In compliance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties, its Regulations, and the Guidelines of the Privacy Notice (hereinafter, the “Personal Data Law”), we hereby inform you of the present Privacy Notice of GMéxico Transportes, S.A.B. de C.V. (the “Controller”), with address at Bosques de Ciruelos No. 99, Colonia Bosques de las Lomas, Miguel Hidalgo, Mexico City, C.P. 11700.
1. Personal data subject to processing.
As part of our registry of clients, suppliers, and users, certain personally identifiable information about you may be collected and processed. The information that may be collected and processed includes the following:
1) Identification data: full name, marital status, signature, electronic signature, Federal Taxpayer Registry, Unique Population Registry Code, image or images identifying you, place and date of birth, age, names of relatives, dependents, and beneficiaries.
2) Contact data: home address, personal, mobile, and/or work phone numbers, as well as email accounts.
3) Professional data: occupation, position, area or department, work address, work phone number and email, extracurricular activities, employment references, personal references, academic background, performance history within the company, among others.
We are committed to ensuring that such data will be processed under strict security measures, always guaranteeing its confidentiality.
For the purposes stated in this notice, we may collect your personal data in different ways: when you provide it directly to us; when you visit our websites or use our online services; by telephone; through the voluntary provision of data when entering our facilities; as well as through other sources permitted by the Personal Data Law.
2. Purposes of processing your personal data.
Your personal data will be processed for the purposes detailed below:
Primary Purposes
- To identify and/or contact you.
- To control entry and exit records of our facilities.
- To market the products and services offered by GMéxico Transportes, S.A.B. de C.V., its affiliates and/or subsidiaries.
- To update the records and system programs of GMéxico Transportes, S.A.B. de C.V., its affiliates and/or subsidiaries.
- To comply with requirements made by authorities, when necessary to safeguard public interest, law enforcement, or the administration of justice.
- Where applicable, the drafting, preparation, definition, and execution of any document to be entered into with any client, supplier, service provider, or advisor as required.
- Compliance with obligations arising from the legal relationship established with the client.
- To provide the services and products requested by the client in a timely and proper manner.
Secondary Purposes
- Market research and product promotion.
- Sending advertising and promotions regarding our products and services.
- Analysis to determine the effectiveness of our advertising and promotions.
- Discount programs, reimbursements, and other programs in which the client or user chooses to participate, as well as quality assurance.
- Conducting inquiries, research, and reviews related to the services provided, complaints, or claims.
You will have a period of 5 business days to object to the processing of your personal data for the secondary purposes mentioned in this Privacy Notice. To do so, you must contact us through the mechanisms mentioned later. Otherwise, you may limit the use of your personal data for secondary purposes, in accordance with the mechanisms provided in this Privacy Notice.
3. Transfers and Purposes.
For the fulfillment of the purposes of this Privacy Notice, the Controller may carry out the transfer and/or referral, both nationally and internationally, of data without your consent, in accordance with the terms of the Personal Data Law, in the following cases:
a) When the transfer is made to parent companies, subsidiaries, or affiliates belonging to the same group as the Controller and operating under the same internal processes and policies;
b) When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the Controller and the data subject;
c) When the transfer is provided for in the Personal Data Law or in treaties to which Mexico is a party;
d) When the transfer is necessary for medical prevention or diagnosis, the provision of healthcare, medical treatment, or the management of health services;
e) When the transfer is necessary by virtue of a contract entered into or to be entered into in the interest of the data subject, by the Controller and a third party;
f) When the transfer is necessary or legally required to safeguard public interest, or for law enforcement or the administration of justice; and
g) When the transfer is necessary for the recognition, exercise, or defense of a right in a judicial process.
Additionally, the Controller may transfer personal data to third parties that the Controller deems necessary for the operation of its electronic sites and the proper provision of services, as well as for marketing and commercialization purposes.
The third parties and entities receiving personal data will be made aware of the terms under which you subjected the processing of your personal data, as established in this Privacy Notice.
4. Means for Exercising ARCO.
Rights of the Data Subject You or your legal representative may exercise any of the rights of access, rectification, cancellation, or opposition (hereinafter, the “ARCO Rights”), as well as request the revocation of your consent, by sending an email to the Controller at the following address: datospersonales@gmxt.mx.
Your request must be made through an application to exercise ARCO Rights and revocation of consent, which should be sent to the email address datospersonales@gmxt.mx and must contain all the elements necessary to address the exercise of your right and/or revocation of consent in accordance with applicable regulations. The exercise of such rights and/or revocation of consent will be free of charge, with you only being responsible for shipping, reproduction, and, where applicable, certification costs of documents.
For the Controller to follow up on your request, you or your legal representative must properly prove your identity by including the following information with your application:
- Your name and email address;
- A copy of documents proving your identity (e.g., voter ID, passport, or any other official identification) or, where applicable, proof of legal representation;
- A clear and precise description of the personal data regarding which you seek to exercise any of your ARCO Rights;
- Any document or information that facilitates locating your personal data; and
- In case of requesting rectification of your personal data, you must also indicate the modifications to be made and provide documentation supporting your request.
Once your application is submitted, the personal data department will acknowledge receipt on the same day it is received. If the information provided in the application is incorrect or insufficient, or if the required supporting documents are not included, the Controller may, within five (5) business days following receipt of the application, request that you provide the necessary elements or documents to process it. You will have ten (10) business days to respond to this request, counted from the day after you receive it. If you fail to respond within this period, the application will be deemed not submitted.
The Controller will communicate its decision within a maximum of twenty (20) business days from the date the application was received, so that, if appropriate, it may be enforced within fifteen (15) business days following the communication of the response. Please note that such response may be affirmative or negative, and will be duly substantiated. The response will be sent electronically to the email address specified in the application.
Furthermore, regarding ARCO Rights, their exercise may be restricted for reasons of national security, public order provisions, public safety and health, or to protect the rights of third parties, or by resolution of a competent authority duly substantiated and grounded. If your ARCO Rights are restricted for the aforementioned reasons, you will be notified accordingly.
Additionally, pursuant to Chapter VII of the Federal Law on Protection of Personal Data Held by Private Parties, if you believe that your right to data protection has been violated, you may initiate a rights protection procedure before the National Institute for Transparency, Access to Information and Protection of Personal Data (formerly the Federal Institute for Access to Information and Data Protection).
It is important to consider that, for the purposes that gave rise to and are necessary for the development of the relationship you maintain with the Controller, in the event you request cancellation or opposition to the processing of your data, the data subject accepts that such relationship with the Controller may not continue.
5. Mechanisms to Limit the Use or Disclosure of Personal Information.
You may limit the use or disclosure of your personal data to prevent it from being used or disclosed for purposes not necessary for the legal relationship between you and the Controller.
If you wish to limit the use or disclosure of your personal data, you must submit your request through the same mechanisms available to exercise your ARCO Rights and/or revoke your consent.
6. Use of Cookies.
On the website https://www.ferromex.com.mx/ (hereinafter, the “Website”), we use our own cookies to improve your user experience. The information collected through the cookies mentioned in this section will provide the Controller with means of session identification, authentication, or user preferences.
You are hereby informed that you may disable the use of such cookies through the following:
Microsoft Edge
- In the address bar, go to Settings and more (Alt+F).
- Select the Settings option.
- Go to Site permissions.
- Click on Cookies and site data.
- Disable the option “Allow sites to save and read cookie data (recommended).”
- Close the settings window.
Chrome
- Open Chrome.
- At the top right, click More and then Settings.
- Under “Privacy and security,” click Cookies and other site data.
- Click Block all cookies.
Firefox
- Click the Firefox menu button and select Options.
- On the left side, click Privacy & Security.
- In the Private Browsing section, click Customize.
- Disable the Cookies option.
Safari
- In Safari, go to Settings > Safari.
- In the Privacy & Security section, disable the option Block all cookies.
By browsing the Website, it will be understood that you consent to the use of cookies under the conditions established in this Privacy Notice.
7. Personal Data Department.
For any inquiries regarding the protection of your Personal Data, please contact the Controller’s Privacy Officer, who is designated to handle and process any request related to personal data and the exercise of ARCO Rights (located at the Controller’s address), or send an email to datospersonales@gmxt.mx, provided that receipt is confirmed by telephone. You may also contact us at 55 52463700, Monday to Friday, from 8:00 a.m. to 6:00 p.m. (Central Mexico time).
8. Procedures and Means for Changes to the Privacy Notice.
The Controller reserves the right to update and/or modify the terms of this Privacy Notice at any time, to address legislative developments, internal policies, or new requirements for the provision or offering of our products or services, as well as market practices. Such modifications or updates will be made available to the public through this medium. You may request the most updated Privacy Notice from the Controller via email at datospersonales@gmxt.mx.
This Privacy Notice is subject to the applicable legislation of the United Mexican States.