exercise any of the aforementioned ARCO Rights, he/she may do so by sending a Request to Access Rectify, Cancel or Oppose the use of the Data and Revoke the Consent by filling out and sending the form that can be found on the Grupo Lamosa webpage at Solicitud_Derechos_ARCO_y_
Revocaciones.pdf by e-mail to privacidad@lamosa.com or, failing that, to the official domicile of the Data Steward indicated in the introduction of this Privacy Policy, indicating or attaching, as appropriate, the information or documentation indicated in said request form. Grupo Lamosa, within a maximum period of 20 (twenty) business days, counted from the date the request is received, will contact the data owner with the answer to the request.
Modifications to the Privacy Policy
Grupo Lamosa reserves the right to periodically review and modify the terms and conditions established in this Privacy Policy in order to adapt it to its activities, reflect any changes in the internal practices of Grupo Lamosa or its subsidiaries and/or affiliates, and/or adapt it to legal reforms that might come into effect in the future. As a result of the foregoing, the Privacy Policy will be available to the owner of Personal Data, Sensitive Personal Data and/or Data on Personal Assets and/or Personal Financial Information on the company website www.lamosa.com or at the request of the data owner to Grupo Lamosa through the e-mail privacidad@lamosa.com.
Consent of the Holder of Personal Data
It shall be understood that the decision of the owner to (i) hand over Personal Data, Sensitive Personal Data and/or Data on Personal Assets and/or Personal Financial Information and/or (ii) sign this Privacy Policy constitutes in itself an unequivocal indication of the consent granted by the owner for the Use thereof in accordance with the provisions of this Privacy Policy.
It is important to note that, among other cases, the consent of the owner of the Personal Data will not be required for: (i) the Use of Personal Data when the purpose thereof is to comply with obligations derived from a legal relationship between the owner and Grupo Lamosa, in accordance with the provisions of Section IV of Article 10 (ten) of the Law; and (ii) the transfer of Personal Data to controlling companies, subsidiaries or affiliates under the common control of Grupo Lamosa, or to a parent company or any other company belonging to Grupo Lamosa that operates under the same internal processes and policies, in accordance with the provisions of Section III of Article 37 (thirty-seven) of the Law.
Revocation of the Holder's Consent
The owner of the Personal Data may at any time revoke the consent for the Use of his/her Personal Data by sending the Request for Access, Rectification, Cancellation or Opposition to the Use of Data and Revocation of Consent form that can be found on the company webpage Solicitud_Derechos_ARCO_y_
Revocaciones.pdf to the following email: privacidad@lamosa.com or, failing that, to the official domicile of the Data Steward specified in the introduction of this Privacy Policy, indicating or attaching, as appropriate, the information or documentation indicated in said request form, under the understanding that said revocation may not be retroactive. Grupo Lamosa, within a maximum period of 20 (twenty) business days, counted from the date the request is received, will contact the owner of the Personal Data with the answer to the request.
Applicable legislation
This Privacy Policy is subject to the legislation applicable in the United Mexican States.
Issue Date: 01/30/2018