“EUREKA & CO” is the trade name of the Data Controller issuing this Privacy Notice, so that the Data Subject —that is, the individual to whom the personal data belongs, hereinafter referred to as the ‘Data Subject’— is informed of how the Data Controller handles their personal data.
Personal Data we collect
The personal data collected by the Data Controller from Data Subjects includes identification data, tax data, financial data, employment data, and contact data.
Purposes of Personal Data processing
The Data Controller processes the Data Subject’s personal data to fulfill the following purposes:
(i) Original purposes:
All of the above purposes are essential for entering into the Legal Relationship.
The Data Controller does not process data for secondary purposes.
Sensitive Personal Data
The Data Controller does not process sensitive personal data.
Personal Data of Minors
The Data Controller does not collect Personal Data from minors, given the nature of the activities it carries out.
Transfer of Personal Data
We inform you that your personal data may be transferred to and processed by parties other than the Data Controller under the following circumstances:
Controlling companies, subsidiaries, or affiliates of the Data Controller, or a parent company; or to any company within the same corporate group as the Data Controller, operating under the same internal processes and policies, in order to fulfill the following purposes:
All of the above purposes are essential for entering into the Legal Relationship.
However, it is specified that the aforementioned parties may only use this information to fulfill the purposes stated for each. Likewise, given that all of the above purposes are intended to fulfill original purposes, it will not be necessary to obtain consent for the transfer, pursuant to Articles 35 and 36 of the Federal Law on the Protection of Personal Data Held by Private Parties.
Exercise of ARCO Rights
The Data Subject has the right, either personally or through a representative, to request, at any time, Access, Rectification, Cancellation, or Objection with respect to the personal data processed by the Data Controller.
To do so, the Data Subject must submit a written request by email, meeting the following requirements:
(i) The name of the Data Subject, address, and email for communicating the response to their request.
(ii) Documents proving identity — only voter ID card, passport, military service booklet, or Migration Card will be accepted, attached as an image to the email showing both sides clearly and legibly.
(iii) If submitted through a representative, the representative’s identification and a power of attorney letter signed by two witnesses authorizing them to act on behalf of the Data Subject must also be provided, attaching a clear and legible image of both the power of attorney letter and the identification.
(iv) The relationship that they had or currently have with the Data Controller.
(v) A clear and precise description of the personal data with respect to which they seek to exercise any of the rights of access, rectification, cancellation, or objection.
(vi) If applicable, the modifications to be made, providing documentation to support the request.
(vii) That the letter be addressed to the Data Controller and to the Data Controller’s Privacy Department.
The Request must be sent to the Personal Data Department’s email at [email protected], which will be received Monday through Friday, from 9:00 am to 6:00 pm.
The Data Controller will inform the Data Subject, within twenty business days from the date the access, rectification, cancellation, or objection request was received, of the determination made, using the same email address indicated. The moment the Data Controller receives the request is deemed to be when it enters our server, which will be confirmed with an Acknowledgment of Receipt.
Once the response has been sent within the stated period, the Data Controller will have 15 business days to carry out the Access, Rectification, Cancellation, or Objection to the personal data in accordance with the request. The response and, if applicable, the delivery of the information will be made by email. If the Data Subject so decides and it is applicable, the information will be sent to the means designated for that purpose by the Data Subject, provided that they request it and cover the justified or justifiable delivery costs, or the cost of reproduction in copies or other formats.
Limitation on the use or disclosure of Personal Data
The Data Subject may exercise, at any time and unilaterally, their right to limit the use or disclosure of their personal data. To do so, they may use the unsubscribe mechanism or link provided at the bottom of each email sent by the Data Controller.
Use of Cookies or any other technology for collecting information
The Data Controller does not use cookies or any other mechanism, whether through remote or local means of electronic, optical, or other technology, that allows for the automatic and simultaneous collection of personal data.
Modifications to the Privacy Notice
Both the Data Controller and the Data Subject acknowledge that this Privacy Notice is valid for an unlimited period. However, the Data Controller will strive to keep this Notice up to date. Publication of modifications to the Privacy Notice will apply generally to all Data Subjects. Amendments to the Privacy Notice may be communicated to the Data Subject through a notice on the Data Controller’s website, by email, by telephone, or in writing.
Consent
Prior to providing their personal data, the Data Subject expressly gave their consent to this Notice, which was made available to them on the website before the delivery of said information
Revocation of consent
The Data Subject may revoke, at any time, their consent to this Privacy Notice and to the processing of their Personal Data.
To revoke consent, the Data Subject must send a request in writing to the email address [email protected], meeting the following requirements:
(i) Documents proving identity — only voter ID card, passport, military service booklet, or Migration Card will be accepted, attached as an image to the email showing both sides clearly and legibly.
(ii) If submitted through a representative, the representative’s identification and a power of attorney letter signed by two witnesses authorizing them to act on behalf of the Data Subject must also be provided, attaching a clear and legible image of both the power of attorney letter and the identification
(iii) The relationship that they had or currently have with the Data Controller.
(iv) That the letter be addressed to the Data Controller and to the Data Controller’s Privacy Department.
The Data Controller will issue a response confirming the revocation of consent or, if applicable, stating the reasoning for the specific case, and the Data Controller will have 15 days to issue this response.
The deadlines will be counted from the moment the email enters our server, and the Data Controller will issue the corresponding Acknowledgment of Receipt of the Request. The response will be sent by email.
The Request will not be valid if any of the above requirements are omitted.
Internal Privacy Department
The Data Subject may exercise their rights and make the inquiries indicated in this document, as well as in the law, through the Data Controller’s Privacy Department, to which the requests indicated in this document and in the law must be directed. The Data Subject must use the aforementioned email address [email protected] or the telephone number (55) 52564225 to contact the Privacy Department.
Data Protection Authority
For any questions or additional information, as well as to exercise other types of rights and procedures beyond those set forth herein, the User may contact the Secretariat of Anticorruption and Good Governance through its website https://www.gob.mx/buengobierno
Identification of the Data Controller
EUREKANDCO, S.A. DE C.V., referred to in this document as the ‘Data Controller,’ with the trade name ‘EUREKA & CO’ and with its address located at Atlixco 87, Colonia Condesa, Cuauhtémoc, 06140, Mexico City, in Mexico City.
Last updated: February 2026.
