Privacy Notice

RSK AGENTE DE SEGUROS Y DE FIANZAS S.A. DE C.V., SUBSIDIARIES AND AFFILIATES

On July 5, 2010, the Federal Official Gazette (DOF) published the Federal Law on the Protection of Personal Data Held by Private Parties ("the Law"). This Law aims to protect personal data held by private entities and regulate its legitimate, controlled, and informed processing to guarantee individuals' privacy and the right to informational self-determination.

According to Article 2, the Law applies to any natural or legal private persons that process personal data, except for: (i) credit information companies governed by the Law for the Regulation of Credit Information Companies; and (ii) individuals collecting or storing personal data exclusively for personal use without commercial intent.

It is important to note that the Law protects both personal data and sensitive personal data. Personal data refers to any information concerning an identified or identifiable individual. Sensitive personal data includes information that affects the most private areas of an individual or could lead to discrimination or significant risk if misused, such as racial or ethnic origin, present or future health status, genetic information, religious, philosophical, or moral beliefs, union affiliation, political opinions, and sexual preference.

Notices and Rights

To collect and process personal data, companies are required to provide a document in physical, electronic, or any other format ("Privacy Notice") made available to data subjects before processing their personal information. This notice must include at least the following:

Identity and address of the data controller
Purpose of data processing
Options and means provided to limit data use or disclosure
Means for exercising access, rectification, cancellation, or opposition rights (ARCO rights)
Information on data transfers
Procedure for notifying data subjects of changes to the Privacy Notice

In short, obligated companies must draft and provide the Privacy Notice to data subjects via printed, digital, visual, audio, or other formats, allowing them to express their consent regarding the use, disclosure, or transfer of their personal data.

Security Measures

The Law requires all data controllers to implement administrative, technical, and physical security measures appropriate to the sensitivity of the personal data processed. Companies must also designate a person or department responsible for handling data subject requests and promoting data protection internally.

Regarding third-party transfers, the Law states that data controllers intending to transfer data must notify recipients of the Privacy Notice and the purposes for which the data was originally collected. The Privacy Notice must include a clause indicating whether the data subject consents to such transfers, and the third party must comply with the same obligations as the original data controller.

Sanctions

Chapter X of the Law outlines applicable penalties, including fines ranging from 200 to 320,000 times the current daily minimum wage in Mexico City. In cases of repeated violations, an additional fine of 100 to 320,000 times the minimum wage may be imposed, and in certain cases, criminal penalties may apply.

Applicability to RSK

In compliance with the Law and applicable regulations, RSK, located at Prol. Paseo de la Reforma 379, 11th Floor, Santa Fe, Paseo de las Lomas, Cuajimalpa de Morelos, 01219, Mexico City, is responsible for processing your personal data (identification, financial, employment, academic, and immigration) and sensitive personal data (physical characteristics, union membership, racial or ethnic origin, medical history, blood type, present and future health status, genetic information, religious, philosophical, and moral beliefs, and sexual preference).

RSK may collect your personal data directly, electronically, via phone, by mail, or through publicly accessible sources or authorized third-party transfers.

Purposes of Data Processing

A. Primary Purposes:

Prospective Clients and Clients: Your data will be used to evaluate and respond to information requests; offer consulting services; provide insurance and bond policy quotes, placement, and negotiation; assess and prioritize risks; identify potential and hidden risks; determine insurable values and protection needs; assess potential losses; provide claims support; deliver tech and communication support; and carry out analysis, audits, program updates, HR consulting, business services, and pension plans. We also use data for statistical studies, billing, and quality evaluations.

Suppliers: Your data will be used for evaluation, possible contracting, billing, and payment validation for goods and services supplied.

Job Applicants and Employees: Your data will be used in selection, recruitment, background checks, training, development, hiring, and to fulfill legal obligations arising from employment relationships.

Visitors to RSK Facilities: Your data will be used for access control, video surveillance, and to ensure the safety of personnel, equipment, and facilities.

B. Secondary Purposes:

Marketing, promotions, and commercial prospecting
Invitations to participate in promotions, contests, and recreational activities

RSK requires your express consent to process personal and sensitive data. If consent is not granted, RSK may be unable to provide services related to insurance and bond policy placement, consulting, employment opportunities, or employment benefits.

You may express your refusal for secondary purposes by contacting our Privacy Department at servicios@rskservices.mx or calling +52 55 5350 1200. If this Privacy Notice is not provided directly, you have five business days to express your refusal regarding secondary data processing purposes.

Data Transfers

Your data may be transferred to:

Insurance and bond companies for contract negotiations and fulfillment
Related financial/insurance companies to offer complementary products and services
RSK subsidiaries in Mexico or abroad for service improvement and analysis
National and international authorities for legal compliance
Mexican Social Security Institute for legal compliance

ARCO Rights and Consent Revocation

You have the right to access, rectify, cancel, or oppose the processing of your personal data (ARCO Rights), and to revoke previously granted consent. Submit your request to servicios@rskservices.mx. If applicable, data delivery will be free, and only reproduction or shipping costs may apply. RSK provides forms and instructions on our website www.rskservices.mx in the Privacy Notice section.

You may also limit data use through the Public Registry of Users (REUS) managed by CONDUSEF.

RSK websites use cookies to anonymously track session information (e.g., quotes, pages visited). Third parties may send cookies for advertising or features. Users can configure their browsers to accept, reject, or disable cookies—note that disabling cookies may limit personalized features.

Modifications

RSK reserves the right to update this Privacy Notice at any time due to legislative changes, internal policies, or market practices. Changes will be published on our website at www.rskservices.mx, under the Privacy Notice section.

Last update: May 24, 2019.