PRIVACY NOTICE

OROPEZA SERVICIOS JURÍDICOS, S.C. (hereinafter referred to as the “Data Controller”), with its registered address at Corporativo Parque Reforma, Campos Elíseos 400, 14th Floor, Office I, Lomas de Chapultepec, Miguel Hidalgo, 11550, Mexico City, Mexico, in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties and its Regulations (hereinafter referred to as the “Law”), hereby makes this Privacy Notice available to you to inform you of how your personal data is collected, used, disclosed, and safeguarded, as well as to protect your privacy and your right to informational self-determination.

​

The Data Controller will collect the following personal data: full name, address, date and place of birth, nationality, citizenship, information concerning your legal representatives or attorneys-in-fact, place of residence, email address, telephone number, mobile phone number, general contact and identification information, the institution or company with which you are affiliated, Unique Population Registry Code (CURP), Federal Taxpayer Registry number (RFC), foreign tax identification number or other tax-related information (such as a Tax Status Certificate), responses to identification-related questions included in the Know Your Customer (KYC) questionnaire, and any banking information you provide to us (hereinafter referred to as “Personal Data”).

This information will be used for the purposes described below.

1. Purposes of Processing Personal Data

Your Personal Data will be used for the following purposes:

a. To provide the legal services requested or contracted, comply with legal and tax obligations, including issuing receipts, invoices, and any other documentation related to the provision of services, and communicate updates or relevant information regarding the contracted services.

b. To comply with obligations arising from any applicable law, regulation, decree, rule, administrative provision, order, circular, or other legal requirement binding upon the Data Controller.

c. To provide information requested by competent authorities.

d. To verify your identity and conduct background checks against national and international sanctions lists, as part of procedures commonly known as screening or background checks, as well as regulatory compliance and due diligence activities.

These purposes are necessary for the fulfillment of our legal and contractual obligations.

2. Sensitive Personal Data

If the Data Controller needs to collect Sensitive Personal Data (for example, financial or asset-related information), your express consent will be required for its processing, except where the Law permits such processing without consent.

3. ARCO Rights

You may exercise your rights of Access, Rectification, Cancellation, or Opposition (“ARCO Rights”) concerning your Personal Data at any time.

To exercise these rights, you must submit the corresponding request through the following contact information:

• Contact Person: María José Anahuati

• Telephone: 55 4774 9000

• Email: manahuati@oropeza-abogados.com

Your request must include:

• Your full name and contact information (address or email).

• Documents proving your identity or the legal authority of your representative.

• A clear description of the Personal Data concerning which you wish to exercise any ARCO Right. In the case of a rectification request, you must specify the requested modifications and provide supporting documentation.

4. Procedure for Exercising ARCO Rights

Upon receipt of your request, the Data Controller will provide a response within a maximum of 10 business days.

If your request is approved, the corresponding right will be exercised within the following 15 business days.

Information regarding your request will be sent to you by email or to the address you have provided.

5. Withdrawal of Consent

You have the right to withdraw, in whole or in part, the consent you have granted for the processing of your Personal Data at any time.

Please note that, in certain circumstances, withdrawing your consent may prevent us from continuing to provide the requested services or may result in the termination of our contractual relationship.

To withdraw your consent, you must submit a request through the contact channels specified above, providing the same information and documentation required to exercise your ARCO Rights.

The Data Controller will notify you of its decision regarding your request within a maximum of 10 business days.

6. Security Measures

The Data Controller has implemented the levels of personal data protection and security required by the Law. The security measures applied to Personal Data are equivalent to those used by the Data Controller to safeguard its own information.

Furthermore, given the nature of the services provided by the Data Controller, all information containing Personal Data is considered confidential.

7. Consent

If you do not agree with this Privacy Notice, you must refrain from providing your personal information, using or requesting the Data Controller's services, and accessing, browsing, or using the features and services available on the Data Controller's website.

Your consent to the processing of your Personal Data in accordance with the terms established herein will be considered tacitly granted if, after this Privacy Notice has been made available to you, you do not express any objection.

Furthermore, any submission of information, access to or use of our platforms and/or services, or participation in our forums and events will be understood as an indication of your consent to and acceptance of this Privacy Notice.

Whenever required by law for certain categories of Personal Data, the Data Controller must take affirmative steps to obtain your consent.

Your consent to the processing of Personal Data under the terms established herein will be considered expressly granted when any of the following occurs:

i. You sign a copy of this Privacy Notice.

ii. You sign any contract, service proposal, or engagement letter that refers to this Privacy Notice.

iii. You expressly indicate your agreement by selecting a checkbox provided on our websites or platforms, ensuring that your consent is given clearly and unequivocally.

iv. You provide consent through any other mechanism or procedure permitted by the Law.

By granting your consent, whether tacitly or expressly, as applicable, you also consent to any transfer of Personal Data that may be carried out by the Data Controller in accordance with the terms of this Privacy Notice.

​

1. Modifications to the Privacy Notice:

The Data Controller reserves the right to modify or update this Privacy Notice at any time due to changes in legal provisions, internal policies, or needs arising from the services it offers. Modifications will be communicated promptly by sending an email to the address you have provided.

Privacy Notice updated on May 14, 2025.