Privacy Notice

PRIVACY NOTICE

In compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), its Regulations, the Privacy Notice Guidelines, and other applicable provisions, CONSULTORES PHOENIX, S.C., with address at Calle Bahía Las Palmas S/N, Plaza Bahía, Local 4, Col. Campo de Golf, San José del Cabo, Municipality of Los Cabos, Baja California Sur, Mexico, C.P. 23406, shall be referred to in this notice as the “DATA CONTROLLER.”

The DATA CONTROLLER makes available to data subjects this Comprehensive Privacy Notice, through which it informs them of how it collects, uses, retains, protects, transfers and, where applicable, deletes their personal data.

1. Scope of this Notice

This notice applies to the personal data of clients, prospective clients, representatives, beneficiaries, trust beneficiaries, suppliers, service providers, collaborators, and other individuals whose data is processed in connection with the professional, administrative, or management services coordinated or rendered by the DATA CONTROLLER.

Data may be obtained directly from the data subject, through electronic, printed, optical, audio, or visual means; through the data subject’s representatives or authorized persons; or from publicly available sources and third parties authorized to provide it.

2. Personal Data Subject to Processing

Depending on the legal relationship or the service requested, the DATA CONTROLLER may process the following categories of information:

  • Identification data: full name, signature, image, photograph, date and place of birth, age, sex, nationality, marital status, occupation, Federal Taxpayer Registry number (RFC), Unique Population Registry Code (CURP), official identification documents, immigration data, and other information contained in identity documents.
  • Contact data: home or work address, telephone number, email address, and other means designated to receive communications.
  • Family and estate-related data: information regarding the spouse, ancestors, descendants, heirs, legatees, beneficiaries, and other individuals related to the relevant transaction or legal instrument.
  • Employment, professional, and corporate data, activity or occupation, position, company or organization to which the person belongs, powers of representation, immigration status, and related documentation.
  • Asset and financial data: information relating to real property, trust rights, transactions, prices, payment methods, source or destination of funds, income, bank accounts, CLABE interbank number, financial institution, account ownership, and proof of transfers or deposits.
  • Compliance information: data and documentation necessary to identify the client or user and the controlling beneficiary or beneficial owner; information regarding Politically Exposed Persons (PEPs), family or business ties, economic activity, source of funds, and other information required under anti-money-laundering regulations.

The DATA CONTROLLER will only collect data that is adequate, relevant, and necessary for the stated purposes. Where the nature of a matter makes it indispensable to process sensitive personal data, enhanced protection measures will be adopted and the corresponding consent will be obtained, unless applicable law permits processing without consent.

3. Primary Purposes of Processing

Personal data will be used for the purposes that gave rise to, or are necessary to maintain, the legal relationship with the data subject, including to:

  • Identify clients, representatives, beneficiaries, trust beneficiaries, suppliers, and other participants in a transaction or service.
  • Compile, review, update, administer, and retain physical or electronic files.
  • Assess the legal, documentary, and administrative feasibility of the requested service.
  • Prepare, review, negotiate, formalize, and follow up on contracts, agreements, letters of instruction, powers of attorney, public deeds, trusts, and other legal instruments.
  • Coordinate real-estate transactions, purchase and sale agreements, property transfers, and the creation, modification, assignment, or termination of trusts and other related acts.
  • Manage legal, corporate, notarial, registry, cadastral, tax, or administrative filings before private parties and competent authorities.
  • Verify identity, legal capacity, representation, immigration status, corporate structure, ownership of rights, source and method of payment of funds, and other elements necessary for the file.
  • Comply with contractual, tax, administrative, regulatory, record-keeping, and anti-money-laundering obligations.
  • Request, receive, and follow up on quotes, authorizations, opinions, certificates, appraisals, permits, certifications, filings, and other documents related to the contracted services.
  • Share necessary information with notaries public, public brokers, trustees, financial institutions, authorities, registries, cadastral offices, experts, translators, advisors, and other third parties that legitimately take part in the transaction.
  • Maintain communication with the data subject, respond to inquiries, provide updates on the matter’s progress, issue invoices, manage payments, and provide after-service support.
  • Respond to requirements, audits, inspections, proceedings, orders, or requests lawfully issued by competent authorities.
  • Prevent fraud, identity theft, unlawful transactions, and legal or security risks.
  • Exercise or defend the rights of the DATA CONTROLLER or third parties in judicial, administrative, arbitration, or other proceedings.

If the data subject fails to provide the necessary information, or the information is incomplete, the DATA CONTROLLER may be unable to begin, continue, or complete the requested service.

4. Consent for Asset and Financial Data

Given the nature of the services, the DATA CONTROLLER may need to process asset and financial data. Where legally required, the data subject’s express consent will be obtained through the handwritten or electronic signature of this notice, the service agreement, mandate, letter of instruction, corresponding form, or related legal instrument.

Consent will not be required where any of the exceptions provided under applicable law apply.

5. Transfer of Personal Data

The DATA CONTROLLER may transfer or disclose strictly necessary data, within or outside of Mexico, to the following third parties, as applicable:

  • administrative, tax, judicial, immigration, registry, cadastral, or other legally competent authorities;
  • notary offices, public brokerage offices, public registries, cadastral offices, archives, and government agencies;
  • banking, financial, or trust institutions involved in the transaction;
  • legal, tax, accounting, or technical advisors, experts, appraisers, translators, agents, courier companies, and technology providers;
  • agents, agencies, developers, sellers, buyers, and other participants in a real-estate transaction, solely to the extent necessary for its execution;
  • holding companies, subsidiaries, affiliates, or other members of the same corporate group, when operating under equivalent privacy policies; and
  • third parties to whom information must be disclosed to fulfill a legal relationship, protect rights, comply with a legal mandate, or perform the requested service.

In particular, the data subject acknowledges that, in order to coordinate sales, transfers of title, trusts, assignments of rights, full or partial terminations, and other real-estate or trust transactions, it may be necessary to disclose personal, asset, and financial information to credit or trust institutions, notaries, and authorities.

Transfers requiring consent will be submitted to the data subject for prior authorization. Other transfers may be carried out without consent where permitted by law. The DATA CONTROLLER will inform the receiving third party of the purposes and conditions applicable to the processing of the data.

6. Confidentiality, Retention, and Security

The DATA CONTROLLER will keep personal data confidential and will apply reasonable administrative, technical, and physical measures to protect it against damage, loss, alteration, destruction, use, access, disclosure, or unauthorized processing.

Access will be limited to personnel, collaborators, and third parties who need to know the information to perform their duties or obligations and who are bound by confidentiality obligations.

Data will be retained for as long as necessary to fulfill the purposes for which it was obtained, and thereafter for the retention, limitation, archiving, and compliance periods established under applicable civil, commercial, tax, notarial, registry, and anti-money-laundering provisions. Once such periods have elapsed, the data will be securely blocked, deleted, destroyed, or anonymized, as applicable.

The DATA CONTROLLER will not be responsible for information that the data subject has made public, that is legally available from public sources, or that was lawfully obtained from such sources, without prejudice to any obligations applicable to its subsequent processing.

Should a security breach occur that significantly affects the property or moral rights of a data subject, the DATA CONTROLLER will promptly inform the data subject of the nature of the incident, the data affected, the measures adopted, and recommendations to help protect the data subject’s interests.

7. ARCO Rights (Access, Rectification, Cancellation, and Objection)

The data subject, or their legal representative, may at any time request Access, Rectification, Cancellation, or Objection (ARCO) regarding the personal data held by the DATA CONTROLLER.

Requests should be addressed to Francisco Quirino Parra Rodríguez, who is responsible for handling personal-data requests, through any of the following means:

  • Email: quirino.parra@settlement-co.com
  • Address: Calle Bahía Las Palmas S/N, Plaza Bahía, Local 4, Col. Campo de Golf, San José del Cabo, Municipality of Los Cabos, Baja California Sur, Mexico, C.P. 23406.

The request must include, at minimum:

  • The data subject’s full name and an address, email, or other means to communicate the response.
  • Documents evidencing the data subject’s identity and, where applicable, the identity and authority of their legal representative.
  • A clear description of the right the data subject wishes to exercise and of the personal data involved.
  • For a rectification request, the requested change and supporting documentation.
  • Any information that helps locate the data.

The DATA CONTROLLER will communicate its determination within twenty business days of receiving a complete request. If the request is granted, it will be implemented within fifteen business days of the date the response is communicated. These periods may be extended once, for an equal period, when justified by the circumstances and the data subject is informed.

Exercising ARCO rights is free of charge. Only justified reproduction, shipping, or certification costs permitted by law may be charged. If a data subject repeats a request within the period established by law, the authorized costs may apply, unless there have been substantial changes to this notice that warrant a new request.

Cancellation will not proceed where there is a legal or contractual obligation to retain the information, or another applicable exception applies. In such cases, the DATA CONTROLLER will explain the reason for its determination.

Rectification of data within the DATA CONTROLLER’s files or systems does not include the modification or correction of public deeds, contracts, trusts, property titles, or other legal instruments that have already been formalized. If a modification requires the involvement of a notary, trustee, authority, registry, expert, or other third party, the corresponding fees and expenses will be disclosed in advance and will require the data subject’s acceptance; such amounts do not constitute a fee for exercising an ARCO right.

8. Withdrawal of Consent

The data subject may withdraw the consent given for the processing of their data, to the extent permitted by law, by sending a request to Francisco Quirino Parra Rodríguez at quirino.parra@settlement-co.com, with the subject line “Withdrawal of Consent.”

The request must meet, as applicable, the requirements established for exercising ARCO rights. Withdrawal will not have retroactive effect and will not prevent the DATA CONTROLLER from retaining or processing the data necessary to comply with legal or contractual obligations, address responsibilities arising from the legal relationship, or exercise and defend its rights.

9. Accuracy of Information

The data subject must ensure that the information provided is truthful, complete, correct, and up to date, and must promptly report any relevant changes. The DATA CONTROLLER will not be liable for the consequences of false, incomplete, inaccurate, or outdated information provided by the data subject, their representative, or an authorized third party.

10. Compliance with Special Obligations

Given the nature of the professional, administrative, and real-estate management services provided, the DATA CONTROLLER may be subject to special obligations regarding identification, file compilation, client/user due diligence (know-your-customer), identification of the controlling beneficiary, document retention, and the filing of notices or information with competent authorities.

Where processing is necessary to comply with a legal provision, an order from an authority, or obligations arising from the Federal Law for the Prevention and Identification of Transactions with Illegally-Sourced Funds (Mexico’s anti-money-laundering law) and its regulations, the DATA CONTROLLER may carry it out without obtaining additional consent, within the limits permitted by law.

11. Amendments to this Privacy Notice

The DATA CONTROLLER may amend or update this notice as a result of legal reforms, new regulatory criteria, changes in its services or privacy practices, or operational needs.

Amendments will be made available at the DATA CONTROLLER’s address and, where applicable, on its website or through other physical or electronic means it determines. If a change requires obtaining the data subject’s consent again, the DATA CONTROLLER will request it in accordance with applicable law.

12. Competent Authority

The data subject may file a complaint with the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), through its competent administrative unit, if they believe their right to personal data protection has been violated, without prejudice to any other remedies available under applicable law.

13. Applicable Law

The interpretation and application of this notice will be governed by the Mexican Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, the Privacy Notice Guidelines, and other applicable provisions in force.

14. Language

This notice was originally drafted in Spanish. Any translation provided into another language is for informational purposes only. In the event of any discrepancy or difference in interpretation, the Spanish-language version shall prevail.

15. Consent

Where applicable law requires express consent, the data subject declares that they have read and understood this Comprehensive Privacy Notice and authorizes the processing of their asset and financial personal data on the terms set out herein.

Last updated: September 7, 2026