Comprehensive Privacy Notice (Aviso de Privacidad Integral)

Servicios Jurídicos Beristain, S.C. (“B+A”), with its address for service of notices at Avenida Tecamachalco 35, Colonia Reforma Social, Alcaldía Miguel Hidalgo, C.P. 11650, Mexico City, Mexico, is the data controller of your personal data, pursuant to Article 2, Sections XIV and XVI, of the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, “LFPDPPP”). B+A establishes and maintains security measures to protect your personal data against damage, loss, alteration, destruction, and unauthorized access, use, or processing.

This notice covers the data obtained through the website and the handling of your privacy requests. For processing specific to the engagement or provision of legal services that exceeds this scope, the corresponding notice will be provided to you before any additional data are collected or used.

This notice is issued pursuant to the LFPDPPP published on March 20, 2025, as last amended by the reform published on November 14, 2025; its Regulations (Reglamento de la LFPDPPP, the “Regulations”), published on December 21, 2011; and the Privacy Notice Guidelines (Lineamientos del Aviso de Privacidad), published on January 17, 2013, to the extent they do not conflict with the legal framework currently in force.

Personal Data Collected

Through the contact form at www.beristain-abogados.com, we collect the following personal data:

  1. First and last name.
  2. Telephone number.
  3. Email address.
  4. Information about your inquiry: the subject matter or issue to be addressed, a description of the facts, the authorities or counterparties involved, related deadlines, and whether the matter is personal or business-related.

Browsing data listed in the section on tracking technologies is also collected. If you exercise ARCO rights or request to revoke your consent, we will process the data contained in your request, your address or other means for receiving notices, your identification documents and, where applicable, those evidencing representation, exclusively to verify your identity and process the request.

The contact form does not request sensitive, financial, or asset-related personal data. Please do not include data concerning racial or ethnic origin, health, genetic information, religious, philosophical, or moral beliefs, political opinions, or sexual preference, or banking or asset-related data. Receipt of such information in a message will not be deemed sufficient consent: B+A will not use it to analyze or handle the matter without an applicable legal basis or without first obtaining the corresponding express consent and, for sensitive data, express written consent. The specific data and purposes will be disclosed beforehand; if there is no legal justification for retaining them, they will be deleted.

Purposes of the Processing of Personal Data

The personal data collected through the website will be used for the following primary purposes, which are necessary to handle your request and to maintain the relationship that arises with B+A:

  • Handling, routing to the appropriate legal department, and following up on the requests or inquiries you submit through the website, and contacting the requesting person to respond to them.
  • Notifying you, where applicable, of changes to this Privacy Notice; handling requests concerning your personal data; and complying with the legal obligations applicable to their protection.

Additionally, contact and browsing data may be used for the following secondary purposes, which are not necessary to handle your request:

  • Sending advertising, commercial prospecting communications, and informational newsletters from B+A.
  • Analyzing browsing preferences and behavior to improve and develop B+A’s service offerings.
  • Enabling third-party legal, tax, accounting, or business consulting providers to contact you to propose services related to your request, solely if you authorize the transfer described in this notice.

B+A will use your data for these purposes only if you have first given your acceptance for the specific purpose. You may give it by email to privacidad@beristainabogados.com, stating your name and the purposes you accept. You may refuse at the time of collection or at any later time by sending an email to that same address with the subject line “Opt-Out of Secondary Purposes” (Negativa a finalidades secundarias), stating your name and the purposes you reject. Your refusal will not condition the handling of your request or any services you request or engage.

If this notice was not communicated to you directly or in person, you will have five business days from the date it was made available to you to express your refusal to secondary purposes, pursuant to Article 14 of the Regulations. B+A will not use such data for those purposes during that period or without your prior acceptance. The expiration of that period does not limit your right to refuse thereafter, to revoke your consent, or to object to the processing.

Exercise of ARCO Rights

You may access your personal data and learn the conditions of its processing (Access); request its correction when it is inaccurate, incomplete, or outdated (Rectification); request its cancellation at any time, with the blocking and deletion that are legally applicable (Cancellation); and object to the processing for a legitimate cause, or in the cases of automated processing provided for in Article 26 of the LFPDPPP (Objection). These are the ARCO rights (derechos ARCO: Access, Rectification, Cancellation, and Objection). Exercising one is neither a prerequisite for nor an obstacle to exercising another.

To exercise your ARCO rights, you or your legal representative may submit a request in free-form writing addressed to B+A’s Personal Data Department (Área de Datos Personales), which is responsible for handling it, by either of the following means, without having to use any specific form:

  • In person: at Avenida Tecamachalco 35, Colonia Reforma Social, Alcaldía Miguel Hidalgo, C.P. 11650, Mexico City, Mexico.
  • Electronic: by email to privacidad@beristainabogados.com. That same email address is available for inquiries about the procedure and the protection of your personal data.

The request must contain and be accompanied by the following, pursuant to Article 28 of the LFPDPPP:

  1. Full name of the data subject.
  2. Address or any other means for receiving notices and the response, including an email address.
  3. Documents evidencing your identity and, if acting through a representative, the identity of both and the representation. In person, you may submit a copy of your identification and display the original for verification against the copy. By email, you may send a legible digital copy of your identification; if verification is necessary, you will be offered a free remote verification by video call, displaying the original, without being required to appear in person. You may also use an advanced electronic signature (Firma Electrónica Avanzada) to establish your identity without providing a copy of identification, pursuant to Article 89 of the Regulations. Representation may be established by public instrument, by a power of attorney letter (carta poder) signed before two witnesses, or by a declaration made by the data subject in a personal appearance.
  4. A clear and precise description of the data with respect to which you seek to exercise a right, except in the case of access; and a description of the ARCO right you intend to exercise or of what you are requesting.
  5. Any other element or document that facilitates locating your personal data.
  6. For rectification requests, you must indicate the modifications requested and provide supporting documentation. For objection, state the legitimate cause or the case of automated processing on which you rely. Refusal of secondary purposes may also be expressed through the specific mechanism provided in this notice.

We will notify you of our determination on your request within a maximum of 20 (twenty) business days from its receipt. If the request is granted, we will give effect to the right within the 15 (fifteen) business days following the communication of the response. Each period may be extended only once for an equal period, when circumstances so warrant; we will notify you of the cause within the period being extended, pursuant to Article 31 of the LFPDPPP.

If the request is insufficient or erroneous, or necessary documents are missing, we may require you to provide clarification one time within five business days following its receipt. You will have ten business days, counted from the day after you receive the requirement, to comply. If you do not comply, the request will be deemed not submitted; if you do, the response period will begin anew on the following day, pursuant to Article 96 of the Regulations.

We will provide you with an acknowledgment of receipt showing the date of receipt. We will respond by the means you have indicated, including email or postal address. If your request is denied in whole or in part, we will inform you of the reasons, the relevant evidence, and your right to go before the competent authority; only the statutory grounds for inadmissibility set forth in Article 33 of the LFPDPPP will apply. The part of the request that is admissible will be granted.

Access will be provided, upon verification of identity, through legible electronic documents sent to the means indicated, simple copies, or in-person review. In the latter case, your data will be available to you for a period of not less than 15 business days. The exercise of ARCO rights is free of charge; only reproduction, copying, or shipping costs may be charged. If you provide the medium or mechanism needed to reproduce the data, delivery will be free. For repeated requests within twelve months, the limit of three times the prevailing Unit of Measurement and Update (Unidad de Medida y Actualización, UMA) provided in Article 34 of the LFPDPPP will be observed, except for substantial modifications to the notice that prompt new inquiries.

Where cancellation is granted, we will inform you of the blocking period needed to address possible liabilities; during that period the data will not be used for other purposes and, once it has ended, the data will be deleted and you will be notified. Cancellation will not be granted in the cases set forth in Article 25 of the LFPDPPP. If rectified or cancelled data continue to be processed by third parties to whom they were transferred, we will communicate the request to them so that they take the appropriate action, pursuant to Article 24 of the same Law.

Consent and Revocation

To handle inquiries and operate the website with the ordinary data described in this notice, we will obtain your consent, which may be implied (tacit) when the notice has been made available to you and you do not express your refusal, pursuant to Article 7 of the LFPDPPP. Consent will not be required when the data are indispensable to exercise rights or perform obligations arising from an existing legal relationship with you, pursuant to Article 9, Section IV. The handling of privacy requests and the notices necessary to comply with legal obligations are grounded in Article 9, Section I. B+A will obtain your prior acceptance for the secondary purposes and the transfers subject to consent described in this notice. Silence does not substitute for the express consent required for financial or asset-related data, or the express written consent required for sensitive data, subject to any applicable legal exceptions.

You may revoke your consent at any time, free of charge and without retroactive effect. Revocation does not require us to cease processing grounded in a legal obligation or another applicable exception; in such cases we will explain the reason and the scope of the retention required. If revoking the processing of indispensable data prevents us from handling your inquiry or maintaining the requested relationship, we will inform you of the consequences, without conditioning the service on secondary purposes.

To revoke your consent, you may submit a request addressed to B+A’s Personal Data Department by either of the following means:

  • In person: at Avenida Tecamachalco 35, Colonia Reforma Social, Alcaldía Miguel Hidalgo, C.P. 11650, Mexico City, Mexico.
  • Electronic: by email to privacidad@beristainabogados.com. You may use this channel to revoke consent given by electronic means.

The request must include the following data and documents; verification of identity and representation will be carried out by the means described in the ARCO rights section:

  1. Full name of the data subject.
  2. Address or any other means for receiving the response.
  3. Documents or mechanism evidencing your identity and, where applicable, the identity and capacity of your representative.
  4. The data or processing with respect to which you revoke your consent, indicating whether the revocation is total or partial.
  5. Elements that allow us to locate the data or the consent to which your request refers.

We will respond within a maximum of 20 business days from receipt and, if granted, will give effect to the revocation within the 15 business days following the response. The rules on clarification and extension of periods set forth in the ARCO section will apply, without exceeding the statutory periods. The response will be sent to the means indicated in your request. If you request confirmation of cessation, we will respond to it expressly. We will notify the revocation to the processors (personas encargadas) that continue to process the data on B+A’s behalf, so that they take the corresponding action.

Options to Limit the Use or Disclosure of Your Personal Data

In addition to ARCO rights and revocation, you may request, free of charge, that we stop sending you advertising, commercial prospecting, or newsletters by writing to privacidad@beristainabogados.com with the subject line “Limit Use or Disclosure” (Limitar uso o divulgación). State your name, the email address or telephone number at which you receive the communications, and the uses you wish to limit. We will record your refusal and confirm that it has been handled within the following five business days. This mechanism does not require a specific format and will not affect communications strictly necessary to handle your request or comply with legal obligations.

Transfers and Remissions of Personal Data

National or international transfers will be limited to the recipients and purposes described below. Without requiring your consent, we may transfer the strictly necessary data to competent administrative or judicial authorities to comply with legally enforceable obligations or requirements, to seek or administer justice, or to exercise or defend rights in judicial proceedings, solely when any of the cases set forth in Article 36, Sections I, V, or VI, of the LFPDPPP applies.

With your prior acceptance, we may transfer only your name, telephone number, and email address to third-party legal, tax, accounting, or business consulting providers acting as independent data controllers, so that they may contact you and propose professional services related to the subject matter of your request. This transfer is optional and requires your consent, which will be obtained through the following clause.

In every transfer, we will communicate this notice and the authorized purposes to the recipient. The recipient will assume the obligations applicable to the transferring data controller and will process the data in accordance with those conditions. International transfers will also observe the applicable legal and regulatory safeguards; the existence of a commercial relationship with the recipient does not, by itself, constitute an exception to consent.

For the transfer to third-party legal, tax, accounting, or business consulting providers described in this section, please indicate your decision: ☐ I accept the transfer of my name, telephone number, and email to such providers so that they may contact me and propose services related to my request. ☐ I do not accept that transfer. You may communicate your decision to privacidad@beristainabogados.com, stating your name and the option chosen. The options will not be pre-checked. B+A will not make this transfer without your verifiable prior acceptance; your refusal will not prevent B+A from handling your request.

The communication of data to providers that act exclusively on behalf of and under the instructions of B+A, for hosting and operating the website, database administration, or email, constitutes a remission to processors (remisión a personas encargadas). The relationship must be formalized in writing and must oblige them to use the data only for the instructed purposes, maintain security and confidentiality, delete the data when appropriate, and refrain from using them for their own purposes or transferring them outside the permitted cases, pursuant to Articles 49 through 54 of the Regulations. If a provider acts for its own purposes, the rules on transfers will apply.

Use of Tracking Technologies on Our Website

At www.beristain-abogados.com we use cookies and web beacons to automatically collect the browsing data listed in this section. Their processing will be limited to the following purposes, distinguishing necessary purposes from secondary ones:

  • Necessary purposes: to enable the operation and navigation of the website, retain language preference and session continuity, and maintain the security of the site.
  • Secondary purpose: to analyze browsing preferences and behavior to improve and develop B+A’s service offerings.
  • Secondary purpose: to conduct advertising, commercial prospecting, and the sending of B+A newsletters.
  • Technologies intended for secondary purposes will be used only with your prior acceptance, through a choice mechanism with no pre-checked options. Merely entering the website will not constitute such acceptance.

The personal browsing data obtained through these technologies are:

  • Language preferred by the user.
  • Region where the user is located.
  • Type of browser used by the user.
  • Type of operating system used by the user.
  • Date and time of the start and end of a user’s session.
  • Pages visited within the website.
  • Searches performed within the website.
  • Advertising viewed on the website.

You may disable non-essential cookies through your browser’s privacy options: open its settings, locate the cookies or site data section, select the blocking or rejection of cookies, and delete those already stored. For web beacons, you may use tracking-content blocking options or disable automatic image loading. If you need assistance, write to us at privacidad@beristainabogados.com. Disabling may affect certain technical functions of the website; refusal of secondary tracking will not prevent you from contacting us.

Upon your first contact with the website, you will be informed of these technologies by a visible notice, with access to this notice and to the means of disabling them; only those necessary for technical reasons may be exempted from disabling. The mechanism to accept or reject technologies for secondary purposes will be available before their activation, pursuant to Article 14 of the Regulations and the Thirty-First Guideline (Lineamiento Trigésimo primero).

Retention and Deletion of Personal Data

We will retain your data only for the time necessary to fulfill the authorized purposes and, where applicable, retention obligations or the limitation periods for legal or contractual liabilities. Once they are no longer necessary, they will be blocked, where applicable, and subsequently securely deleted, pursuant to Articles 10 and 12 of the LFPDPPP. Mandatory retention does not authorize their use for advertising or other different purposes.

Security Measures and Confidentiality

B+A establishes and maintains administrative, technical, and physical security measures commensurate with the risks of the processing, to protect your personal data against damage, loss, alteration, destruction, and unauthorized access, use, or processing. Persons involved in the processing must maintain confidentiality, even after their relationship with B+A ends, pursuant to Articles 18 and 20 of the LFPDPPP.

If a security breach significantly affects your property or moral rights, B+A will notify you immediately, including the nature of the incident, the data compromised, recommendations for protection, corrective actions taken, and a means to obtain additional information, pursuant to Article 19 of the LFPDPPP and Article 65 of the Regulations.

Changes to the Privacy Notice

Modifications or updates will be communicated by publishing the current version, with its update date, at https://www.beristain-abogados.com/aviso-de-privacidad/. You may consult it through the “Privacy Notice” (Aviso de Privacidad) link on the website and request a copy by email at privacidad@beristainabogados.com.

The notice will also be available in print at Avenida Tecamachalco 35, Colonia Reforma Social, Alcaldía Miguel Hidalgo, C.P. 11650, Mexico City, Mexico. When a change requires a new notice or new consent, we will make it available to you and obtain the corresponding consent before the new processing; publication of an update will not substitute for those requirements.

Competent Authority

If you believe your rights regarding personal data held by private parties have been infringed, you may go before the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the competent authority pursuant to Articles 2, Section XV, 38, and 39 of the LFPDPPP. If you are not satisfied with the response to your ARCO request, you may file for protection of rights within 15 business days following its communication; if you received no response, you may do so once the corresponding period has expired, pursuant to Article 40. You may also file a complaint for noncompliance with the applicable regulations. Institutional information and official channels of assistance may be consulted at https://www.gob.mx/buengobierno.

Last modified: October 6, 2026.