COMPREHENSIVE PRIVACY NOTICE FOR CLIENTS - SUPPLIERS

In accordance with the Federal Law on Protection of Personal Data Held by Private Parties, its Regulations, the Privacy Notice Guidelines, and other applicable legislation in Mexico (“the Law”), Tequila Orendain de Jalisco, S.A. de C.V., commercially known as (“Destilería Orendain”) with its address located at Calle Tabasco, Num. Ext. 208, Tequila Centro, Tequila, Jalisco, C.P. 46400, and internet portal www.destileriaorendain.com (“Portal”), is the entity responsible for the treatment of your personal data, its use, and protection, observing at all times the principles of legality, quality, consent, information, purpose, loyalty, proportionality, and responsibility as stipulated in the Law. Therefore, Destilería Orendain provides you with this Privacy Notice (“Notice”) so that you, as the Data Subject, understand the scope and conditions of the processing of your personal data, guaranteeing your right to informational self-determination.

DEFINITIONS

Privacy Notice: This document we provide to you, either physically, electronically, or in any other format.

Personal Data: Any information concerning an identified or identifiable natural person.

Sensitive Personal Data: Personal data that affects the most intimate sphere of its owner or whose misuse could result in discrimination or pose a serious risk.

ARCO Rights: The rights of Data Subjects, consisting of Access, Rectification, Cancellation, and Opposition to their personal data.

Days: Business days.

Processor: The individual or legal entity that, alone or jointly with others, processes personal data on behalf of Destilería Orendain.

Law: Federal Law on Protection of Personal Data Held by Private Parties.

Regulations: Regulations of the Federal Law on Protection of Personal Data Held by Private Parties.

Controller: The individual or legal entity that decides on the treatment of your personal data, which for the purposes of this Privacy Notice is Destilería Orendain.

Data Subject: The individual to whom the personal data pertains.

Processing: The obtaining, use, disclosure, or storage of personal data, by any means. Use includes any action of access, handling, exploitation, transfer, or disposition of personal data.

Pransfer: Any communication of data made to a person other than the Controller or Processor.

PERSONAL DATA COLLECTED

  1. Identification Data: Information that allows differentiating you from other individuals, which could include: name, Federal Taxpayer Registry (RFC); Unique Population Registry Code (CURP), date of birth, nationality, gender, physical image by photograph and/or video recording within Destilería Orendain’s facilities
  2. Contact Data: Information that allows us to stay in contact with you, which could include: address, home phone number, mobile number, email, social media usernames for contact purposes (e.g., via the inbox of your Facebook, Twitter, Instagram, Foursquare or Swarm, and Google+ accounts).
  3. Labor Data: Information concerning a natural person related to their employment, position, or commission, such as: position, work address, institutional email, institutional phone number.
  4. Property or Financial Data:Information concerning a natural person related to their assets, rights, obligations susceptible to economic valuation, such as: movable and immovable property; tax information; credit history; income and expenses; bank accounts; insurances; bonds, among others.
  5. Electronic Records: This information includes certain data about you or your device obtained when you access our Digital Properties and (ii); records of images and/or voice obtained through video surveillance systems, which are obtained when you visit our facilities.

SENSITIVE PERSONAL DATA COLLECTED

Video or photograph images, voice recordings, digital signature, tax information, fingerprint (as applicable), facial recognition (as applicable), property or financial data such as: name of debit and credit card holders, expiration dates of debit and credit cards, and debit and credit card numbers, as well as credit history.

HOW WE COLLECT YOUR PERSONAL DATA

Personal data will be obtained directly by any of our agents, dependents, commercial representatives, technological systems, and computer applications, either in person or through the internet. Destilería Orendain collects your personal data when you make any inquiry, request services in person or through technological means, exchange emails, calls, or video calls with our agents, dependents, commercial representatives, or authorized managers, exercise your ARCO Rights, we conduct audits of our suppliers and clients, visit our facilities, websites, and social networks of Destilería Orendain, when Data Subjects, with prior consent, provide their personal data as a personal reference, when we request a consultation regarding your history of goods, products and/or services, when generating a record of the pages and ads you access, or manage an advertising campaign, when you access websites or mobile applications (collectively, our “Digital Properties”); provided that these Digital Properties establish that this Privacy Notice is applicable.

IN THE CASE OF BIOMETRIC CONTROLS, YOUR PERSONAL DATA WILL BE PHYSICALLY REQUIRED IN OUR FACILITIES.

This Privacy Notice is also applicable to people who visit any of our offices in Mexico, either because they provide us with their data for any purpose or because they are obtained through our video surveillance systems. Anyone entering Destilería Orendain’s facilities may be videotaped and/or photographed by our security cameras. The images captured by the closed-circuit television system cameras are used for your security and that of visitors, to monitor the premises remotely, and confirm in real-time any risk condition to minimize it. Also, to safeguard material and human resources within our facilities. The images are intended to carry out access control to our corporate facilities. Video recordings and/or photographs are stored for a period of 30 calendar days.

PURPOSES OF PERSONAL DATA PROCESSING

Primary Purposes:

  1. Comply with legal, contractual, and/or extracontractual obligations arising from the legal and/or commercial relationship between you and Destilería Orendain;
  2. Enable Destilería Orendain to provide appropriate attention in terms of selling its products, as well as correctly providing its services and/or third-party services (when it comes to resales or distribution);
  3. Enable Destilería Orendain to contact you and inform you of any changes to the terms and conditions applicable to the sale of its products and/or provision of services, or inform you about product lists, new products, prices, payment methods, invoicing, new services and their characteristics;
  4. Perform billing, payment, collection, and credit granting processes;
  5. Provide customer service and, if applicable, grant bonds and/or guarantees;
  6. Validate the accuracy of your data;
  7. Verify your identity through the search engine generated and/or contracted by Destilería Orendain;
  8. Manage value-added services and content;
  9. Administer applications and websites;
  10. Send quotations and commercial proposals;
  11. Establish a contact list;
  12. Provide the products and/or services you request;
  13. Allow access to certain sites developed exclusively for visitors, clients, and suppliers;
  14. Keep our records updated to respond to your inquiries and perform statistical and market analysis;
  15. Maintain the security of our facilities and infrastructure through our prevention, detection, and video surveillance systems, either to verify compliance with internal policies or to ensure the normality and security of Destilería Orendain and the people within its facilities;
  16. Provide competent authorities with your personal data, including audio, video, and/or biometrics as required through a duly founded and motivated request.

Secondary Purposes: Additionally, Destilería Orendain will process personal data for other purposes:

  1. Send notifications of offers, notices, and/or promotional messages;
  2. Communications for marketing, advertising, or telemarketing purposes about new or existing products and services, whether own or of business partners;
  3. Commercial prospecting;
  4. Congratulations and recognition programs;
  5. Risk analysis for offering products and lines of credit, whether own or of business partners;
  6. Profiling for offering own or business partners’ products and services;
  7. Conduct surveys, statistics, market studies to provide products, services, content, and advertising according to your needs;
  8. Register consumption habits through automatic data capture tools, interests, and behavior;
  9. Conduct benefit and incentive programs;
  10. Participate in social networks, chats, and/or discussion forums;
  11. Participate in events, trivia, contests, raffles, games, and sweepstakes;
  12. Evaluate service quality;
  13. Anonymize for Big Data projects and generally for any activity aimed at promoting, maintaining, improving, and evaluating products and services.

If you do not wish for the provided personal data to be used for secondary purposes, you must express your refusal through the exercise of the ARCO Rights described here. The exercise of your ARCO Rights regarding these purposes will not be a reason for Destilería Orendain to deny you the requested services.

You have 5 business days to express your refusal after initiating the commercial relationship. Regardless of these days, at any time during the processing, you can express your refusal through ARCO Rights.

Your personal data, including sensitive, property, financial, and biometric data, will be stored in Mexico, strictly adhering to the purposes established herein.

REMISSION OF PERSONAL DATA TO OUR PROVIDERS

Destilería Orendain may remit your personal data, wholly or partially, to service providers that support us in some process, such as: (i) companies providing hosting, advertising, client profile review, fraud prevention, creation or administration of databases or platforms for file management; (ii) entities supporting accounting, tax, or extrajudicial collection matters; (iii) transport and logistics companies, shipment and delivery of physical mail or email and other messaging services; (iv) advisors in matters of accounting, legal, tax, labor, compliance, telecommunications, and/or social networks, and other external providers who have a contractual relationship with Destilería Orendain.

These providers will act on behalf of Destilería Orendain and comply with the applicable regulations for the protection of personal data. We have signed agreements with them that include obligations to protect your personal data in accordance with our policies and applicable laws.

TRANSFER OF PERSONAL DATA

Your personal data will be transmitted, including sensitive, property, financial, and biometric data to: (i) competent authorities when necessary for compliance with obligations under applicable regulations; (ii) competent authorities for investigations or dispute resolutions; (iii) financial entities for payments and/or credits; (iv) in case of a merger, acquisition, or restructuring of the corporate group to which Destilería Orendain belongs, including entities located abroad; and (v) third parties resulting from a contract or legal obligation.

For the purposes of commercial relationships, we may transfer your data to our commercial partners and/or service providers. If the law requires obtaining your express consent for such transfers, it will be requested separately.

EXERCISE OF ARCO RIGHTS

As a Data Subject, you have the right to Access, Rectify, Cancel, and Oppose (ARCO Rights) the processing of your personal data by Destilería Orendain. To exercise your ARCO Rights, you must submit a request via email to datospersonales@destileriaorendain.com with the following information:

  1. Your full name and email or other means to communicate the response to your request.
  2. Official documents proving your identity or, if applicable, the legal representation of the person submitting the request on your behalf.
  3. A clear and precise description of the personal data regarding which you seek to exercise your ARCO Rights.
  4. Any other element or document facilitating the location of your personal data.

CHANGES TO THE PRIVACY NOTICE

Destilería Orendain reserves the right to modify or update this Privacy Notice as necessary to reflect changes in our data practices or relevant laws. Any changes will be communicated through our website www.destileriaorendain.com or by other means we deem appropriate.

By using our services and providing your personal data, you agree to the terms of this Privacy Notice.

For more information on the processing of your personal data, please contact us at:

Destilería Orendain

Calle Tabasco, Num. Ext. 208, Tequila Centro, Tequila, Jalisco,C.P. 46400

Email: datospersonales@orendain.com.mx

Website: www.destileriaorendain.com

Date of Last Update: June 10th, 2024