Notice of Privacy

SIR SAS DE CV.

1. RESPONSIBLE FOR PERSONAL DATA:

SIR SAS DE CV, (hereinafter CARRUSO) with address at Paseo de la Reforma N° 25, 17th floor, Col. Juárez, Alcaldía Cuauhtémoc, CP 06600, Mexico City and internet portal

​www.carruso.com.mx, is responsible for your personal data, and therefore, is a company committed to the right to protection of personal data of any owner, which is guaranteed and protected, as a human right, in the second paragraph of article 16 of the Political Constitution of the United Mexican States.

This Privacy Notice is regulated, in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter Law), its Regulations, as well as the Guidelines of the Privacy Notice (hereinafter Legislation). ). Therefore, this Privacy Notice (hereinafter Privacy Notice) applies to the personal information collected about you by CARRUSO. The terms used in this Privacy Notice and that are not defined therein will have the meaning attributed to them in the Legislation. personal, is obliged, in an enunciative manner, but not limited to:

1. Use or apply your personal data exclusively for the purposes established in this Privacy Notice.P

2. Ensure that your personal data is handled with strict adherence to professional secrecy and confidentiality.

3. Observe the protection principles such as legality, consent, information, quality, purpose, loyalty, proportionality and responsibility, as well as the security and confidentiality duties provided for in the Legislation.

4. Implement and maintain administrative, technical and physical security measures that protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing.

Primary purposes:

They are those necessary to maintain the legal relationship between Carruso and the owner of the data, which are listed below:

· Identify and contact the owner of the data in relation to the contracted services;

· Operation, administration, monitoring and marketing of our services;

· Provide the data owner with efficient service and better attention;

· Collection and billing of our services;

· Information about improvements, updates, changes and modifications that are related to what was contracted by the data owner;

· Attention to requests from the data owner;

· Comply with obligations contracted with the data owner;

· Hiring of personnel, in which case the purpose will be to carry out the recruitment and selection process, and Hiring of suppliers.

Secondary purposes:



They are those that are not necessary to maintain the legal relationship between Carruso and the owner of the data, which are listed below:

· Information about new products or services;

· Sending information related to Carruso;

· Statistical data;

· Consultations and surveys, and Advertising services;

· Commercial prospecting;

If you do not want your personal data to be processed for secondary purposes, you can, at any time, oppose the processing for said purposes by exercising your right to object, in accordance with this PRIVACY NOTICE.

3. PERSONAL DATA COLLECTED:

To fulfill the previously mentioned purposes, Carruso will collect identification, fiscal, financial and/or property, contact, electronic data; fiscal and legal. In the case of hiring personnel, in addition to the above, academic data will be collected; labor and health. The aforementioned data is obtained from the owner when he or she provides it to Carruso, having previously read this PRIVACY NOTICE, or from the documents required by the owner of the data. Carruso does not collect sensitive personal data.

4. TRANSFER OF PERSONAL DATA:

Your personal data may be transferred, inside and outside the country, to the following people, authorities, companies or organizations other than Carruso, as long as it arises from the relationship between Carruso and the owner of the data, which are listed below. :

RECIPIENT OF PERSONAL DATA PURPOSE

• Secretariat of Finance and Public Credit
• Service tax administration
• Judicial and/or Administrative Authorities

Compliance with fiscal and/or administrative obligations; or, at the express request of the recipient; or when the intervention of the recipient is required.

• Affiliated, controlling or subsidiary companies of Carruso

Compliance with the legal relationship between Carruso and the data owner; Compliance with internal policies; Improvement in the quality of Carruso services.

• Suppliers

Assist in the fulfillment of the object of the legal relationship between Carruso and the owner of the data.

• Firms and/or external consultants

Assist in compliance with contractual and tax obligations.

Credit investigation.

Exercise the appropriate legal actions.

• Institutions that are members of the Mexican Banking System, legally authorized by the Ministry of Finance and Public Credit and the National Banking and Securities Commission.

Payment for products or services that are the subject of or derive from the relationship between Carruso and the owner of the data.

In the case of personnel hired by Carruso, your personal data will be shared with:

RECIPIENT OF PERSONAL DATA PURPOSE

• Service tax administration
• Secretariat of Finance and Public Credit
• Mexican Social Security Institute
• Institute of the National Housing Fund for Workers

Compliance with fiscal and/or administrative obligations that derive from the contractual relationship between Carruso and the owner of the data.

Compliance with obligations established in the Federal Labor Law, the Social Security Law and the Law of the Institute of the National Housing Fund for Workers; as well as the Official Mexican Standards.

• Institutions that are members of the Mexican Banking System, legally authorized by the Ministry of Finance and Public Credit and the National Banking and Securities Commission.

Payment of salaries, and other benefits derived from the contractual relationship between Carruso and the owner of the data.

• Firms and/or external consultants

Assist in compliance with contractual and tax obligations.

Credit investigation.

Exercise the appropriate legal actions.

Those cases in which any authority in a well-founded and motivated manner requires personal data, as well as the transfers provided for in this section, may be carried out without the consent of the owner of the data by virtue of the provisions of article 37 of the LAW, which are cases of exception to consent.

5. ARCH RIGHTS:

You have the right to access your personal data, rectify it if it is inaccurate, cancel it when you consider it to be excessive or unnecessary for the purposes described, or oppose its processing for specific or secondary purposes.

The application you submit to exercise your ARCO rights must contain:

· Name of the owner of the personal data.

· Simple copy of the document that proves the personality of the data owner.

· Address or email to communicate the response to your request.

· A clear and precise description of the ARCO right(s) that you wish to exercise, as well as the personal data that is the subject of your request.

· Any other element or document that facilitates the location of your personal data.

· The request must be signed at the end of the document and initialed at the bottom of each of the pages.

Once your request to exercise your ARCO rights is at our disposal, we will issue the respective determination within a period of no more than 20 business days from its receipt. We will inform you of this at the address or email address you indicate and, if your request is appropriate, we will make it effective within 15 business days following the date on which we have communicated the respective determination.

You may revoke your consent for the processing of your personal data at any time, through the previously indicated procedure, expressing your desire to revoke the consent granted to Carruso.

However, you should take into account that not in all cases we will be able to respond to your request or terminate the use immediately, since it is possible that due to some legal obligation we will be required to continue processing your personal data. Likewise, you must consider that, for certain purposes, the revocation of your consent will mean that we will not be able to continue providing you with the service you requested from us, or the conclusion of your relationship with us.

6. MANAGEMENT OF COOKIES AND/OR WEB BEACONS:

Cookies are used by Carruso to improve the efficiency of its websites, and are text files that are stored on the hard drive of your computer when you visit some websites, which allows us to identify applications of the website in which it may have greater interest. Most browsers are configured to accept Cookies, so you can at any time disable or adjust the use of cookies, according to the instructions of the browser or Internet viewer you use.

Carruso does not collect personal data through this type of mechanism.

7. CHANGES TO THE PRIVACY NOTICE:

This PRIVACY NOTICE may be modified, changed or updated due to new legal requirements; of our own needs for the services we offer; of our privacy practices; Changes in our business model, or other causes.

Carruso undertakes to keep data owners informed of any changes to this PRIVACY NOTICE, through our website.www.carruso.com.mx

8. RIGHT OF THE OWNERS OF PERSONAL DATA:

If you consider that your right to the protection of personal data has been violated by any conduct of our employees or our actions or responses, you can go to the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI). ), whose website is www.ifai.org.mx