Customer Privacy Notice

 

This privacy notice, hereinafter referred to as “THE NOTICE,” is issued in compliance with the provisions of Article 15 of the Federal Law on the Protection of Personal Data Held by Private Parties, hereinafter referred to as “THE LAW,” and its corresponding Regulations, hereinafter referred to as “THE REGULATIONS.” It is made available to users who provide personal data or information to AUTOBUSES RÁPIDOS DE ZACATLÁN, S.A. DE C.V., hereinafter referred to as “THE CONTROLLER.”

 

1. Data Controller Responsible for protecting your personal data

“THE CONTROLLER,” with address for the receipt of notifications at Artilleros Number 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico, is responsible for the processing of your personal data.

In its capacity as the controller of personal data, “THE CONTROLLER” observes the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility, as established by “THE LAW.”

 

2. Contact method and means

To contact us, you must submit a request written in Spanish, addressed to the PERSONAL DATA PROTECTION OFFICE OF “THE CONTROLLER,” and deliver it either in person or by postal mail to the following address: Artilleros Number 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico; or via email to: datos.personales@grupoado.com.mx

 

3. Personal data we collect and means of obtaining personal data

The personal data we collect from users to fulfill the purposes described in this “NOTICE” are obtained directly when you provide them through our ticket counters, our websites www.turibus.com.mx, www.teper.com.mx, and www.autotur.com.mx, mobile applications, official social media accounts, instant messaging services, customer service and complaint platforms called “hola,” by telephone, by email, and when we obtain information through other publicly accessible sources permitted by “THE LAW” and “THE REGULATIONS.”

The data we collect include the following:

From individuals: Full name, gender (male or female), image, date of birth, nationality, landline number, mobile number, email address, residential address, social media or search engine credentials or passwords (when you choose to register through such platforms), age, and official identification. For foreign individuals, we may also collect the immigration status contained in the document that proves legal stay in the United Mexican States, hereinafter referred to as Mexican territory. Regarding financial or asset-related data, such as the Federal Taxpayer Registry (RFC), tax address, and payment data or information, by using this information to purchase any of our products or services, you expressly consent to the processing of such data in accordance with Article 8 of “THE LAW.”

From legal entities: From the legal representative or attorney-in-fact: full name, official identification, signature, email address, unique population registry code (CURP), date of birth, telephone number, address, and nationality. With regard to financial or asset-related data of the company, such as the Federal Taxpayer Registry (RFC), tax address, and payment data or information, the legal representative or attorney-in-fact, by using such information to purchase any of our products or services, expressly consents to the processing of such data in accordance with Article 8 of “THE LAW.”

Please note that “THE CONTROLLER” does not store any debit card, credit card, or payment method information as part of the payment processing. “THE CONTROLLER” transmits such information directly to your bank or the payment platform being used.

Furthermore, since “THE LAW” permits the use of other sources of information such as telephone and service directories, both physical and electronic, we may obtain the following data from such sources: full name, phone number, email address, and home address.

 

3.1. Personal data of third parties and minors

“THE CONTROLLER” may collect and process identification and contact personal data of third parties, such as their full name, email address, and telephone number. Additionally, for foreign nationals, we will process the immigration status contained in the document that proves their legal stay in Mexican territory, when you or such third parties provide such data for purposes related to the products and/or services contracted on behalf of said third parties. By providing this data, you acknowledge that you have informed those third parties about the use of their personal data and that you have previously obtained their consent for “THE CONTROLLER” to process their data for the purposes mentioned above.

“THE CONTROLLER” does not collect personal data of minors. Therefore, by providing your data, you acknowledge that you are of legal age, have full legal capacity, and have read this privacy notice. In the event that, as an exception, personal data of minors or persons with natural or legal incapacity established by law are collected and processed, such as name and age—and additionally, for minors or incapacitated foreign persons, the immigration status contained in the document that proves their legal stay in Mexican territory—such data will be collected and processed only with the prior consent of the person exercising parental authority, guardianship, or legal representation, in accordance with applicable laws.

If “THE CONTROLLER” identifies that a minor or a person with natural or legal incapacity has provided personal data without the consent of the person exercising parental authority or their guardian or legal representative, or that due to human or technical error, personal data of such individuals has been collected, such data will be deleted from the databases as soon as this is known.

 

3.2. Sensitive personal data

“THE CONTROLLER” will not collect or process any kind of sensitive personal data.

 

4. Purposes of personal data processing

Your personal data will be used for the following purposes:

Primary Purposes: Purposes that give rise to and are necessary for the existence, maintenance, and fulfillment of the legal relationship between you and “THE CONTROLLER”:

  • Identification and contact.
  • Contracting, follow-up, updates, confirmation, and generation of a history of contracted products and/or services.
  • Creation, updating, personalization, maintenance, and authentication of your user account.
  • Handling questions, complaints, comments, suggestions, clarifications, and follow-up.
  • Ensuring personal safety: when acquiring a product or service, you may be videotaped or photographed. Please be informed that images from video recordings or photographs will be protected by “THE LAW” and “THE REGULATIONS” and will be stored in databases for ten calendar days. After this period, the recordings or photographs will be deleted or erased.
  • Credit and payment validation and fraud risk assessment of transactions.
  • Billing of contracted services or products.
  • Compliance with legal and regulatory obligations, as well as requirements from government, immigration, or judicial authorities at the Federal, State, or Municipal level and/or regulatory entities.

Secondary Purposes: Purposes that differ from and do not give rise to the legal relationship between you and “THE CONTROLLER,” but which are highly useful to us in providing better service and developing new products and services:

  • Evaluation of service quality through surveys, conducting studies on consumption habits and preferences.
  • Participation in contests, raffles, events, and promotions. Please note that if you participate in such activities, “THE CONTROLLER” may collect your image through videos and/or photographs and publish them through various physical or electronic media, as well as your personal data, such as full name, date of birth, email address, mailing address, and phone number, in order to document your participation or deliver the corresponding prize or incentive.
  • Informing you about and/or offering the range of products and services marketed by “THE CONTROLLER” and communicating promotions.
  • Marketing and commercial prospecting.
  • Applying data analytics techniques to carry out profiling activities and better understand the customer.

The provision of services and/or the creation of an account implies the users’ full and unconditional consent to the processing of their personal data in accordance with this Privacy Notice.

If you wish to EXPRESS YOUR OBJECTION to the processing of your personal data for the aforementioned secondary purposes, you must send an email to datos.personales@grupoado.com.mx or submit a written request in Spanish to the following address: Artilleros Número 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico, stating which secondary purpose(s) you object to.

 

5. Limitations on the use of data

You may limit the use or disclosure of your personal data by sending us a written request in Spanish, addressed to the PERSONAL DATA PROTECTION OFFICE OF “THE CONTROLLER”, via email to datos.personales@grupoado.com.mx or to the following address: Artilleros Número 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico. In your request, please state your intention to limit the use or disclosure of your personal data and include the following necessary information: full name, a simple copy of your official identification, customer number (if applicable), phone number, and physical address or email address.

In addition to the procedure described above, you may cancel your subscription to promotional, marketing, and/or advertising emails we send by clicking on the unsubscribe link included at the bottom of each of these emails.

 

6. ARCO rights

You or your duly authorized legal representative may exercise, when applicable, the rights of access, rectification, cancellation, or opposition (hereinafter referred to as "ARCO RIGHTS") provided under “THE LAW”, through the mechanism described below. It is important to note that the exercise of any of the "ARCO RIGHTS" does not preclude the exercise of another right.

 

6.1. Mechanisms for exercising ARCO rights and revoking consent for the processing of personal data

The exercise of "ARCO RIGHTS" as well as the revocation of your consent for the processing of your personal data will be carried out through the submission of the corresponding request, which must be in writing and in Spanish, presented by the personal data holder or their legal representative, and addressed to the PERSONAL DATA PROTECTION OFFICE OF “THE CONTROLLER” at the address located at Artilleros Número 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico (shipping costs shall be borne by the applicant), or by email to datos.personales@grupoado.com.mx.

Your request must include your full name, a simple, legible, and valid copy of your official identification or, in the case of using electronic means, attach a digitized version of it (scan), email address or mailing address designated for notifications, and a contact phone number. If your request is submitted by your legal representative, you must also attach the official documents proving such representation.

If the information provided in your request is incorrect or insufficient to process it, or if the required documents are not attached, you will be notified within five business days following receipt of your request to provide the necessary elements or documents to proceed. You will have ten business days to respond to this request, starting the day after the request was issued by the PERSONAL DATA PROTECTION OFFICE OF “THE CONTROLLER”. If you do not respond within the given time, your request will be considered as not submitted.

Once the requirements mentioned above are fulfilled, within a maximum of twenty business days from the date of receipt of your ARCO RIGHTS request or revocation of consent for the processing of personal data, the PERSONAL DATA PROTECTION OFFICE OF “THE CONTROLLER” will respond regarding the outcome of your request, via email to the email address you provided in the request, or by sending a notification to the mailing address you indicated (the twenty-day period is considered fulfilled upon delivery of the document to the postal service). If the request is granted, it will be implemented within fifteen business days from the date on which the outcome was communicated.

 

7. National and international data transfers

Your personal data will not be transferred nationally or internationally to third parties without your consent, except as provided under Article 37 of “THE LAW”:

  • When the transfer is made between controlling, subsidiary, or affiliated companies under common control of “THE CONTROLLER”, or to a parent company or any company of the same group of “THE CONTROLLER” that operates under the same internal processes and policies.
  • When the transfer is necessary for medical prevention or diagnosis, the provision of healthcare, medical treatment, or the management of health services.
  • When the transfer is necessary by virtue of a contract concluded or to be concluded in your interest, by “THE CONTROLLER” and a third party, in order to grant benefits.
  • When the transfer is required for the maintenance or fulfillment of a legal relationship between “THE CONTROLLER” and you, such as with suppliers, banking and credit institutions, chambers of commerce, and others.
  • When the transfer is necessary or legally required to safeguard a public interest or for the administration or enforcement of justice.
 

8. Information on the Internet

We inform you that we use electronic technologies (cookies and web beacons) on our websites: www.turibus.com.mx, www.teper.com.mx, and www.autotur.com.mx. When you access our websites, we collect information such as your browser type and operating system, the websites you recently visited, links you recently followed, your computer’s IP address, and the website you closed before accessing our site.

You may disable or adjust the use of these technologies by following the procedures provided by the internet browser you use to access our website.

 

8.1. Disclaimer of liability for our website or applications

By browsing or using our websites www.turibus.com.mx, www.teper.com.mx, and www.autotur.com.mx, or applications, you may encounter hyperlinks, links, banners, or buttons owned by third parties that may request your personal data (hereinafter referred to as “Third-Party Sites”). The personal data you provide through these portals or websites will be subject to the Privacy Notices displayed and applicable on those portals and websites. Therefore, “THE CONTROLLER” shall not be held responsible for the use, publication, disclosure, and/or dissemination of your personal data through the aforementioned Third-Party Sites. We recommend that users be careful and responsible regarding the personal information they provide on such sites.

 

9. Data retention

“THE CONTROLLER” will retain your information for as long as it is needed for the purpose for which it was collected, unless you request its deletion, and provided that “THE CONTROLLER” no longer has any legal need to retain your information. “THE CONTROLLER” may retain your personal data for longer periods than those required by applicable laws if it is in our legitimate business interest and the law does not prohibit it.

Please note that when we have collected your personal information based on your consent and you withdraw such consent, or exercise your ARCO rights (to delete your personal information), we may keep your information blocked and available for as long as needed to comply with applicable laws and so that “THE CONTROLLER” fulfills its responsibilities arising from the processing of your data.

 

10. Modifications to this privacy notice

“THE CONTROLLER” reserves the right to make modifications or updates to this "NOTICE" at any time. Any modifications made will be made available to users through one or more of the following means: visible announcements at our ticket offices or branches, on our websites www.turibus.com.mx, www.teper.com.mx, and www.autotur.com.mx, via mobile applications, via email to the most recent address we have for you, through posters, audio or video recordings, or in person through our staff when visiting any of our facilities.

 

11. Definitions

For the purposes of this “NOTICE,” the following terms shall be understood as:

  • Cookies: These are text files that are automatically downloaded and stored on the user's computer hard drive when browsing a specific webpage or internet portal, which allow the internet server to store certain data, including information about your preferences and browsing patterns.
  • Days: As stated in Article 3, Section VII of the Federal Law on the Protection of Personal Data Held by Private Parties, the terms and timeframes specified in days shall be counted as business days.
  • ARCO Rights: These are the Rights of Access, Rectification, Cancellation, and Opposition, as established in “THE LAW,” and whose acronym in Spanish forms the word ARCO.
  • Law: Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Journal of the Federation on July 5, 2010.
  • Regulation: Regulation of the Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Journal of the Federation on December 21, 2011.
  • Transfer: Any communication of personal data within or outside Mexican territory made to a person other than the data subject, the controller, or the data processor.
  • Web Beacons: An image used exclusively to count the number of visits or monitor user behavior.