CANVAS Privacy Notice

This privacy notice (the “Notice”) was prepared in accordance with the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), its Regulations, and the Privacy Notice Guidelines (Lineamientos del Aviso de Privacidad).

1. Identity and Address of the Controller
   Vento Asesores, S.A.P.I. de C.V. (“Canvas” or “we”), is responsible for the processing of your personal data.
   Our address is Monte Caucaso 915, Office 501, Lomas de Chapultepec, 11000, Miguel Hidalgo, Mexico City, Mexico, and our email is alejandra@canvasp.com.
2. Personal Data and Processing Purposes
   1. PRIMARY PURPOSES
   1. Employees or Service Providers
      We collect and use the following data:
      • • Identification data: name, nationality, date of birth, marital status, personal image.
      • • Contact data: address, email, phone number.
      • • Official data: RFC (tax ID), CURP (population registry ID), IMSS (social security) affiliation number.
      • • Professional data: contained in degree certificate, professional license, and educational and professional background documents.
      • • Financial data: bank account information.
      • • Emergency contact data: name, relationship, and phone number of designated person.
      
      We use this data to:
      
      
      • • Establish, maintain and comply with the legal relationship between parties.
      • • Conduct necessary communications.
      • • Prepare contracts and documentation.
      • • Make payments and tax withholdings.
      • • Contact individuals in case of emergency.
   2. Clients:
      
      We collect From Clients:
      • • Identification and contact data: name, address, email, phone number, RFC (tax ID) and tax status certificate information.
      • • Financial data: information about economic capacity, financial and patrimonial situation, tax information, credit history, income, expenses, bank accounts, and other information provided by clients for review, analysis, and service provision.
      
      We collect From employees and representatives (officers, service providers, or advisors) of our clients:
      • • Contact data: name, address, email, phone number, and position.
      
      We use this information to:
      • • Identify and contact our clients.
      • • Provide our services.
      • • Issue invoices and process payments.
      • • Prepare proposals for additional services.
      • • Comply with the contractual relationship.
   3. Potential Clients
      
      We collect:
      • • Identification and contact data: name, address, email, and phone number.
      • • Data of their representatives (officers, service providers, or advisors): name, address, email, phone number, and position.
      
      We use this information to:
      
      • • Contact and communicate with potential clients.
      • • Prepare requested service proposals.
   4. Employment or Service Provider Candidates
      
      We collect:
      • • Personal data: name, nationality, date of birth, address, personal image.
      • • Professional data: educational and professional background, degree, and professional license.
      • • Work or professional references: name, position, phone number, and email of designated references.
      
      We use this information to evaluate the possibility of establishing an employment or service relationship with the candidate.
   2. SECONDARY PURPOSES
      We use your name, position, and email to send you:
      
      • • Information about Canvas events.
      • • News related to Canvas.
      • • Information about relevant financial and economic topics.
   3. DISTINCTION BETWEEN PURPOSES
      
      • • The purposes described in section 1 are necessary to establish and maintain our relationship with you.
      • • The purposes described in section 2 are not necessary for our relationship.
   4. OTHER PURPOSES AND SENSITIVE DATA
      If we need to use your data for a different purpose, we will inform you beforehand. Canvas does not process sensitive personal data. If we need to do so, we will request your express written authorization.
3. Refusal of Personal Data Processing
   If you do not wish us to use your data for the secondary purposes mentioned in Section II.2, you have 5 days from receiving this Notice to inform us by email, including:
   
   • • Your full name.
   • • Documents proving your identity.
   • • Specific indication that you do not want your data used for secondary purposes.
   • • Your address for notifications.
   Even if you don't exercise this right within the specified period, you may do so later through the consent revocation or opposition procedures.
4. Personal Data Transfers
   Canvas will share your personal data with third parties only when necessary to establish, maintain, or comply with our relationship with you.
   If we need to share your data for other reasons, we will request your authorization beforehand, except in cases permitted by Article 37 of the Law.
   When we share your data, we inform the recipient about this Notice and the permitted purposes of use. The recipient must comply with the same obligations as we do.
5. Personal Data Remissions
   To provide our services, Canvas works with providers who support us in different activities. These providers act on our behalf and follow our instructions. They are obligated to:
   • • Use the data only for authorized purposes.
   • • Refrain from using the data for their own purposes.
   • • Comply with this Privacy Notice.
   Our providers may be located in Mexico or other countries.
   Occasionally, we act as processors for our clients and therefore process personal data that these clients provide to us, on their behalf and according to their instructions.
6. ARCO Rights
   You can exercise your rights of Access, Rectification, Cancellation, or Opposition (“ARCO Rights”) through a request that includes:
   
   1. Your name and address or means to communicate the response.
   2. Documents proving your identity.
   3. Clear description of the personal data and the right you wish to exercise.
   4. Any information that helps locate your data.
   For rectification requests, you must also indicate desired modifications and provide supporting documentation.
   We will respond within 20 days maximum and, if applicable, implement changes within the following 15 days. These periods may be extended once for the same period if necessary.
7. Consent Revocation
   You can revoke your authorization for the use of your data by following the procedure in Section VI.
   The revocation:
   • • Has no retroactive effects.
   • • Does not apply when data is needed for a legal or contractual obligation.
8. Use or Disclosure Limitation
   To protect your data:
   • • Our staff executes confidentiality agreements.
   • • We use password-protected security systems.
   • • We limit access to your data.
   To stop receiving promotional communications, you can:
   • • Use the mechanisms in each communication.
   • • Submit a request following the procedure in Section VI.
9. Tracking Technologies
   Canvas will not use cookies, web beacons, or similar tracking technologies.
10. Changes to Privacy Notice
    We will publish any changes to this Notice on canvaspartners.mx.
    For more information, contact us at alejandra@canvasp.com or at our address, mentioning “Privacy Notice” as the subject.