Comprehensive Privacy Notice from Ehecatl and Websites. /

Privacy Policy /

The requested personal identification data (including geolocation), and contact information, collectively referred to as ("Personal Data"), are processed by Servicios de Software Ehecatl SA de CV, as the data controller (hereinafter "Ehecatl", which includes the following trade names and websites: muestreo.com.mx, codigovainilla.com, pruebademanejo.com.mx, frameworkabierto.org), with its address at Avenida Tiburón 430 7 Costa de Oro, C.P. 94299, Boca del Rio, Veracruz, for the following primary purposes:

• Updating our databases;
• Creating your account for the purchase of products or services;
• Customer support for clients with an active service contract;
• Online purchases;
• Responding to questions, complaints, comments, suggestions, clarifications;
• Processing your order and product delivery;
• Processing payments and issuing invoices if required;
• Service quality assurance;

We may process your Personal Data for the following secondary purposes:

• To send you promotions, advertisements, benefits, and discount coupons from Ehecatl and companies in the same corporate group such as subsidiaries, affiliates, parent or controlled entities, and even third-party business partners and suppliers;
• To carry out analyses to offer and potentially provide financial products and/or services in accordance with existing regulations;
• To understand your consumer habits, preferences, and tastes to offer you suitable products;
• To conduct marketing studies, market segmentation, statistics; and to invite you to participate in our events, contests, giveaways, promotions, and activities on social networks, websites, stores, mobile apps, call centers, etc., where we may ask participants for images, photos, or videos of themselves to be published on electronic or mass media.

You may object to the processing of your Personal Data for secondary purposes within 5 business days after giving your consent to this Privacy Notice by emailing: [email protected]

By registering your account, making a purchase, or subscribing to our newsletter, you expressly consent to the collection of your Personal Data for the purposes outlined in this Privacy Notice.

We may transfer your Personal Data to third parties with whom we have a legal relationship, for which we will previously obtain your consent in the following cases:

• I. To send you offers and/or advertisements;
• II. To conduct market research or surveys;

Additionally, and in accordance with applicable legislation, we may transfer your personal data without prior consent to:

• III. National or international companies of the same group, such as subsidiaries, affiliates, parent or controlled companies of Ehecatl for the purposes described in this Privacy Notice.
• IV. Third parties that assist with your online purchase process.

Additionally, your Personal Data may be sent by Ehecatl, without your consent, to service providers with whom there is a legal relationship and who act as data processors under the terms established by law, in the following cases:

• I. Third-party consultants or auditors, national or foreign, to monitor legal compliance, and adherence to our internal policies, procedures, and protocols.

Such parties may not use your data in ways other than those described in this Privacy Notice. These transfers will be carried out with all appropriate security measures in accordance with the principles of the Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, and the Privacy Notice Guidelines (collectively referred to as "The Legislation").

In addition to the information you provide, Ehecatl may collect data such as your IP address, MAC address, browser type, domain name, specific pages visited, and the time spent on our website. Cookies and web beacons may also be used to gather statistics on browsing behavior and display relevant product information.

Your personal data is stored in controlled databases with limited access. Most browsers offer a "help" button that tells you how to avoid new cookies, be notified of new cookies, or disable cookies altogether.

When you make an online purchase, your banking data will be handled securely and confidentially using SSL certificates signed by a valid certificate authority (Global Sign), encrypted via the SHA256 algorithm and TLS 1.2 protocol, ensuring information is securely transmitted. Look for an “S” in your browser’s address bar (“https://”) to confirm secure browsing.

Your Personal Data will be processed in accordance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility under the applicable law. We will maintain the confidentiality of your data using administrative, technical, and physical safeguards to prevent damage, loss, alteration, destruction, unauthorized use, or disclosure.

Any changes or updates to this Privacy Notice will be communicated on the following website: https://www.ehecatl.com.mx/aviso-de-privacidad.php

Procedure to address ARCO Rights (Access, Rectification, Cancellation, and Opposition), withdrawal of consent, and limitation of use or disclosure of Personal Data.

The Personal Data you provide in any ARCO Rights request or related request will be used for the following primary purpose:

• To process, investigate, resolve, and respond to any of the aforementioned requests.

ARCO Rights and Withdrawal of Consent

To initiate an ARCO Rights request (Access, Rectification, Cancellation, or Opposition) or to withdraw your consent, you may use the following methods:

• a) By email to: [email protected], specifying your ARCO request and including valid official ID to confirm your identity. A request number will be provided afterward.
• b) Via written request addressed to the Privacy Office.

Limiting Use or Disclosure

You may limit the use or disclosure of your data to stop receiving promotional messages via the following methods:

• 1. a) (i) Use the unsubscribe link included in emails or SMS messages; (ii) Register your phone number with Mexico’s “Public Registry to Avoid Advertising” (REPEP) from PROFECO. Visit www.profeco.gob.mx for more info.
• 2. b) Via written request to the Privacy Office.

Written Request to the Privacy Office

Requests must be submitted to Avenida Tiburón 430 7 Costa de Oro, C.P. 94299, Boca del Río, Veracruz and must include:

• 1. Full name of the applicant and their email and/or mailing address for response purposes.
• 2. A clear and specific description of the Personal Data for which the request is made, including supporting documents or references.
• 3. A legible copy of valid official ID, and in case of a legal representative, a notarized power of attorney or signed letter with two witnesses, plus ID of the representative.
• 4. For Rectification requests, supporting documentation must be attached.

Once your request is submitted, the Privacy Office may request additional information within 5 business days. You will then have 10 business days to respond. Otherwise, your request will be considered void.

The Privacy Office will respond within 20 business days. If your request is granted (partially or fully), they will implement the resolution within 15 business days.

These timelines may be extended once if necessary, with notification via the contact method provided in your request.

Exercise of ARCO Rights and consent withdrawal are free of charge, except for shipping or reproduction costs, if applicable.

If you believe your Personal Data has not been properly protected, you may contact the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI). For more information, visit: www.inai.org.mx

Last update date: 10/16/2018