Privacy
Policy
July 2022
GENERAL
​
Oxtron SAS (hereinafter "Oxtron") in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties, its regulations, guidelines and other related and applicable provisions (hereinafter jointly the "Law" ), and in compliance with the obligation under its responsibility, consisting of the protection of the Personal Data to which it has access by its clients, affiliates and/or beneficiaries of any of the products or services belonging to the concept commercially known as “Oxtron ”, hereby informs you of the privacy policy (the “Privacy Notice”) and the treatment that it will give to the Personal Data that is collected, directly in its establishment; via telephone; via email; social networks and/or through its portals www.oxtron.mx, (hereinafter a "website"), thus guaranteeing that the processing of your Personal Data is carried out in a legitimate, controlled and informed manner, preserving the right of the owner of Personal Data to privacy and informative self-determination, through the use and implementation of high technical, physical and administrative security measures, in order to prevent any damage, loss, alteration, destruction, use, access or unauthorized treatment, of accordance with the following:
​
Identification and address of the person responsible for processing your Personal Data.
​
Oxtron, indicates its address to hear and receive notifications that located in extension calle 26, number 86A, colony San José Vista Hermosa, C.P. 72190, Puebla, Pue, will be responsible for the treatment of the Personal Data that it collects from its subscribers, clients, suppliers, users, employees and the general public that provide data in favor of Oxtron (who hereinafter will be referred to collectively as the "Holder") through the means described above, likewise, informs you that Personal Data will be treated and protected based on the principles of legality, quality, consent, information, purpose, loyalty, proportionality and responsibility, established in the law.

Concepts in this privacy policy, e.g. “data controller”, “data subject”, “personal data”, “processing”, “data processor”, “standard contractual clauses” and “supervisory authority”, shall have the meaning ascribed to them in Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) or otherwise in the, where applicable, unless the circumstances distinctly require another order of interpretation.

This privacy policy serves to assure that Oxtron processes personal data in accordance with applicable privacy laws and regulations.

Below follows a description of how Oxtron processes personal data as well as information regarding the rights of the data subjects and how the data subjects can get in contact with Oxtron and/or exercise its rights.

CHANGES TO THE PRIVACY POLICY

Oxtron may at its sole discretion make changes to this privacy policy. Oxtron undertakes to inform affected data subjects of any material changes to the privacy policy.

OBJECTIVES AND LEGAL BASIS FOR OXTRON’S PROCESSING OF PERSONAL DATA

The main purpose of Oxtron’s processing of personal data is to enable Oxtron to offer its services in full, provide information about the services and market the services. Oxtron may however also process personal data due to a legal obligation (e.g. when Oxtron must save the data according to accounting rules), or in order to defend Oxtron against legal claims.

The collection and processing of personal data in order to provide, market, or inform about Oxtron’s services is made on the legal basis of either the data subjects approval, a contractual obligation between the data subject and Oxtron (or Oxtron’s principal if applicable), or an existing legal obligation for Oxtron (or Oxtron’s principal if applicable). Exceptions are made for cases where a prior consent is not possible for practical reasons, the processing of the data is permitted by law, and when Oxtron has a legitimate interest in processing the personal data (e.g. for marketing, follow-up of the services, or for exercising or defending Oxtron against legal claims) according to a so called balance of interests.

The collection and processing of personal data in order to comply with legal obligations or in order to defend Oxtron against legal claims is made on the legal basis of the legal obligation or a balance of interests.

Oxtron does not process any sensitive personal data regarding the data subject without the express consent of the data subject (either to Oxtron or Oxtron’s principal if applicable).

SHARING OF PERSONAL DATA TO THIRD PARTIES

Oxtron will not share personal data with any third party in any other way than what follows from this privacy policy, unless Oxtron is given prior consent from the data subject, or unless Oxtron is obliged to do so following the applicable regulations or unless the personal data is shared in connection with an ongoing legal-, administrative- or recovery procedure in which the data subject and Oxtron are both parties.

Oxtron may use subcontractors for the processing of personal data (so called personal data assistants). Oxtron may also need to use the subcontractor’s services to store personal data. Oxtron will always limit such subcontractors’ access to personal data to the minimal amount needed for Oxtron to still be able to reach the objective of the processing of the personal data.

Oxtron requires all subcontractors to (i) protect personal data in accordance with this privacy policy and (ii) not use or disclose personal data for any purpose other than to provide the agreed upon services to Oxtron.

STORING OF PERSONAL DATA

All personal data stored by Oxtron is stored locally with Oxtron, or on an external server provided by Oxtron’s personal data assistant in the MEXICO.

Personal data will not be stored for any longer than necessary, with regards to the objective of the processing, and taking into account Oxtron’s legal obligations regarding to accounting regulations etc.

Oxtron regularly deletes personal data which is no longer needed with regards to the objective of the processing, in accordance with the applicable regulations in force at any time.

THE RIGHT TO REQUEST INFORMATION

The data subject has a right to request and obtain, free of charge, information regarding what personal data, relating to such data subject, is being processed, at any time, by Oxtron (a so-called register extract).

If a data subject wishes to know if Oxtron processes any personal data about the data subject, he or she can send a written request to Oxtron in accordance with section 16 below. In the request, the data subject needs to indicate specifically what kind of information the data subject is interested in receiving (unless the data subject is interested in receiving information about all personal data being processed). That way, Oxtron can provide the data subject with information that is relevant.

If a data subject repeatedly sends requests for extracts from the register, Oxtron may charge a fee or, in some cases, in accordance with statutory law, refuse to comply with the requests.

The extract from the register will be sent to the data subject within 30 days from the time Oxtron received the request. If the extract is extensive and Oxtron needs more time or if Oxtron for some reason cannot comply with the data subject’s request, Oxtron will without undue delay notify the data subject thereof.

THE RIGHT TO RECTIFICATION

In order to fulfill its obligations to always have accurate and relevant personal data, Oxtron systematically works with its registers and updates personal data where necessary.

If a data subject notices that the personal data Oxtron processes is incorrect or if Oxtron lacks important personal data, the data subject has the right to have their personal data corrected.

Oxtron normally performs simple data corrections without consideration, but in some cases Oxtron may need to consider the data subject’s request. Oxtron will not approve the data subject’s request if it is impossible or requires an unreasonable amount of work

In the event that personal data is changed at the data subject’s request, Oxtron will inform any subcontractors and partners that processes the personal data about the change. Upon written request by the data subject, Oxtron will also inform the data subject about to whom the corrections have been submitted

THE RIGHT TO ERASURE
​
A data subject has the right to request that Oxtron erases personal data when:

-
they are no longer needed for the objectives for which they have been collected and for which they are being processed;
 -
Oxtron processes personal data on the legal basis of consent and the data subject withdraws said consent;
 -
Oxtron processes personal data for direct marketing and the data subject opposes the continued processing for this objective;
 -
Oxtron processes personal data on the legal basis of a balance of interests and there are no legitimate interests that outweighs the data subject’s interest;
 -
Oxtron does not process personal data in accordance with applicable regulations;
 -
It is required that personal data is erased in order to fulfill a legal obligation; or
 -
there is another relevant legal basis for the data subjects request to erase the personal data.

Oxtron has the right to refrain from erasing personal data if Oxtron needs to retain these in order to fulfill a legal obligation, to be able to make legal claims against a data subject, or in defense against legal claims from a data subject.

When Oxtron receives a data subject’s request regarding erasure, Oxtron will conduct an assessment in order to evaluate if there are reasons to erase the personal data. The data subject will then be informed about Oxtron’s assessment. If the personal data are erased at the data subject’s request, Oxtron will also instruct suppliers and third-party partners, to which personal data has been transferred, that the personal data are to be erased.

THE RIGHT TO RESTRICTION OF PROCESSING

A data subject has the right to request the restriction of Oxtron’s processing of personal data when:

-
the data subject has disputed the accuracy of the personal data, during the time Oxtron has the opportunity to check whether the personal data are correct;
 -
the processing is illegal, and the data subject opposes that the personal data is deleted and instead requests a limitation of its processing;’
 -
Oxtron no longer needs the personal data for the purposes of the processing, but the data subject needs the personal data to be able to determine, enforce or defend legal claims; or
 -
the data subject has objected to processing in accordance with section 12 below, when awaiting information of the legitimacy of whether Oxtron's interests outweigh the interests of the data subject.
​
Restriction of processing implies that the personal data will be marked, so that they in the future may only be processed for certain limited purposes.

DELETION OF PERSONAL DATA

Personal data will not be retained for any longer than is necessary with regard to the objective of the processing, and Oxtron will otherwise delete personal data in the manner that follows from applicable regulations.

If a data subject requests that personal data shall be deleted, Oxtron will delete or de-identify the personal data no later than 30 days from the reception of the request. This is provided that the personal data are not required to be saved in order for Oxtron to fulfill its legal obligations or to be able to exercise its legal claims.

THE RIGHT TO WITHDRAW CONSENT AND OBJECT TO PROCESSING

A data subject has the right to object to Oxtron’s processing of personal data which Oxtron processes on the legal basis of a so-called balance of interests.

If a data subject wishes to exercise the right to object to the processing, the data subject needs to specify in writing which processing the data subject objects to.

In the event of an objection by a data subject, Oxtron may only continue to process the personal data if Oxtron can show that there are compelling and entitling reasons for why the personal data must be processed, and provided such reasons outweigh the data subject’s interests.

If personal data is processed for direct marketing, a data subject always has the right to object to the processing at any time.

THE RIGHT TO DATA PORTABILITY

If a data subject has provided his or her personal data to Oxtron, the data subject may, in some cases, be entitled to extract his or her personal data in order to, for example, move them to another company.

In order for a data subject to be able to use his or her right to so called data portability, the data subject’s request must relate to personal data that the data subject himself/herself has provided to Oxtron and which Oxtron processes with the consent of the data subject or to fulfill an agreement with the data subject.

The right to data portability does not apply when Oxtron’s processing of the data subject’s personal data is based on a balance of interests or a legal obligation for Oxtron. The right to data portability does not apply when data portability is technically difficult to implement.

THE RIGHT TO COMPLAIN

A data subject has the right to complain on Oxtron’s processing of personal data.

Oxtron kindly asks that any data subject who wishes to complain initially contacts Oxtron, so that Oxtron can address the complaint and assist the data subject in the best way possible.
The Holder may: (i) know the Personal Data that Advalitie possesses and the details of its treatment; (ii) rectify your Personal Data if it is inaccurate; (iii) cancel the processing of Personal Data when it considers that they turn out to be excessive or unnecessary for the purposes that justified their collection; and (iv) object to the processing of your Personal Data for specific purposes.
- The Holder must consider that, for certain purposes, the revocation of consent to the processing of Personal Data will imply that Oxtron cannot continue providing the product and/or service requested by the Holder.
- ​At any time, the Owner may revoke the consent granted for the processing of their Personal Data, so that they are no longer used. In case you need to limit the use and/or disclosure of Personal Data or exercise any of your rights of access, rectification, cancellation or opposition ("A.R.C.O Rights"), you must direct your request: (i) to the email info@oxtron.mx, and must confirm receipt of said document by email, from Monday to Friday from 9:00 a.m. to 5:00 p.m., on business days, as appropriate; and (ii) title the email "RIGHTS A.R.C.O."
- The exercise of the A.R.C.O. It will be free, and the Holder must cover the costs of sending, reproducing and/or certifying documents. Notwithstanding the foregoing, in the event that the request is reiterated within a period of less than 12 (twelve) months, the response to the reiteration of a request by the Holder will have a cost that will not exceed 3 days of the general minimum wage in force in Mexico City.
​
For the above, you must inform Oxtron, clearly and precisely, of the Personal Data that the Owner wishes to be rectified, canceled or revised, as well as the purpose for which they were provided and, in general, comply with the requirements mentioned in art. 29 of the Law:
-
Full name of the Holder, address, telephone and email account, to be able to communicate the response to your request.
-
The documents that prove the identity or, where appropriate, the legal representation of the Owner of the Personal Data.
-
A clear, succinct and precise description of what is requested.
-
Any other element or document that facilitates your case, to comply with your request and/or to issue a response to it.
​Oxtron will have a period of no more than 60 (sixty) business days after receipt of the aforementioned request to respond to it, and 15 (fifteen) business days more to make effective the exercise of the right requested, in the event that be appropriate.
​
The aforementioned terms may be extended for an equal period, as long as the circumstances of the case justify it.

SECURITY

Oxtron undertakes to implement all appropriate technical and organizational security measures, that are required in accordance with applicable regulations, to ensure a high level of security, appropriate to the risks of the processing of personal data, and to protect personal data from accidental or unlawful destruction, loss, alteration, and unauthorized disclosure of, or access to, processed personal data.

Upon written request by a data subject, Oxtron will inform the data subject about which security measures are being implemented for the personal data of the data subject.
Granting of Consent
By providing the Personal Data, the Owner confirms and accepts that prior to the collection and/or processing of their Personal Data, the Owner has read and consents to comply with the provisions of this Privacy Notice. Likewise, in case of providing sensitive Personal Data and / or of a patrimonial and / or financial nature, her consent will be obtained expressly and in writing, leaving as evidence her autograph signature, electronic signature, or any authentication mechanism that for this purpose. be established. The foregoing, based on articles 8 and 9 of the Law and articles 11, 12, 14, 15, 16 of the Regulations of the Law, without prejudice to the cases of exception provided for in articles 10 and 37 of the Law that They empower us to process Personal Data and transfer it in order to comply with our obligations in legal, contractual terms, or by virtue of the legal, present and/or future relationship that we have or that we have with the Owner.

CONTACT INFORMATION

If a data subject wishes to exercise his or her rights under this privacy policy, a request shall be made in written form and sent to Oxtron by email to info@oxtron.mx .

If the data subject has any questions about this policy or Oxtron’s personal data processing, the data subject can contact Oxtron by email to info@oxtorn.mx .