Suppliers Privacy Notice

Suppliers Privacy Notice

This privacy notice, hereinafter the “NOTICE”, is issued in compliance with Article 15 of the Federal Law on Protection of Personal Data Held by Private Parties, hereinafter the “LAW”, and the corresponding provisions of the Regulations of the Federal Law on Protection of Personal Data Held by Private Parties, hereinafter the “REGULATIONS”, and is made available to suppliers who provide personal data or information to AUTOBUSES RÁPIDOS DE ZACATLÁN, S.A. DE C.V., its affiliated, subsidiary, controlled or controlling companies, hereinafter the “CONTROLLER”.

1. Controller responsible for the protection of your Personal Data

The “CONTROLLER”, with address to receive notifications at Artilleros Número 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico, is responsible for the processing of your personal data.

In its capacity as controller of personal data, the “CONTROLLER” observes the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility as established by the “LAW”.

2. Means and methods of contact

To contact us, you must submit an application written in Spanish addressed to the PERSONAL DATA PROTECTION OFFICE of the “CONTROLLER”, and deliver it in person or by postal mail to the address: Artilleros Street #123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico or via email to: datos.personales@grupoado.com.mx

3. Personal data we collect and means of obtaining Personal Data

The personal data we collect from you for the purposes described in this “NOTICE” are obtained when you provide them to us through our employees, the website https://proveedores.ado.mx/DPA_PACFE_ADO, mobile applications, by telephone, by email, and when we obtain information through other sources of public access allowed by the “LAW” and the “REGULATIONS”.

The data we collect are the following:

From individuals: Full name and surnames, image, official identification, signature, email address, and telephone numbers. Regarding patrimonial data such as Tax ID (RFC), tax address, and banking account information, by having a contractual relationship with the “CONTROLLER” you give your express consent for the processing of such data in accordance with Article 8 of the “LAW”.

From legal entities: Corporate name as stated in the Articles of Incorporation, Power of Attorney of the legal representative and address. From the legal representative or attorney-in-fact: full name and surnames, image, official identification, signature, email, and telephone numbers. Regarding patrimonial data of the company such as Tax ID (RFC), tax address, and banking account information, the attorney-in-fact or legal representative gives express consent for the processing of such data in accordance with Article 8 of the “LAW” by virtue of the contractual relationship with the “CONTROLLER”.

Since the “LAW” allows additional sources of information such as physical or electronic telephone and service directories, the data that may be obtained by such means include: name and surnames, telephone number, and email address.

3.1. Personal Data of third parties

The “CONTROLLER” may process identification and contact personal data such as full name, email address, and telephone number of third parties—such as employees of the supplier, supplier’s authorized persons, supplier’s references, joint obligors, guarantors or sureties—when you provide them for the fulfillment of the contractual relationship or to participate in the evaluation, selection and contracting process. By providing such data, you acknowledge that you have informed said third parties of the use of their personal data, obtained their prior consent for the “CONTROLLER” to process their data for the aforementioned purposes, and informed them of this privacy notice.

3.2 Sensitive Personal Data

The “CONTROLLER” will not collect nor process any type of sensitive personal data.

4. Purposes of the Processing of Personal Data

Your personal data will be used for the following purposes:

Primary Purposes: Purposes that give rise to and are necessary for the existence, maintenance, and fulfillment of the legal relationship between you and the “CONTROLLER”:

• Identification and contact.
• Participation in the evaluation, selection and contracting process.
• Verify and confirm your identity as a supplier as well as the authenticity of the information you provide, including that of your authorized third parties such as your references, joint obligors, guarantors or sureties and supplier’s employees, as applicable.
• Carry out internal and external investigation processes and conduct audits.
• Quote products and/or services.
• Draft, verify, and monitor compliance with the object of the executed contract, and, where appropriate, its renewal.
• For control, surveillance, and access to the “CONTROLLER’s” facilities. Upon entering our facilities, you may be video recorded or photographed; therefore, you are hereby informed that images from video recordings or photographs will be protected under the “LAW” and the “REGULATIONS” and will be stored in databases for a period of ten calendar days, after which the video recordings or photographs will be formatted or deleted.
• Billing or payment derived from the contractual relationship.
• Creation, update, customization, maintenance, and authentication of your user account.
• Handling of inquiries, complaints, comments, suggestions, clarifications and their follow-up.
• Notify changes of conditions and maintenance of the business relationship.
• Compliance with legal and regulatory obligations, as well as requirements from Federal, State, or Municipal governmental or judicial authorities and/or regulatory entities.

Secondary Purposes: Purposes other than those arising from the legal relationship between you and the “CONTROLLER”, but which are extremely useful to provide better service:

• Marketing and commercial prospecting.
• Conduct data analysis techniques for profiling activities.

If you wish to EXPRESS YOUR OBJECTION to your personal data being processed for the aforementioned secondary purposes, you must send an email to datos.personales@grupoado.com.mx or submit a written request in Spanish to the following address: Artilleros Street #123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico, stating to which secondary purpose(s) you object.

5. Limitations on the use of data

You may limit the use or disclosure of your personal data by submitting a written request in Spanish, addressed to the PERSONAL DATA PROTECTION OFFICE of the “CONTROLLER,” to the email address datos.personales@grupoado.com.mx or to the following address: Artilleros Número 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico, stating your intention to limit the use or disclosure of your personal data and providing necessary details such as: full name and surnames, a simple copy of your official identification, supplier number (if you have one), telephone number, and address or email. In the event that the request is submitted by your attorney-in-fact or legal representative, they must additionally attach official documents proving such representation.

In addition to the procedure described in the paragraph above, you may unsubscribe from emails we send for marketing purposes by clicking the link included at the bottom of each such email.

6. ARCO Rights

You or your duly accredited legal representative may exercise, when applicable, the rights of access, rectification, cancellation, or opposition, hereinafter “ARCO RIGHTS,” provided by the “LAW,” through the mechanism described below. It is important to mention that exercising any of the “ARCO RIGHTS” does not prevent the exercise of any other right.

7. National and international transfer of data

Your personal data will not be transferred nationally or internationally to third parties without your consent, except as provided in Article 37 of the “LAW”:

• When the transfer is made between controlling companies, subsidiaries, or affiliates under the common control of the “CONTROLLER,” or to a parent company or any company of the same group of the “CONTROLLER” operating under the same internal processes and policies.
• When the transfer is necessary for medical prevention or diagnosis, the provision of health care, medical treatment, or the management of health services.
• When the transfer is necessary by virtue of a contract executed or to be executed in your interest, by the “CONTROLLER” and a third party.
• When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the “CONTROLLER” and you, such as banking and credit institutions, chambers of commerce, business partners, among others.
• When the transfer is necessary or legally required for the safeguarding of a public interest, or for the procurement or administration of justice, or when requested by competent authorities.

8. Information on the Internet

We inform you that we use electronic technologies (cookies and web beacons) on our website https://proveedores.ado.mx/DPA_PACFE_ADO. Therefore, when you access our Internet portal, we receive information such as: your browser type and operating system, the Internet pages you have recently visited, the links you have recently followed, the IP address of your computer, and the site you exited before entering our Internet portal.

You may disable or adjust the use of these technologies by following the procedures of the Internet browser you use to access our website.

8.1. Disclaimer of liability for our website or application

By browsing or using our website https://proveedores.ado.mx/DPA_PACFE_ADO or applications, you may find hyperlinks, links, banners, buttons, owned by third parties that may request your personal data (hereinafter “Third-Party Sites”). The personal data that you provide through these portals or Internet sites shall be subject to the Privacy Notices displayed and applicable to those portals and Internet sites; therefore, the “CONTROLLER” shall not be responsible for the use, publication, disclosure and/or dissemination that you make of your personal data through the aforementioned means. We recommend that you be careful and responsible with the personal information you provide on such media.

9. Data retention

The “CONTROLLER” will retain your information for as long as it is needed for the purpose for which it was collected, unless you request its deletion, and in such case, provided that the “CONTROLLER” no longer needs to retain your information for other reasons. The “CONTROLLER” may retain your personal data for longer periods than those required by applicable laws, if it is in our legitimate business interest and the law does not prohibit it.

Please note that when we have collected your personal information based on your consent and you withdraw such consent, or exercise your ARCO rights (to have your personal information deleted), we may keep your information blocked and available for as long as required to comply with applicable laws and for the “CONTROLLER” to comply with its responsibilities arising from the processing of your data.

10. Modifications to this privacy notice

The “CONTROLLER” reserves the right to make modifications or updates to this “NOTICE” at any time. Any modifications made will be made available to you through one or more of the following means: visible notices at our facilities, via our website https://proveedores.ado.mx/DPA_PACFE_ADO, mobile applications, by email to the most recent address we have on record for you, by means of posters, audio recordings, or video.

11. Consent

The fact that you provide us with your data by any means implies that you give your free, specific, informed, and unequivocal consent for their processing, under the terms of this privacy notice, without prejudice to your right to exercise your ARCO rights.