Privacy Notice

1. Identity and address of the data controller

Industrias Notesa, S.A. de C.V. (hereinafter "Notesa"), with address at Guillermo Barroso No. 7, Fraccionamiento Industrial Las Armas, C.P. 54080, Tlalnepantla, Estado de México, Mexico, is the party responsible for the processing, use and protection of the personal data you provide to us.

For any matter relating to this notice or to your personal data, Notesa makes available the email address info@notesa.com.mx, as well as the address stated above.

This notice applies to the personal data we collect through the https://www.notesa.com.mx website — in particular through the contact form — and to data we receive by email, by telephone or in the course of commercial and technical support.

2. Legal framework and basis for processing

This notice is issued in compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP"), its Regulations, the Privacy Notice Guidelines and all other applicable provisions of the United Mexican States.

Processing of your personal data is based on the consent you grant when you send us your information, as well as on the cases provided by applicable law in which processing may take place without consent, including: where processing is necessary to perform obligations arising from a legal relationship between you and the controller; where a legal, tax or accounting obligation applies to the controller; or where a duly founded and justified request is made by a competent authority.

3. Personal data we collect

For the purposes described in this notice, we collect the following categories of personal data:

• Identification and contact data: the name of the person submitting the request, the company or organisation they represent, email address and telephone number.
• Data about your technical or commercial requirement: the product line of interest and the description of your application entered in the form (basis weight, width, finish, estimated volume, applicable standards and any other detail you choose to include).
• Technical browsing data: IP address, browser and device type, operating system, pages visited and date and time of access, obtained through server logs and the technologies described in the cookies section.

We do not collect sensitive personal data as defined by applicable law — that is, data relating to racial or ethnic origin, health status, genetic information, religious, philosophical or moral beliefs, union membership, political opinions or sexual preference — nor do we collect financial or asset data through the website contact form. Please refrain from including sensitive, confidential or trade-secret information in the application description field where it is not essential in order to handle your request.

This website is directed at professionals and industrial buyers. We do not knowingly collect personal data from minors.

4. Primary purposes

Your personal data will be used for the following purposes, which are necessary in order to handle the request you submit and to maintain the corresponding legal or commercial relationship:

• To identify you and contact you by email or telephone.
• To review, process and respond to your request for a quotation, a sample, a datasheet or advice on a specification.
• To prepare quotations, prepare and ship samples, and follow up on product developments built to specification.
• To record and track your request in our internal commercial and quality management records.
• Where applicable, to formalise, document and perform the commercial relationship: order entry and confirmation, invoicing, logistics and delivery.
• To handle clarifications, complaints, warranty matters and requests from competent authorities, and to comply with the legal, tax and accounting obligations applicable to Notesa.

5. Secondary purposes

In addition, and provided you do not object, we will use your personal data for the following purposes, which are not necessary in order to handle your request but allow us to serve you better:

• To send you commercial and technical information about our product lines, finishes and new developments.
• To invite you to plant visits, industrial trade shows, training sessions or events organised or sponsored by Notesa.
• To conduct satisfaction surveys and internal studies aimed at improving our products, our service and this website.

If you do not wish your personal data to be processed for any or all of these secondary purposes, you may say so at any time by writing to info@notesa.com.mx with the subject line "Secondary purposes", stating your name and the email address you registered with. Your refusal will not be grounds for denying you the products or services you request, nor for terminating your relationship with Notesa.

6. Transfers of personal data

Notesa does not sell, rent, assign or trade your personal data, and does not transfer it to third parties for marketing, advertising or commercial prospecting purposes unrelated to Notesa.

Your personal data may only be transferred without requiring your consent in the cases expressly provided by applicable law, including:

• Where the transfer is provided for in a law or in a treaty to which Mexico is a party.
• Where it is required by a competent authority through a duly founded and justified request, or by a judicial ruling.
• Where it is necessary for the recognition, exercise or defence of a right in judicial proceedings.
• Where it is necessary to perform obligations arising from a legal relationship between you and Notesa — for example, before legal, accounting or audit advisers bound by confidentiality obligations.

The technology providers that supply us with website hosting, email and form-processing services process the data solely on behalf of and under the instructions of Notesa, acting as data processors and subject to confidentiality and security obligations. Under applicable regulations, remitting data to a processor does not constitute a transfer.

Should a transfer other than those listed above become necessary in the future, we will inform you by updating this notice and, where the law so requires, we will obtain your prior consent.

7. Retention period

We will retain your personal data for as long as strictly necessary to fulfil the primary purposes described above and, where applicable, for as long as the commercial relationship remains in place, plus any additional periods required by applicable tax, commercial and accounting record-keeping provisions. Once those periods have elapsed, your data will be blocked and subsequently deleted.

8. ARCO rights and how to exercise them

You, or your duly accredited legal representative, have the right to:

• Access: to know which of your personal data we hold, what we use it for and the conditions of the processing.
• Rectification: to request the correction of your personal data where it is inaccurate, incomplete or out of date.
• Cancellation: to request that we delete your personal data from our records or databases where you consider it is not being processed in accordance with the principles and duties imposed by the applicable regulations.
• Opposition: to object to the processing of your data for specific purposes, where there is legitimate cause to do so.

Exercising these rights is free of charge. To do so, send a request to info@notesa.com.mx with the subject line "ARCO rights". The request must contain and be accompanied by at least:

1. Your full name and an address or email address at which we may communicate our response.
2. A copy of valid official identification proving your identity and, if acting through a representative, the document accrediting that representation together with the representative’s identification.
3. A clear and precise description of the personal data in respect of which you seek to exercise an ARCO right, and of the right you wish to exercise.
4. Any other element or document that helps us locate your personal data, such as the approximate date of your original request or the email address you wrote from.
5. In the case of rectification, a precise statement of the changes requested together with documentation supporting them.

Notesa will communicate its determination within a maximum of twenty business days from the date the request is received so that, if the request is well founded, it may be given effect within the fifteen business days following the date on which the response is communicated. These periods may be extended once for an equal period where the circumstances of the case so warrant, in which event you will be notified.

Delivery of the personal data is free of charge; you will only be required to cover, where applicable, justified shipping costs or the cost of reproduction in copies or other formats. Please note that exercising the rights of cancellation or opposition may prevent us from continuing to handle the quotation, sample or development request you have submitted.

9. Revocation of consent

You may revoke the consent you have granted us for the processing of your personal data at any time. To do so, send your request to info@notesa.com.mx with the subject line "Revocation of consent", accompanied by the same elements set out for ARCO requests. Your request will be handled within the same periods indicated in the previous section.

Revocation will not have retroactive effect and will not apply where retention or processing of the data is necessary in order to comply with a legal obligation applicable to Notesa, or to perform obligations arising from a legal relationship in force between you and Notesa.

10. Limiting the use or disclosure of your data

If you wish to limit the use or disclosure of your personal data — for example, to stop receiving commercial communications or event invitations — you may request this by writing to info@notesa.com.mx with the subject line "Limitation of use". We will record your request in our internal exclusion list and confirm your registration.

11. Cookies and tracking technologies

This website may use cookies, browser local storage and server logs. Cookies are small text files stored on your device that make it possible to remember preferences and recognise your browser between visits.

The technologies used fall into the following categories:

• Strictly necessary: these enable the website to function, remember basic preferences such as the selected language, and protect form submissions against abuse. Without them the site cannot operate correctly.
• Measurement or analytics: these tell us, in aggregate, which sections are consulted and how the site is navigated, so that we can improve it. They will only be activated in accordance with the consent mechanism displayed on the site, where applicable.

You may disable or delete cookies at any time through your browser settings. Please note that if you do so, some features of the site may stop working correctly.

12. Security measures

Notesa has implemented and maintains reasonable administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorised use, access or processing. Access to the information is limited to personnel who need to know it in order to fulfil the purposes described in this notice, and who are bound by confidentiality duties.

13. Changes to this privacy notice

Notesa reserves the right to amend or update this privacy notice at any time, whether as a result of new legal requirements, of our own needs regarding the products or services we offer, of our privacy practices, or of changes to our business model.

Any amendment will be brought to your attention by publishing the current version on this same page, indicating the date of the last update. Where the change is substantial and the regulations so require, we will notify you by email at the address you have provided. We recommend that you review this page periodically.

14. Competent authority

If you believe that your right to the protection of personal data has been harmed by any conduct or omission on our part, or you suspect a breach of the provisions of the applicable legislation, you may file the corresponding complaint before the competent personal data protection authority in Mexico, in the terms and within the periods that such legislation establishes.

15. Acceptance of these terms

By submitting the contact form on this website, or by providing us with your personal data by email, by telephone or in person, you represent that you have read, understood and accepted the terms of this privacy notice, and you grant your consent to the processing of your personal data on the terms described herein.