Comprehensive
privacy notice.

Controller

ORTIZ LINARES ABOGADOS ASOCIADOS, S.C. (“OLA” or the “Controller”), with address at Boulevard Atlixco No. 2703 Altos, Edificio CeyCo, Colonia Nueva Antequera, C.P. 72180, Puebla, Puebla, Mexico, is subject to Mexico’s Federal Law on Protection of Personal Data Held by Private Parties (the “Law”), published in the Official Gazette of the Federation on 20 March 2025 and amended on 14 November 2025.

OLA is responsible for processing the personal data it collects from you (the “Data Subject”) in accordance with the principles of legality, purpose limitation, loyalty, consent, quality, proportionality, information and accountability established by the Law.

Personal data we collect

Personal data may be collected directly, indirectly or in person through our offices, by telephone, email or other authorised means. Data we may process include:

• Full name.
• Date of birth.
• Email address.
• Mexican Federal Taxpayer Registry (RFC) and updates.
• Mexican Population Registry Code (CURP).
• Home and/or business address.
• Official identification.
• Telephone numbers.
• Financial and/or asset information where necessary for the service relationship.

OLA does not proactively collect sensitive personal data in the ordinary course of business. If such processing is exceptionally necessary, OLA will obtain the applicable express written consent. Financial or asset data require express consent, except where the Law provides otherwise.

The site does not use advertising, profiling or analytics cookies. The private-access infrastructure may use cookies or equivalent technologies that are strictly necessary to authenticate authorised visitors, preserve security and enable the site to operate. OLA does not control those infrastructure technologies and does not use them for commercial purposes. The preference to dismiss this notice is retained only in the browser through local storage. You may manage or disable cookies through your browser’s privacy and security settings; doing so may prevent access to the private site.

Purposes of processing

Personal data are processed for the following primary purposes:

• To identify you as a client, prospective client or legal representative.
• To compile your client or prospective-client file.
• To provide and develop the legal services engaged and related activities.
• To prepare documents, quotations, agreements, invoices, receipts and service-related records.
• To address complaints, clarifications and related requests.
• To retain information for applicable periods.
• To comply with legal obligations, including anti-money-laundering obligations.
• To comply with agreed terms and conditions.

OLA may additionally process your data for secondary purposes: service-quality assessments; event invitations; publication updates; promotion of services; marketing, advertising or commercial prospecting; and statistics.

You may refuse processing for secondary purposes by writing to proteccion_datos_personales@ortizlinares.com. This refusal will not affect services or products you request or engage from OLA.

Security and retention

OLA protects personal data through administrative, technical and physical safeguards designed to prevent unauthorised damage, loss, alteration, destruction, use, access or disclosure. These measures take account of the nature of the data, the purposes of processing and applicable risks.

Persons involved in processing personal data are subject to confidentiality obligations that remain in effect after their relationship with OLA ends. When data are no longer necessary for the stated purposes or legal compliance, they will be blocked and subsequently deleted in accordance with applicable retention periods.

Cloud infrastructure and processors

Personal data and confidential information related to our services may be hosted, processed and safeguarded in cloud-computing infrastructure provided by third parties, such as Google LLC or its affiliates. Such providers act as processors under OLA’s instructions and data-processing agreements containing administrative, technical and physical safeguards. They do not use the data for purposes other than those instructed by OLA.

Consent

Processing for primary purposes is carried out under the consent bases and exceptions established by the Law. Where applicable, consent may be implied after this notice is made available to you and you do not object. Financial or asset data will be processed with express consent, subject to applicable legal exceptions.

You may revoke consent at any time, without retroactive effect, through the procedure described under ARCO rights.

Transfers of personal data

OLA may make domestic or international transfers without additional consent only where one of the circumstances in Article 36 of the Law applies, including a legal obligation, necessity for the contracted services, or recognition, exercise or defence of a right in judicial proceedings. In all other cases, the applicable consent will be obtained.

ARCO rights, restriction and revocation

You may exercise your rights to access, rectify, cancel or object to the processing of your personal data (ARCO rights), as well as restrict their use or disclosure and revoke consent, by writing to proteccion_datos_personales@ortizlinares.com or presenting a request at our address.

The request must include:

• Your full name and means of receiving notices.
• Documents proving your identity or, where applicable, legal representation.
• A clear description of the data in respect of which you seek to exercise an ARCO right, except for access requests.
• The right you seek to exercise or specific request.
• Supporting documentation where rectification is requested.

OLA will communicate its decision within 20 days of receiving the request and, where granted, give effect to it within the following 15 days. Time limits may be extended once for an equal period where circumstances justify it.

Exercise of ARCO rights is free, except for reproduction, copying or delivery costs under the Law. Cancellation may not proceed where legally prevented or where data are required to fulfil legal or contractual obligations, including client-identification files required by applicable law.

Procedure before the authority

If you believe that your right to personal-data protection has been infringed, you may initiate the rights-protection procedure before Mexico’s Ministry of Anti-Corruption and Good Government, as provided by the Law.

Changes to this notice

Any amendment to this notice will be published in the “Privacy Notice” section of this website.