Privacy Notice

 

Abucombal S.A. de C.V., with registered address at Avenida Guty Cárdenas 310, San Nicolás, León, Guanajuato, C.P. 37480, Mexico, in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), is the Data Controller responsible for the processing of personal data.

 

This Privacy Notice informs you of the terms and conditions under which we process personal data collected from clients, suppliers, employees, job applicants, and any related individuals.

 

 

1. Personal Data We Collect

 

Depending on the nature of your relationship with Abucombal (client, supplier, visitor, employee, or applicant), we may collect the following categories of personal data, including data provided directly by you:

 

 

a) Identification Data

 

Full name, marital status, nationality, taxpayer ID (RFC), unique population registry code (CURP), date and place of birth, and copies of official photo ID (such as voter ID/INE, passport, professional license or equivalent identification), and handwritten signature.

 

 

b) Contact Data

 

Home and tax address, work address, telephone number(s), email address, and other similar contact methods.

 

 

c) Employment / Professional Data

 

Occupation, job title/position, area/department, company or institution you work for, length of employment, employment references, and workplace address and contact information.

(Primarily applicable when you represent a legal entity, when creditworthiness is evaluated, or for individuals who work or intend to work with us.)

 

 

d) Financial and/or Asset Data

 

Banking information such as bank name, account number, interbank CLABE, card number (when applicable), account holder name, payment history, income information, assets or property information, credit bureau records or other credit reporting agency information, financial statements or bank statements, and in general any information required to make payments, issue refunds, or perform credit analysis.

(Some of this data is requested to pay suppliers, process customer refunds, or evaluate credit terms.)

 

 

e) Legal and Administrative Documentation

 

Copies of official documents required for the commercial relationship, such as articles of incorporation and amendments (for legal entities), powers of attorney, proof of address, certified bank statements, tax registration certificate (RFC) for individuals or entities, and other documents supporting the information provided.

(These documents may include personal data of you and/or third parties such as attorneys-in-fact or legal representatives.)

 

 

f) Image and Audio Data

 

Images captured through CCTV systems at our facilities (upon entry, during stay, and/or exit) and/or photographs taken for security or access control; voice recordings (e.g., telephone calls may be monitored or recorded for quality and evidence); and video or other recordings obtained through electronic, optical, or audio means during events, meetings, or video conferences related to our operations.

 

 

g) Sensitive Personal Data

 

If you are an employee or job applicant, we may request information related to your health status, including clinical history, pathological background, medical contraindications, lab test results, diagnoses, and medical prognoses. The collection and processing of sensitive data requires your express, written consent.

 

In all cases, Abucombal will process personal data confidentially and implement appropriate safeguards to prevent unauthorized access, damage, loss, alteration, or disclosure.

 

 

2. Purposes of Processing

 

 

2.1 Primary Purposes (Necessary Purposes)

 

The personal data we collect will be used for the following primary purposes, which are necessary for the existence, maintenance, and fulfillment of the relationship between you and Abucombal, as applicable:

 

1. Provide products and services

   To process requests and perform the activities required to provide the products or services you request or contract with us, including quotations, orders, reservations, delivery, shipping, and supply pursuant to applicable agreements.

2. Identity verification and file management

   To confirm and validate your identity, the authenticity of official documents, and, when applicable, your legal authority to represent a legal entity. To create and update your physical or electronic file as a client, supplier, employee, or applicant.

3. Contractual relationship management

   To administer and monitor the commercial relationship, including drafting, executing, filing, and managing contracts, purchase orders, invoices, and related documents, and ensuring mutual compliance with obligations.

4. Invoicing and payments

   To issue tax invoices, record payments, charge and collect amounts due, process supplier payments, execute electronic transfers, and manage returns or refunds in accordance with applicable policies.

5. Credit evaluation and payment terms (when applicable)

   To analyze and evaluate your financial and credit situation to determine eligibility for credit sales, payment terms, or financing, including reviewing provided information, verifying references, and consulting credit reporting agencies (e.g., credit bureaus) where legally applicable and subject to required authorizations.

   Express authorization clause (credit bureau consultation):

   “I authorize Abucombal S.A. de C.V. to consult my credit history with any authorized credit reporting agency.”

   Name and signature: ____________________________  Date: _______________

6. Communication and customer service

   To communicate order status, delivery changes or delays, billing and payment notifications, and to address questions, complaints, clarifications, or suggestions. Also to coordinate appointments, technical visits, and post-sale support.

7. Legal and regulatory compliance

   To comply with applicable laws and lawful requests from competent authorities, including tax obligations (e.g., issuance of electronic tax invoices), customs procedures (when applicable), consumer protection, fraud prevention, and, where applicable, anti-money laundering / “Know Your Client (KYC)” compliance and related audits. We may retain data for legally required periods and share information with authorities as required by law.

8. Internal administrative management

   To maintain efficient internal administration, including updating client/supplier databases, generating internal statistical or historical reports (e.g., sales/purchase volumes, business analysis), and performing internal or external audits.

9. Collections and exercise of rights

   In case of late payment or breach by clients, to conduct administrative or extrajudicial collections, including payment reminders, debt restructuring, or referral to collection agencies or external legal counsel for recovery. Also to pursue or defend legal actions arising from the relationship.

10. Physical and electronic security

    To protect people, assets, and facilities through CCTV, visitor access logs, and—where applicable—recorded calls or electronic communications for security, service quality, staff training, and transactional evidence.

 

Transfers for primary purposes may occur only as permitted by law. In particular, your consent is not required for transfers to administrative, judicial, or health authorities when necessary for legal compliance or legal defense.

 

 

2.2 Secondary Purposes (Optional Purposes)

 

With the exception of sensitive personal data, we may also process your personal data for secondary purposes that are not essential to the main legal relationship but help improve service and operations. These require your consent where applicable:

 

1. Marketing and promotions

   To send promotional, advertising, or marketing communications regarding our products/services, discounts, packages, special offers, events, newsletters, catalogs, or similar communications through email, SMS, phone calls, messaging apps, or social media.

2. Surveys and service improvement

   To conduct satisfaction surveys, market research, consumer preference analysis, and other feedback initiatives to improve customer service, commercial practices, or product development; including participation in promotional activities, raffles, or contests when applicable.

3. References and success stories

   With your authorization, to use your name, contact information, or experience as a commercial reference or success case for prospective clients, including testimonials, only with your specific consent.

   Consent clause (reference / success case use):

   “I authorize Abucombal to use my name and/or experience as a commercial reference or success case.”

   Name and signature: ____________________________  Date: _______________

 

If you do not wish your data to be processed for any or all secondary purposes, you may refuse consent now or at any time by using the mechanism described in the ARCO Rights section. Refusal for secondary purposes will not be a reason to deny the products or services you request or contract.

 

Absolute restriction on sensitive data transfers:

Abucombal will never transfer, under any circumstances, sensitive personal data (including clinical history, diagnoses, medical contraindications, risk history, or similar health information) to third parties unrelated to the employment relationship or unrelated to the healthcare provider that may treat you in the event of a workplace accident or occupational illness. No sensitive data will be transferred for advertising or marketing purposes.

 

 

3. Sensitive Personal Data and Purpose

 

In compliance with Article 9 of the LFPDPPP, we inform you that, within the scope of an employment relationship (current or potential), Abucombal may collect and process sensitive personal data under principles of lawfulness, fairness, consent, quality, and accountability.

 

Sensitive data may include complete clinical background, prior illnesses, surgeries, family medical history, addictions, relevant reproductive health history, and results from clinical, imaging, or laboratory tests where necessary to maintain an employee medical record.

 

These sensitive data will be collected directly from you via onboarding questionnaires and medical assessment notes.

 

Special consent for processing sensitive personal data:

Name and signature: ____________________________  Date: _______________

 

 

4. How We Obtain Personal Data

 

We collect personal data through lawful means and with your knowledge, including:

 

1. Directly from you

   When you provide data in person at our offices/facilities, through forms, contracts, documentation, phone calls, email, messaging apps, our website, or authorized digital communications.

2. Electronic and digital means

   Through our website, online forms, registrations, cookies, web beacons, tracking pixels, and interactions on our official social media pages (e.g., direct messages or contact forms), as described in our Cookies Notice.

3. Legally permitted sources

   From public sources or lawful third parties where permitted, including public registries (e.g., corporate filings, powers of attorney), government validation lists (e.g., RFC validation), and, when applicable and authorized, credit reporting agencies and commercial/banking references.

4. Automatic collection

   CCTV video at our facilities for security, and call metadata (date, time, duration) and recordings where notified, for security, quality, and evidence purposes.

 

 

5. Data Retention Period

 

We will retain your personal data only for the time strictly necessary to fulfill the primary purposes stated above and to comply with applicable legal obligations (including tax and commercial requirements).

 

In general, we will retain your personal data for five (5) years from the termination of the legal or commercial relationship. Once the purpose is fulfilled and mandatory retention periods expire, data will be blocked and subsequently deleted from our systems.

 

 

6. Transfers of Personal Data

 

Abucombal does not sell or rent personal data to unrelated third parties. However, we may disclose or transfer certain personal data to third parties, domestically or abroad, in the following scenarios:

 

1. External legal counsel and collections providers

   For legal representation, dispute handling, and administrative/extrajudicial/judicial collections, under confidentiality obligations and only to the extent necessary.

2. Accountants, auditors, and financial advisors

   For accounting, auditing, tax compliance, and financial reporting purposes, under confidentiality obligations.

3. Financial institutions and payment processors

   To execute payments, refunds, or collections, including required banking details to process transactions securely.

4. Courier, shipping, and logistics providers

   To deliver goods or documents, providing only the data necessary (name, address, phone).

5. Credit reporting agencies and references (when applicable)

   For credit evaluation, subject to legally required consent and authorizations.

6. Affiliates and subsidiaries

   Where necessary to provide integrated services, centralize operations, comply with group policies, or generate consolidated reporting, under equivalent confidentiality and protection standards.

7. Authorities and legally required disclosures

   When mandated by competent authorities or applicable law, or in emergencies that threaten life, health, or safety.

 

We will disclose only the data strictly necessary and ensure recipients assume confidentiality and data protection obligations. Most transfers above do not require consent under Articles 37 and related provisions of the LFPDPPP. Where consent is required, it will be requested separately.

 

 

Marketing Data Transfer Consent (Contact Data Only)

 

Transfer of contact data to third parties for marketing purposes is not necessary for service provision. Therefore, such transfer will occur only if you provide explicit consent.

 

“I ACCEPT the transfer of my non-sensitive contact data to third parties for marketing and advertising purposes.”

[  ] Mark with “X” if you accept

Name and signature: ____________________________  Date: _______________

 

 

7. ARCO Rights (Access, Rectification, Cancellation, Opposition)

 

You may exercise your ARCO rights at any time:

 

• Access: Know what data we hold, how we use it, its origin, and general processing conditions.

• Rectification: Correct inaccurate or outdated data.

• Cancellation: Request deletion when data is not processed in accordance with applicable principles, subject to legal exceptions and mandatory retention requirements.

• Opposition: Object to processing for specific purposes, such as marketing communications.

 

 

How to Submit an ARCO Request

 

Submit a written request at our address above to the Personal Data Department, or email: hey@abucombal.com.mx

 

Your request must include:

 

• Full name and a contact method for response

• Copy of valid official ID (INE/passport/professional ID or similar)

• If applicable, proof of legal representation and representative’s ID

• Clear description of the data and the ARCO right you wish to exercise

• Any details that help locate your records (e.g., client/supplier reference, last interaction date)

 

We will respond within 20 business days. If the request is granted, we will implement it within 15 business days thereafter. If information is missing, we may request additional documentation within 5 days, and you will have 10 business days to comply.

 

ARCO requests are free of charge, except reasonable costs for reproduction and delivery where legally permitted, and in cases of repeated requests within 12 months as allowed by law.

 

If you believe your data protection rights have been violated, you may file a complaint with the Mexican data protection authority (INAI). More information is available at www.inai.org.mx.

 

 

8. Revocation of Consent

 

Where processing is based on your consent (e.g., marketing), you may revoke consent at any time by following the same procedure described for ARCO requests. Revocation does not have retroactive effect and may be subject to legal or contractual obligations that require continued processing.

 

 

9. Limitation of Use or Disclosure

 

You may limit the use or disclosure of your personal data by:

 

• Requesting inclusion in our internal suppression list to stop promotional communications

• Requesting specific lawful limitations via email or written request

 

You may also register your phone number in Mexico’s REPEP (Public Registry to Avoid Advertising) administered by PROFECO to limit advertising calls generally.

 

 

10. Cookies and Online Tracking Technologies

 

On our website www.abucombal.com.mx, we may use cookies and similar technologies (web beacons/pixels) to collect navigation data (language preference, region, browser type, pages visited) to improve user experience, enable certain functions, and generate performance analytics and metrics.

 

You may disable cookies through your browser settings; however, doing so may limit certain website features. Please refer to our Cookies Policy or contact us for more information.

 

 

11. Security Measures

 

We maintain administrative, technical, and physical safeguards to protect personal data, including staff training, role-based access controls, secured physical files, restricted IT access, firewalls, encryption for sensitive data where appropriate, and confidentiality agreements with personnel and third-party providers.

 

If a security breach significantly affects your economic or moral rights, we will notify you promptly in accordance with applicable law.

 

 

12. Updates to This Privacy Notice

 

This Privacy Notice may be modified to reflect changes in our information practices, security measures, or legal requirements. Updated versions will be published on our website or made available at our facilities. If new consent is required for material changes, we will request it accordingly.

 

Last updated: December 8, 2025

 

 

13. Acceptance

 

By voluntarily providing your personal data in person, electronically, or by any other means, you acknowledge that you have read and understood this Privacy Notice and accept its terms.

 

For employees and applicants, the processing of sensitive personal data is subject to your express written consent, as indicated in the “Special consent” section above.

 

 

Contact

 

For questions, comments, or requests related to this Privacy Notice, please contact:

Personal Data Department

Email: hey@abucombal.com.mx

Address: Avenida Guty Cárdenas 310, San Nicolás, León, Guanajuato, C.P. 37480, Mexico

 

​