Suppliers Privacy Notice

 

This privacy notice, hereinafter referred to as “THE NOTICE”, is issued in compliance with the provisions of Article 15 of the Federal Law on Protection of Personal Data Held by Private Parties, hereinafter “THE LAW”, and its corresponding regulations, hereinafter “THE REGULATIONS”, and is made available to suppliers who provide personal data or information to AUTOBUSES RÁPIDOS DE ZACATLÁN, S.A. DE C.V., its affiliated, subsidiary, related, controlled, or controlling companies, hereinafter “THE CONTROLLER”.

 

1. Controller responsible for the protection of your personal data

“THE CONTROLLER”, with its address for notifications at Artilleros Number 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico, is responsible for the processing of your personal data.

As the controller responsible for personal data processing, “THE CONTROLLER” observes the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility, as established by “THE LAW”.

 

2. Method and means of contact

To contact us, you must submit a request written in Spanish, addressed to the PERSONAL DATA PROTECTION OFFICE of “THE CONTROLLER” and deliver it in person or by postal mail to the following address: Artilleros Number 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico; or by email to: datos.personales@grupoado.com.mx

 

3. Personal data collected and means of collection

The personal data we collect from you to fulfill the purposes described in this "NOTICE" are obtained when you provide them to us through our employees, the website https://proveedores.ado.mx/DPA_PACFE_ADO, mobile applications, by telephone, via email, and when we gather information from other publicly accessible sources allowed by “THE LAW” and “THE REGULATIONS”.

The data we collect include the following:

From individuals: Full name and surname, image, official identification, signature, email address, and phone numbers. Regarding financial data such as the Federal Taxpayer Registry (RFC), tax address, and bank account information, by having a contractual relationship with “THE CONTROLLER”, you expressly consent to the processing of such data in accordance with Article 8 of “THE LAW”.

From legal entities: Business name through the articles of incorporation, power of attorney of the legal representative, and address. From the representative or legal agent: full name and surname, image, official identification, signature, email address, and phone numbers. As for the company’s financial data, such as the Federal Taxpayer Registry (RFC), tax address, and bank account details, the representative or legal agent grants express consent for the processing of such data in accordance with Article 8 of “THE LAW” by virtue of having a contractual relationship with “THE CONTROLLER”.

Since “THE LAW” allows us to obtain information from other sources, such as physical or electronic phone and service directories, the data we may obtain from those means include name and surname, telephone number, and email address.

 

3.1. Third party personal data

“THE CONTROLLER” may process identification and contact personal data, such as full name, email address, and telephone number of third parties, such as supplier employees, supplier-authorized individuals, supplier references, joint obligors, guarantors, or sureties, when you provide them for the purpose of fulfilling a contractual relationship or participating in the evaluation, selection, and hiring process. By providing such data, you acknowledge that you have informed those third parties about the use of their personal data, have obtained their prior consent for “THE CONTROLLER” to process their data for the purposes mentioned above, and have informed them of this privacy notice.

 

3.2. Sensitive personal data

“THE CONTROLLER” will not collect or process any type of sensitive personal data.

 

4. Purposes of processing personal data

Your personal data will be used for the following purposes:

Primary Purposes: Purposes that gave rise to and are necessary for the existence, maintenance, and fulfillment of the legal relationship between you and “THE CONTROLLER”:

  • Identification and contact.
  • Participation in the evaluation, selection, and hiring process.
  • Verification and confirmation of your identity as a supplier, as well as the authenticity of the information you provide, including that of your authorized third parties, such as references, co-obligors, guarantors or sureties, and supplier employees, as applicable.
  • Conducting internal and external investigations, and audits.
  • Quoting products and/or services.
  • Drafting, verifying, and monitoring compliance with the purpose of the executed contract, and, if applicable, its renewal.
  • Control, surveillance, and access to “THE CONTROLLER's” facilities. Upon entering our facilities, you may be video recorded or photographed, and you are hereby informed that the images from such video recordings or photographs will be protected under “THE LAW” and “THE REGULATIONS” and will be stored in databases for a period of ten calendar days, after which they will be deleted or overwritten.
  • Invoicing or payment resulting from the contractual relationship.
  • Creation, updating, customization, maintenance, and authentication of your user account.
  • Addressing inquiries, complaints, comments, suggestions, clarifications, and their follow-up.
  • Notifying changes in conditions and maintaining the commercial relationship.
  • Compliance with legal and regulatory obligations, as well as requirements from federal, state, or municipal government or judicial authorities and/or regulatory entities.

Secondary Purposes: Purposes that are not necessary for the legal relationship between you and “THE CONTROLLER” but are very useful to offer you better service:

  • Marketing and commercial prospecting.
  • Data analysis techniques for profiling activities.

If you wish to EXPRESS YOUR OPPOSITION to the processing of your personal data for the aforementioned secondary purposes, you must send an email to datos.personales@grupoado.com.mx or submit a written request in Spanish to the following address: Artilleros Number 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico, stating which secondary purpose(s) you oppose.

 

5. Limitations on the use of data

You may limit the use or disclosure of your personal data by sending us a written request in Spanish, addressed to the PERSONAL DATA PROTECTION OFFICE OF “THE CONTROLLER”, to the email address datos.personales@grupoado.com.mx or the following address: Artilleros Number 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico. The request should state your intention to limit the use or disclosure of your personal data and include necessary details such as: full name, a simple copy of your official identification, supplier number (if applicable), telephone number, and postal or email address. If the request is submitted by your legal representative or proxy, it must also include official documents that prove such representation.

In addition to the procedure described above, you may unsubscribe from the marketing emails we send by clicking the link included at the bottom of each email.

 

6. ARCO rights

You or your duly authorized legal representative may exercise, when applicable, the rights of Access, Rectification, Cancellation, or Opposition—hereinafter referred to as “ARCO RIGHTS”—as provided by “THE LAW,” using the mechanism described below. It is important to note that the exercise of any of the “ARCO RIGHTS” does not prevent the exercise of any other rights.

 

6.1. Mechanisms for exercising ARCO rights and revoking consent for the processing of your personal data

The exercise of "ARCO RIGHTS" as well as the revocation of your consent for the processing of your personal data must be carried out by submitting the corresponding request, in writing and in Spanish, by the data subject or their attorney or legal representative, directed to the PERSONAL DATA PROTECTION OFFICE of "THE CONTROLLER" at the address located at Artilleros Number 123, Colonia 7 de Julio, Alcaldía Venustiano Carranza, Postal Code 15390, Mexico City, Mexico (shipping costs are borne by the applicant), or via email to: datos.personales@grupoado.com.mx

Your request must include your full name and surname, a simple, legible, and valid copy of your official identification; in case of using electronic means, you must attach a digitized version (scan), an email address or physical address for notifications, and a contact phone number. If the request is submitted by your attorney or legal representative, they must additionally attach official documents proving such representation.

If the information provided in your request is incorrect or insufficient to process it, or if the necessary accreditation documents are missing, a request will be issued within five business days following receipt of your request, asking you to provide the required elements or documents. You will have a period of ten business days to respond to such request, counted from the day after it is issued by the PERSONAL DATA PROTECTION OFFICE of "THE CONTROLLER." If no response is provided within the granted period, your request will be considered as not submitted.

Once the above requirements are met, within a maximum period of twenty business days from the date your "ARCO RIGHTS" or data processing revocation request is received, the PERSONAL DATA PROTECTION OFFICE of "THE CONTROLLER" will inform you of the outcome via email to the address you indicated, or by a notice sent to the physical address you provided (the twenty-day period is considered fulfilled once the document is handed to the postal service). If the request is deemed appropriate, it will be fulfilled within fifteen business days following the notification of the decision.

 

7. National and international data transfers

Your personal data will not be transferred nationally or internationally to third parties without your consent, except as provided in Article 37 of "THE LAW":

  • When the transfer is made between controlling, subsidiary, or affiliated companies under common control of "THE CONTROLLER," or to a parent company or any company of the same group operating under the same internal processes and policies.
  • When the transfer is necessary for medical prevention, diagnosis, healthcare delivery, medical treatment, or the management of healthcare services.
  • When the transfer is necessary due to a contract signed or to be signed in your interest between "THE CONTROLLER" and a third party.
  • When the transfer is necessary for the maintenance or fulfillment of a legal relationship between "THE CONTROLLER" and you, such as banking or credit institutions, chambers of commerce, business partners, among others.
  • When the transfer is required or legally demanded to safeguard public interest or for the procurement or administration of justice, or when requested by competent authorities.
 

8. Information on the Internet

Please be advised that we use electronic technologies (cookies and web beacons) on our website https://proveedores.ado.mx/DPA_PACFE_ADO, so when you access our website, we may collect information such as your browser type, operating system, recently visited websites, links followed, your computer’s IP address, and the site you visited before ours.

You may disable or adjust the use of these technologies by following the procedures in your internet browser settings.

 

8.1. Disclaimer regarding our website or application

While browsing or using our website https://proveedores.ado.mx/DPA_PACFE_ADO or applications, you may encounter hyperlinks, links, banners, or buttons owned by third parties that may request your personal data ("Third-Party Sites"). The personal data you provide through these portals or websites will be subject to the Privacy Notices displayed and applicable to those platforms. Therefore, "THE CONTROLLER" shall not be responsible for the use, publication, disclosure, and/or distribution you make of your personal data through the mentioned means. We recommend exercising caution and responsibility with the personal information you provide on such media.

 

9. Data retention

"THE CONTROLLER" will retain your information for as long as needed to fulfill the purpose for which it was collected, unless you request its deletion, and only when "THE CONTROLLER" no longer needs to retain it for other reasons. "THE CONTROLLER" may retain your personal data for longer periods than required by applicable laws if it is in our legitimate business interest and not prohibited by law.

Please note that when we have collected your personal information based on your consent and you later withdraw such consent, or exercise your ARCO rights (to delete your personal data), we may retain your information blocked and available as long as necessary to comply with applicable laws and to fulfill our responsibilities derived from processing your data.

 

10. Modifications to this privacy notice

"THE CONTROLLER" reserves the right to modify or update this "NOTICE" at any time. Modifications will be made available through one or more of the following means: visible notices in our offices, our website https://proveedores.ado.mx/DPA_PACFE_ADO, mobile applications, email to the most recent address we have for you, posters, audio recordings, or video announcements.

 

11. Consent

The act of providing your data to us by any means implies your free, specific, informed, and unequivocal consent for its processing under the terms of this privacy notice, without prejudice to your right to exercise your ARCO rights.