Privacy Notice

I. Identification of the Data Controller and Processing of Your Personal Data

In accordance with Article 17, Section II of the Federal Law on Protection of Personal Data Held by Private Parties, we inform you that LYSAFE (the “Data Controller”) will process the personal data collected from you under the terms of this Privacy Notice.

II. Purposes

The processing will be carried out for the following purposes:

a) Necessary for the legal relationship with the Data Controller: To obtain the information needed from clients, employees, and suppliers to carry out the labor, commercial, and industrial relationship for the manufacturing and distribution of personal care products, as well as to maintain communication via email and telephone with clients and suppliers, establishing contact for purposes of our commercial and industrial relationship, invoicing, price changes, etc. Likewise, for procedures before IMSS and Infonavit, as well as for hiring the company's suppliers and hiring and subcontracting employees. The personal data requested are as follows:

• From Clients: full name; address; phone number; email address; RFC tax ID registration; articles of incorporation (for legal entities); voter ID of the individual or, where applicable, of the legal representative of the entity; proof of address (for legal entities); banking information, such as account number, CLABE interbank number, and bank; credit application; among others.
• From Suppliers: RFC tax ID registration; full name; address; phone number; email address; voter ID of the individual or, where applicable, of the legal representative of the entity; proof of address (for legal entities); banking information, such as account number, CLABE interbank number, and bank; among others.
• From Employees: police clearance letter; voter ID; CURP; Infonavit withholding letter (if applicable, for those with a credit); birth certificate; proof of address; letter of recommendation from a previous job or personal reference; job application or résumé; among others.

b) Other purposes: to transfer your personal data to third parties, under the terms of this Privacy Notice. To achieve the purposes stated above, the following personal data will be processed: first and last name, address, phone number, email address, RFC, CURP, and banking information such as account number and CLABE interbank number, among others.

III. Options to Limit the Use or Disclosure of Your Personal Data

The Data Controller has appointed a personal data officer (the “Privacy Officer”); therefore, you may limit the use or disclosure of your personal data in person before the Data Controller, at the company's address indicated above.

IV. Means to Revoke Consent

You may revoke your consent for the processing of your personal data in the same way you granted it. If, after revocation, you request confirmation thereof, the Data Controller will respond to you expressly.

V. Means to Exercise Your ARCO Rights

You have the right to (i) access your personal data held by us and learn the details of its processing; (ii) rectify it if it is inaccurate or incomplete; (iii) cancel it when you consider that it is not required for any of the purposes stated in this Privacy Notice, is being used for purposes not consented to, or the contractual or service relationship has ended; or (iv) object to its processing for specific purposes, as provided by law (collectively, the “ARCO Rights”).

To exercise your ARCO Rights, you must submit a request (the “ARCO Request”) to the Data Controller, addressed to the Privacy Officer, accompanied by the following information and documentation:

• Your name, address, and email address so that we can communicate the response to your ARCO Request.
• A copy of the documents proving your identity (copy of official ID, passport, or any other official identification) or, where applicable, the documents proving your legal representation, the original of which must be presented in order to receive the Data Controller's response.
• A clear and precise description of the personal data for which you seek to exercise any of the ARCO Rights.
• Any document or information that facilitates locating your personal data.
• If requesting a rectification of your personal data, you must also indicate the changes to be made and provide documentation supporting your request.

The Privacy Officer will respond to your ARCO Request and the reasons for the decision by email, within a maximum period of 20 business days counted from the day your ARCO Request was received. If the ARCO Request is answered affirmatively or is deemed appropriate, the requested changes will be made within a maximum period of 15 business days. The Data Controller may notify you, within the aforementioned periods, of a one-time extension for an equal period.

The Data Controller may deny access (the “Denial”) for you to exercise your ARCO Rights in the cases permitted by law, in which case it must inform you of the reason for such decision. The Denial may be partial, in which case the Data Controller will carry out the access, rectification, cancellation, or objection to the extent applicable.

The exercise of ARCO Rights is free of charge; however, if you repeat your request within a period of less than twelve months, the costs will be equivalent to three days of the General Minimum Wage in effect in Mexico City, plus VAT, unless there are substantial modifications to the Privacy Notice that give rise to new ARCO Requests. You must cover the justified shipping expenses or the cost of reproduction in copies or other formats and, where applicable, the cost of document certification.

VI. Changes or Modifications to the Privacy Notice

The Data Controller reserves the right to make modifications or updates to this Privacy Notice at any time, with the understanding that any modification will be made known to you through the publication of a notice on the Data Controller's website, so we recommend that you check it frequently.

In the event of a security breach at any stage of the processing of personal data that significantly affects your property or moral rights, the Privacy Officer will immediately notify you by email of the security breach, so that you may take the necessary measures to defend your rights. If we do not have your email address on file, the notification will be published on the Data Controller's website.

VII. Images, Videos, and Photographs

Employees and visitors of the company will be video recorded by cameras for the entire duration of their stay at LYSAFE's premises, for the purposes the company has determined, such as the safety of everyone present at the premises, as well as for the care and monitoring of the company's materials, products, and assets, and to oversee that the company's processes and activities are carried out properly.

The information, data, software, photographs, images, graphics, videos, and any other material that is photographed or video recorded by the company on its premises is the exclusive property of LYSAFE. All video and photograph content is reviewed periodically.

VIII. Consent

I give my consent for the processing of my personal data for the purposes necessary for the legal relationship with the Data Controller. (Refusing to allow the processing of your personal data will result in the impossibility of establishing a legal relationship with the Data Controller.)