VSP Comprehensive Privacy Policy

This Comprehensive Privacy Notice (the “Notice“) is made available to you in compliance with the Federal Law on Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on March 20, 2025 (the “Law“), and the Regulations of the Federal Law on Protection of Personal Data Held by Private Parties (the “Regulations”) and other applicable provisions. We ask that you read it carefully before providing us with any Personal Data.

Capitalized terms used in this Privacy Notice that are not defined herein shall have the meaning attributed to them by the Law and/or the Regulations.

1. Identity and address of the Data Controller

VALLE SALINAS Y PACCHIANO, S.C. (indistinctly “VSP” or the “Data Controller“), residing at Juan Salvador Agraz 97, Office 5-B, Santa Fe, Cuajimalpa de Morelos, C.P. 05348, Mexico City, Mexico, and with website https://vspsc.com/ is responsible for the processing of the Personal Data collected from you, as well as its use, protection, safeguarding, and, where appropriate, transfer.

For all matters related to this Notice and the exercise of your rights, VSP has designated a personal data department, which you may contact via email at contact@vspsc.com or by telephone at 55 9688 6207.

2. To whom this Notice applies

This Notice applies to the processing of Personal Data of: clients and prospects; representatives, attorneys-in-fact, shareholders, partners, directors, and personnel of our clients; counterparties and their advisors; suppliers and service providers; candidates participating in our recruitment processes; visitors to our offices; users of our website; and individuals who subscribe to our publications or attend our events.

3. Personal Data we process

Ordinary Personal Data

VSP may collect from you the Personal Data listed below by categories: (a) Identification; (b) Contact; (c) Employment; (d) Financial and/or Asset data; as well as images and audio captured by our video surveillance cameras. Not all categories apply to all Data Subjects.

Sensitive Personal Data

VSP will not collect Sensitive Personal Data. However, depending on the environment in which the data is processed and the level of risk generated by its processing for the Data Subject, data regarding the health status of the Data Subject, as well as financial data, may be considered Sensitive Personal Data, which we will under no circumstances dispose of unilaterally without prior express written authorization of the Data Subject.

Third-Party Personal Data

If you provide us with Personal Data of third parties—for example, of your employees, attorneys-in-fact, family members, partners, or counterparties—you represent that you possess the authority to do so and agree to make this Notice available to such individuals and, when required by Law, to obtain and retain their consent, as well as to prove it to VSP upon request.

Job Applicants at VSP

If you participate in any of our recruitment processes, VSP will process the Personal Data contained in your resume and in the documentation you provide us, such as name, contact information, academic background, professional license, work history, references, and compensation expectations.

This data is used solely to evaluate your candidacy, contact you, conduct interviews, verify curriculum information and references provided, and, if applicable, formalize your hiring. If you are not selected, we will keep your information in our job bank for 12 (twelve) months to consider you for future openings, unless you request otherwise at contact@vspsc.com.

Processing of Personal Data

Primary Purposes of Processing

The following purposes are necessary and give rise to the legal relationship between you and VSP, therefore they do not require your consent: (i) Identification and contact; (ii) Evaluating the feasibility of taking on a matter, including the detection and resolution of conflicts of interest; (iii) Formalizing and administering the professional service agreement, including service proposals, engagement letters, and schedules; (iv) Registering you in our systems; (v) Creating your client or prospective client file; (vi) Providing the requested legal and consulting services; (vii) Issuing tax invoices, managing billing, collection of fees and expenses, and complying with our accounting and tax obligations; (viii) Complying with internal policies and legal obligations regarding anti-money laundering and terrorism financing prevention, including customer due diligence and filing notices with competent authorities when applicable; (ix) Attending to requests from judicial, administrative, or tax authorities and complying with any other legal obligation binding upon VSP; (x) Controlling access to our facilities and safeguarding the security of individuals, assets, and information under our custody; (xi) Managing our information systems, performing backups, ensuring operational continuity, and preventing and investigating security incidents; (xii) Carrying out billing processes and collection management; and (xiii) In general, complying with any other legal obligation before authorities of diverse nature.

4. Secondary Purposes of Processing

Additionally, your personal information may be used for the following secondary purposes: (i) Sending you newsletters, legal updates, and informational notes regarding legislative, jurisprudential, and regulatory developments; (ii) Inviting you to events, seminars, conferences, webinars, and academic activities organized or sponsored by VSP; (iii) Conducting satisfaction surveys and evaluating the quality of our services; (iv) Preparing internal statistics, studies, and reports, preferably using disaggregated or aggregated information; (v) Promoting VSP’s institutional activity, including the presentation of credentials, participation in directories and specialized publications, and submissions to rankings, always preserving information protected by professional secrecy; (vi) Promoting our products and services; and (vii) Carrying out prospecting activities and developing new professional relationships.

If you do not wish your Personal Data to be processed for one or more of the secondary purposes, you may express this at any time by sending an email to contact@vspsc.com, stating the purpose you object to. Your refusal shall not be a reason for us to deny you the services you have contracted, nor will it affect our ongoing relationship.

We inform Data Subjects that when Personal Data is no longer necessary for the fulfillment of the aforementioned purposes or for compliance with legal obligations, we will proceed to block and subsequently delete such data.

5. Transfers and Remissions of Personal Data

Remissions to Processors

The Data Subject hereby grants consent for VSP to transfer their Personal Data to third parties who collaborate or work with VSP to fulfill the purposes set forth in this Notice. Pursuant to the Law and its Regulations, remissions to data processors do not require the consent of the Data Subject; the processor may not process your Personal Data for purposes other than those instructed by VSP.

VSP will ensure, to the extent possible, that such third parties maintain adequate administrative, technical, and physical security measures to safeguard your Personal Data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, as well as ensure compliance with this Notice. VSP does not assign, sell, or transfer your Personal Data to unrelated third parties.

Transfers Not Requiring Your Consent

National or international transfers of Personal Data may be carried out without the consent of the Data Subject under the circumstances provided for in Article 36 of the Law.

Pursuant to the Law, VSP may transfer your Personal Data without requiring your consent in the events contemplated by the Law, including: (i) To judicial, administrative, tax, or jurisdictional authorities when the transfer is provided for in a law or treaty, or is necessary for the administration or procurement of justice; (ii) When necessary for the performance of the legal services contract entered into with you or in your interest, including transfers to correspondent lawyers, public notaries, commercial brokers, actuaries, experts, translators, intellectual property agents, and other professionals involved in the matter; (iii) When necessary for the recognition, exercise, or defense of a right in judicial or administrative proceedings; (iv) To insurance companies and external auditors, to the extent necessary for securing professional liability insurance and fulfilling audit and control obligations; and (v) In other cases expressly provided for in the Law.

International Transfers

When required by the assigned matter or VSP’s operations, your Personal Data may be transferred to recipients located outside the national territory, mainly correspondent law firms and technology service providers. In these cases, VSP will require the recipient to assume, through appropriate legal instruments, data protection obligations equivalent to those set forth in this Notice and the Law.

6. Security Measures

VSP has implemented reasonable administrative, technical, and physical security measures to protect your Personal Data against damage, loss, alteration, destruction, or unauthorized use, access, or processing. However, it is clear that no data transmission over the internet is completely secure; therefore, VSP cannot guarantee that the processing of your Personal Data will be free from all damage, loss, alteration, destruction, or unauthorized access, use, or processing.

In the event of a security breach that significantly affects the property or moral rights of Data Subjects, VSP will inform the affected Data Subjects and the authority without delay, pursuant to the Law, so that they may take appropriate measures.

Only personnel authorized by VSP who have complied with and observed the corresponding confidentiality requirements may participate in the processing of your Personal Data. Authorized personnel are prohibited from granting access to unauthorized individuals and from using your Personal Data for purposes other than those described. The duty of confidentiality of personnel involved in the processing of your Personal Data survives even after their relationship with VSP has ended.

7. ARCO Rights

You, or your duly accredited legal representative, have the right to:

a) Access. Know what Personal Data of yours is held in our databases and the conditions and general terms of its processing.

b) Rectification. Request the correction of your Personal Data when it is inaccurate, incomplete, or out of date.

c) Cancellation. Request the removal of your Personal Data from our records when you consider that it is not being processed in accordance with the principles and duties of the Law. Cancellation involves a prior blocking period.

d) Opposition. Object, for legitimate reasons, to the processing of your Personal Data, or request that processing be limited for specific purposes, including cases where processing produces legal effects or significantly affects you based on decisions made without human intervention.

To exercise these rights, a request must be submitted via email to contact@vspsc.com, providing: (i) Your full name and the address or contact method to communicate the response; (ii) A copy of your valid official identification and, if acting through a representative, proof of representation and their identification; (iii) A clear and precise description of the Personal Data regarding which you wish to exercise your ARCO Rights, as well as the specific right you seek to exercise; and (iv) In the case of Rectification, the requested corrections along with supporting documentation.

Please note that we may not be able to accommodate your request or cease processing immediately in all cases, as legal obligations may require us to continue processing your Personal Data. Furthermore, you should consider that for certain purposes, revoking your consent will imply that VSP cannot continue the legal relationship with you.

8. Cookies and Similar Technologies

Our website uses cookies, web beacons, and similar technologies that automatically collect information regarding your browsing activity. We use cookies strictly necessary for the operation and security of the website; preference cookies, which remember your language and display settings; and analytical cookies, which allow us to understand in an aggregate manner how the site is used and to improve it.

Cookies that are not strictly necessary are installed only with your consent, which you can grant, deny, or modify through the settings panel displayed during your first visit. Additionally, you may disable or delete cookies through your browser settings. Please note that disabling certain cookies may affect the availability or proper functioning of certain sections of the site.

9. Amendments to the Privacy Notice

VSP may amend this Notice at any time, among other reasons, due to changes in applicable legislation, the addition of new purposes or services, the implementation of additional security measures, or operational needs.

We commit to keeping you informed about any changes this Notice may undergo through our website at https://vspsc.com/.

Last update: August 10, 2026