IIH LEGAL, S.A.S. DE C.V. (“Ibarra & Asociados”, the “Firm”, “we”, “our”) is committed to safeguarding the privacy for our clients and prospective clients, contacts for suppliers of goods and services to the Firm, candidates for employment or engagement, and any other individuals about whom the Firm obtains personal information (each, “you”).

Please read the following statement, which sets out the principles governing the Firm’s use of personal information that we may obtain about you, to understand how the Firm collects, uses, and otherwise processes your personal information as well as the rights that you have in relation to our processing of that information (the “Privacy Policy”). In this Privacy Policy, “personal information” means information that (either in isolation or in combination with other information held by the Firm) enables you to be identified or recognized.

Ibarra & Asociados is the data controller in relation to any personal information that the Firm processes about you and is responsible for ensuring that such processing complies with applicable data protection laws. Your privacy is important to us. Please be aware that Firm personnel are required to comply with the Firm’s data privacy practices as set out in this Privacy Statement and other data privacy-related Firm policies.

While we may also process personal information during our legal representation of a client, such processing is performed on behalf of and at the direction of our client, subject to our client agreements and professional responsibilities, and is not covered by this Policy.

“Personal information” as used in this Policy means information that identifies, relates to, describes, or can reasonably be linked, directly or indirectly, to a specific natural person. It does not include information that is considered anonymous, de-identified, or aggregated by applicable law.

This Policy covers the following topics:

1. The types of information we collect.

The types of personal information we collect about you depend on your interactions with us and are described below.

Information you provide to us.

We collect personal information that you provide to us. For example, we may collect personal information when you contact us, request that we send you newsletters, alerts, or other materials, register for a webinar or event, fill out a form, respond to a survey, comment on a blog, or otherwise communicate with us.

Depending on the context of your interactions with us, the categories of personal information we may collect from you include:

• Unique identifiers that we can use to identify you as a unique individual, such as your name, telephone number, postal or e-mail address, bar license number, social media identifiers, signature, and government issued identification numbers (such as your social security number or passport number).
• Professional and educational information related to your occupation, such as your current or previous employers, your job title, or other information about the organization with which you are affiliated. You might also provide information about your professional qualifications or your education, such as your bar information, degrees, fields of study, the institutions you’ve attended, languages, professional memberships, qualifications, and certifications.
• Health Information, such as accessibility requirements and dietary restrictions.
• Geolocation information, such as your city, state or province, and country.
• Audio and visual Information, such as your voice and likeness as captured in photographs, video, or audio recordings if you attend our events, visit our offices, or leave us a voicemail.
• User content, such as comments or other material you post to our social media pages, blogs, or other forums on our Digital Services.
• Preferences, such as your stated interests, how frequently you wish to receive our newsletters, or other communications.
• Any other information you choose to provide.

You generally can use our Digital Services without providing us with personal information, though we may still collect personal information automatically as described in the next section.

Information we may collect automatically or generate

We may automatically collect and generate information from and about you when you interact with us or our Digital Services, which may include the following categories of personal information:

• Unique identifiers: We might automatically collect information that uniquely identifies you or the device through which you interact with our Digital Services, such as your name, e-mail address, username, social media identifiers, IP address, and device and mobile advertising identifiers.
• Device information: We might automatically collect information pertaining to the device through which you interact with our Digital Services, such as the type of device used to interact with the Digital Services, that device’s operating system and version, your browser type.
• Interaction information: We might automatically collect information about your interaction with our Digital Services, such as the content you view and features you access on our Digital Services, the pages you view immediately before and after you access our Digital Services, whether and how you interact with content available on our Digital Services, and the search terms you enter on our Digital Services. We might also collect information about the events and materials in which you have indicated interest or for which you have registered or requested.
• Geolocation information: We might automatically collect information regarding your location, such as your ZIP code, city, state or province, country, or general geographic location as derived from your device data (such as your IP address).
• Inferences drawn from your interactions with our Digital Services, the events you choose to attend, or any of the other personal information available to us.

We and our service providers or third parties engaged on our behalf may use cookies and similar tracking technologies (collectively, “Cookies”) to collect information from and store information on your device when you use, access, or otherwise interact with our Digital Services. For information about how we use Cookies and the choices you may have, please see our Cookies Policy.

Information we collect from other sources

We may obtain personal information from other sources, such as our clients, employees, or business partners, or from business contact databases and enrichment services. We may also receive information about you from social media platforms, such as when you interact with us on those platforms or access our social media content. We may collect information about you from publicly available sources, such as public social media profiles, publications, and other websites or materials available through search engines.

We may collect the following categories of information from these other sources:

• Unique identifiers, such as name, telephone number, postal or e-mail address, social media identifiers, and device and mobile advertising identifiers.
• Professional and educational information about your occupation and professional activities, such as professional licenses held, employers, business contact information, or information about your education, such as your degrees, fields of study, institutions attended, languages, professional memberships, qualifications, and certifications.
• User content you post or make available online, such as your social media posts or publications.

2. How we use the information we collect.

We may use the information we collect for the various purposes, including:

• To respond to your inquiries or communications.
• To provide you with legal and other services.
• To conduct pre-engagement assessments and formalities such as anti-money laundering checks, conflict checks, etc.
• To operate, troubleshoot, and improve the Digital Services.
• To send you newsletters, legal updates, marketing communications, and other information or materials that may interest you.
• To expand and maintain our list of contacts.
• To manage your online account(s) with our Digital Services and send you technical notices, updates, security alerts, and other administrative messages.
• To understand how people use our services, including by generating and analyzing statistics.
• For the Firm´s business purposes, including internal administration, data analysis, billing, and detecting, preventing, and responding to actual or potential fraud, illegal activities, or intellectual property infringement.
• To satisfy any legal, regulatory, accounting or reporting requirements.
• To advertise, provide, and assess the effectiveness of our events, promotional campaigns, publications, and services.
• As we believe reasonably necessary or appropriate to comply with our legal obligations, to respond to legal process or requests for information issued by government authorities or other third parties, or to protect your, our, or others’ rights.

3. How we may share the information we collect.

Ibarra & Asociados does not sell your personal information. We also do not share personal information that reasonably identifies you with unaffiliated entities for their independent use except when we have your permission, are doing so at your direction, as needed to comply with our legal obligations, as permitted by applicable law, or as otherwise described in this Policy.

We may also disclose the categories of information we collect to the following categories of recipients in furtherance of the purposes described above:

• Our service providers: We may share information with third parties that perform services on our behalf, such as web-hosting companies, mailing vendors, analytics providers, event hosting services, and information technology providers.
• Law enforcement, government authorities, or third parties with legal rights: We may share information as may be permitted or required by the laws, as provided for under contract, or as we deem reasonably necessary to provide legal services. In these circumstances, we strive to take reasonable efforts to notify you before we disclose information that may reasonably identify you or your organization, unless prior notice is prohibited by applicable law or is not possible or reasonable in the circumstances.
• Parties in connection with a business transaction: We may share information with service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets, as well as any bankruptcy or corporate reorganization.
• Others with your consent or at your direction, including if we notify you that your information may be shared and you provide such information or if you use the Firm to interact with a third party.

We may share anonymous, de-identified, or aggregate information that cannot reasonably identify you with others for any purpose, as permitted by applicable law. Please note that any personal information that you post to a profile, blog, comment section, or forum on our Digital Services or social media pages may be available to other users of those forums or, in some cases, made publicly available.

4. Grounds for processing your information.

We rely on the following legal grounds:

• Performance of a contract: We may need to collect and use your personal information to enter into a contract you or to perform a contract that you have with us.
• Consent: Where required to obtain your consent, we will do so.
• Legitimate interests: We may use your personal information for our legitimate interests to improve our services, as well as the content on our Digital Services. Consistent with our legitimate interests and any choices that we offer or consents that may be required under applicable laws, we may use technical information and personal information for our marketing purposes.
• Legal obligation: We may process personal information as necessary to comply with our legal obligations.

5. Third-party services and content.

Our Digital Services may include integrated content or links to content provided by third parties (such as video materials). This Privacy Policy does not address the privacy, security, or other practices of the third parties that provide such content.

Consistent with applicable law, we engage third parties that support the operation of our Digital Services, such as analytics providers. These third parties may track your online activities over time and across different websites and applications. Please see our Cookies Policy for more information about such third-party providers and your choices.

6. Protection and storage of the information we collect.

We will retain your personal data for as long as necessary to fulfill the purposes for which it was collected and processed in compliance with this Privacy Policy. To determine the retention period for personal data, we will take into consideration the purposes for which they were collected, as well as the nature and sensitivity of the information and the applicable legal requirements. We conduct periodic reviews of the data we retain and will safely delete data to the extent it is no longer required to be retained by us.

During the retention of your personal data, we take technical and organizational security measures to protect your data from accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

However, no information system can be absolute secure. We cannot guarantee the absolute security of your information. Moreover, we are not responsible for the security of information you transmit to us over networks that we do not control, including the Internet and wireless networks.

7. Your choices and rights.

Marketing Communications. If you no longer wish to receive marketing communications from us, you can let us know by contacting us at contactus@ibarralaw.com.mx. Please note that if you opt-out of marketing communications, we may still contact you with non-promotional communications, such as those about ongoing business relations or administrative messages.

Cookies. For information about the choices you may have in regard to our use of Cookies, please see our Cookies Policy.

Geolocation Data. If you have previously consented to sharing precise geolocation information with our Digital Services, you can choose to stop the collection of this information at any time by changing the preferences on your browser or mobile device settings.

Push Notifications/Alerts. If you have permitted one of our mobile applications to send you push notifications or alerts, you can deactivate these messages at any time in the notification settings on your mobile device.

Privacy Rights.

• Request access to certain personal information of yours that we process. You may contact us at any time to request access to your personal data, and we will confirm to you whether we are processing your personal data and for what purposes, as well as provide details of the categories of personal data concerned, the specific pieces of data concerned, the recipients of the personal data, the retention periods (where possible) and your rights.
• Update or correct your personal information if you believe it is incomplete or inaccurate. If any of your personal data that we hold appears to be inaccurate or incomplete, you may ask us to correct or complete it at any time.
• Erase or delete your personal information, subject to certain exceptions under local law. You may ask us to have your personal data erased if it is no longer necessary for us to keep it in connection with the purposes for which it was collected or if the processing/storing of such personal data is otherwise unlawful. However, we must keep track of certain information in order to comply with legal obligations, and/or to handle any claims or litigation.
• Object to our processing of your personal information or otherwise restrict our processing activities. You may object to our processing of your personal data on grounds relating to your specific situation, where we are processing your personal data to pursue our legitimate interests.
• Restrict certain transfers of your personal information to third parties. You may ask us to limit the way in which we process your personal data (i.e., require us to continue to store your personal data but not to process it without your consent), for example where you think the personal data we hold is inaccurate, for a period enabling us to verify the accuracy of personal data, or where you have objected to our processing.
• Withdraw your consent to processing, where we base our processing of your personal information on consent. You may withdraw your consent at any time, where the processing is based on your consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before it was withdrawn. You also have the right to contact us at any time if you wish to complain about our processing of your personal data and you may lodge a complaint at any time with a supervisory authority.

You can exercise your rights (if applicable) by submitting a request through our Contact Us page or emailing us at contactus@ibarralaw.com.mx.

8. How to contact us.

If you have any question in relation to this Privacy Policy or the processing of your personal data or would like to exercise your rights under applicable law or this privacy policy, please contact us at contactus@ibarralaw.com.mx.

When contacting us in connection with any of your rights described above (directly, or through an authorized agent as permitted under applicable law), you may be asked to provide certain identifying information before your request can be processed.  We may limit or deny access to personal data where and as permitted by law.

If we are unable to verify your identity to the degree of certainty required under applicable law through any reasonable method, we will state that in a written response to you along with a reason as to why there is no reasonable method by which we can verify your identity.

9. Changes to this Privacy Policy.

We may update this Policy periodically, and will revise the date at the bottom of this Policy to reflect the date when such update occurred. Any changes we make to this Privacy Policy in the future will be posted on this page. Please check back periodically to see any updates or changes to our Privacy Statement.

 

May 2020