COMPREHENSIVE PRIVACY NOTICE FOR EMPLOYEES

In accordance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, the Privacy Notice Guidelines, and other applicable legislation in Mexico (“the Law”), Tequila Orendain de Jalisco, S.A. de C.V., commercially known as (“Destilería Orendain”) with an address at Calle Tabasco, Num. Ext. 208, Tequila Centro, Tequila, Jalisco, C.P. 46400, and website www.destileriaorendain.com (“Portal”), is the entity responsible for the processing of your personal data, its use, and protection, always observing the principles of legality, quality, consent, information, purpose, loyalty, proportionality, and responsibility provided for in the Law. Therefore, Destilería Orendain provides you with this Privacy Notice (“Notice”) so that you, as the Data Subject, are aware of the scope and conditions of the processing of your personal data, ensuring your right to informational self-determination.

DEFINITIONS

Privacy Notice: This document we make available to you, either physically, electronically, or in any other format.

Personal Data: Any information concerning an identified or identifiable individual.

Sensitive Personal Data: Personal data that affects the most intimate sphere of its Subject, or whose misuse could lead to discrimination or pose a serious risk to the Subject.

ARCO Rights: The rights of Data Subjects consisting of Access, Rectification, Cancellation, and Opposition of their Personal Data.

Business Days: Working days.

Processor: The individual or legal entity that alone or jointly with others processes Personal Data on behalf of Destilería Orendain.

Law: Federal Law on the Protection of Personal Data Held by Private Parties.

Regulation: The Regulation of the Federal Law on the Protection of Personal Data Held by Private Parties.

Controller: Private individual or entity that decides on the processing of your Personal Data, which for the purposes of this Privacy Notice

Data Subject: The individual to whom the Personal Data pertains.

Processing: The collection, use, disclosure, or storage of Personal Data, by any means. Use encompasses any action of access, handling, utilization, transfer, or disposition of Personal Data.

Transfer: Any communication of data made to a person other than the Controller or Processor.

PERSONAL DATA COLLECTED

Identification data, contact data, family data, employment data, physical characteristics data, academic data, lifestyle habits and interests data, migration data of you and your family (in case of foreigners or working abroad), biometric data, technical data about the device(s) you use to access our platforms and/or technological tools, financial and/or patrimonial data, and data related to your family members. By providing personal data related to your family members, you acknowledge having their consent for Destilería Orendain to process their data to contact them and designate them as beneficiaries in the management of insurance.

SENSITIVE PERSONAL DATA COLLECTED

We inform you that, if necessary due to the nature of the job position, and to fulfill the purposes described in this Privacy Notice, sensitive personal data related to your present or future health status will be processed. We inform you that the processing of such data is necessary to fulfill the obligations derived from the legal relationship between you and Destilería Orendain, for which reason your consent is excepted.

We also inform you that video or photographic images, voice recordings, digital signatures, tax information, fingerprints (as applicable), facial recognition (as applicable), bank account data for payroll deposits, patrimonial or financial data such as debit cardholder name and/or checking account holder, banking institution, as well as credit history will be collected.

HOW WE COLLECT YOUR PERSONAL DATA

Personal Data will be obtained directly by any of our factors, employees, legal representatives, recruiters, technological systems, and software applications, either in person or via the internet. Destilería Orendain collects your Personal Data when you make any inquiry or request in person or through technological means, exchange emails, calls, or video calls with our factors, employees, legal representatives, recruiters, or authorized processors, exercise your ARCO Rights, participate in labor audits, visit our facilities, websites, and social networks of Destilería Orendain, when Data Subjects provide your Personal Data as a personal reference, request a consultation regarding your employment, academic and educational background, or access our “Digital Properties,” provided such Digital Properties establish that this Privacy Notice is applicable.

Regarding biometric controls, your Personal Data will be physically requested at our facilities.

This Privacy Notice also applies when you visit our offices in Mexico, either because you provide us with your data for any purpose or because they are obtained through our video surveillance systems. Any person entering Destilería Orendain facilities may be videotaped and/or photographed by our security cameras. The images captured by the closed-circuit television system cameras will be used for your safety and the safety of our visitors, to remotely monitor the properties and confirm any risk conditions in real-time to minimize them, as well as to safeguard material and human resources within our facilities. Images are intended to control access to our corporate facilities. The video recordings and/or photographs are stored for a period of 30 calendar days.

PURPOSES OF PERSONAL DATA PROCESSING

Primary Purposes:

  1. Complete your job application;
  2. Prepare or update your employment record;
  3. Create an employee profile to manage your stay at Destilería Orendain;
  4. Assign you an institutional email account;
  5. Prepare and present you with an economic proposal;
  6. Conduct medical diagnostics;
  7. Manage physical access to Destilería Orendain facilities;
  8. Manage electronic access to Destilería Orendain’s technological systems and infrastructure;
  9. Administer payroll services, including but not limited to salary adjustments, overtime payments, and other benefits;
  10. Identify and authenticate activities on our platforms and technological tools, and grant access to them;
  11. Enroll you and/or your family in life, major medical expenses, and other necessary insurance, as well as voluntary insurance you request according to agreements between Destilería Orendain and various insurers;
  12. Design your development and training plans;
  13. Accident prevention, nutrition, psychological help, and medical examination programs;
  14. Provide medical attention in case of emergency and/or if you voluntarily request it at our clinics, thus processing necessary personal data to create a physical and/or electronic clinical record, according to applicable health regulations;
  15. Manage your savings box, savings fund (including beneficiary designation), and meal voucher cards or other benefits that can be transferred to a beneficiary;
  16. Provide training;
  17. Administer personal and professional development and performance tools;
  18. Create and implement analytical and statistical processes;
  19. Comply with the provisions of the employment contract signed with Destilería Orendain and all those applicable according to the Federal Labor Law, IMSS, and INFONAVIT, among others;
  20. Evaluate, design, and grant payroll loans, other monetary and in-kind benefits, educational support, scholarships, and recreational, cultural, and sports activities;
  21. Handle immigration procedures and/or renew relevant immigration permits (in the case of foreigners);
  22. For comprehensive wellness programs and compliance with current labor regulations;
  23. At the end of the employment relationship, carry out all necessary disassociation procedures;
  24. If you request it, issue employment certificates even after the legal relationship with you has ended. To meet this purpose, Destilería Orendain may retain and process necessary personal data to issue written certificates as stipulated by the Federal Labor Law;
  25. Investigate, manage, address, and follow up on complaints received through our reporting system about conduct contrary to our code of ethics;
  26. Perform all necessary activities for the administration and management of your job position and other labor benefits;
  27. Comply with legal and contractual obligations when you decide to participate in national or international magazines, books, or publications, including the necessary dissemination and disclosure activities;
  28. Comply with obligations under applicable regulations. Destilería Orendain will also process the personal data of third parties you have indicated to contact them in case of emergency. You cannot object to Destilería Orendain ceasing the processing of your data for the primary and necessary purposes mentioned above, as processing is required to fulfill obligations arising from the employment relationship between you and Destilería Orendain.

Secondary Purposes: Additionally, Destilería Orendain will process personal data for other purposes:

  1. Improve and foster the work environment (such as the dissemination of congratulations and other celebrations and special days).
  2. Your personal image (photo, video, etc.) may be used for creating informational, promotional, or identification material within our facilities.
  3. Use your data to send correspondence related to Destilería Orendain publications, such as newsletters and magazines.
  4. Conduct surveys and evaluations to improve the quality of our products and services.
  5. Send financial campaigns, advertisements, and marketing communications for our products and services and/or those of third parties through various physical and electronic communication channels.
  6. Provide work references and information about your work performance to authorized third parties, even once the legal relationship between you and Destilería Orendain has ended, as permitted by applicable laws. This consent will be valid even after the legal relationship with Destilería Orendain has ended until you explicitly express your objection to this processing.
  7. Retain necessary and relevant data to provide work references and information about your work performance to third parties authorized by you and/or acting in your interest, even after the legal relationship with Destilería Orendain has ended, as permitted by applicable laws. Destilería Orendain may provide work references to third parties even after the legal relationship has ended until you explicitly notify Destilería Orendain of the revocation of your consent for such processing. If you do not wish for the provided Personal Data to be used for secondary purposes, you must express your refusal through the exercise of the ARCO Rights described here. The exercise of your ARCO Rights regarding these purposes cannot be a reason for Destilería Orendain to terminate your employment relationship.

For the purposes set out in this section, the data subject has five working days to express their refusal after starting the employment relationship. Regardless of these days, at any time during the processing, the data subject can express their refusal through ARCO Rights.

Your Personal Data, including Sensitive Personal Data, Financial Data, and Biometric Data, will be stored in Mexico in strict accordance with the purposes set forth herein.

REMISSION OF PERSONAL DATA TO OUR SUPPLIERS.

Destilería Orendain may remit all or part of your personal data to service providers that support us in some process, such as:

  1. companies providing hosting services, advertising, employee profile review, database creation or management, or digital platforms for file management;
  2. other entities supporting us in accounting, tax, or extrajudicial collection matters;
  3. insurance agents; and
  4. private security companies hired to maintain security and surveillance of facilities and personnel. These remissions may be national or international. In any case, these third parties process the information under our instructions and have assumed contractual obligations with Destilería Orendain to protect your personal data.

TRANSFER OF PERSONAL DATA TO THIRD PARTIES

Destilería Orendain may transfer your personal data to third parties for the purposes established in this Notice. These transfers are made as necessary to maintain or fulfill the legal relationship between Destilería Orendain and you. Destilería Orendain informs you that your Personal Data may be shared in Mexico with the following persons, companies, organizations, or authorities: a. Transfers of personal data to third parties. Your personal data may be communicated or transferred to a third party other than those mentioned above in certain cases; we will only transfer your data when we have your consent or when it is not necessary for the transfer under Article 37 of the Law. You specifically accept and give your consent for your data to be transferred to third parties in the following cases:

  1. Entities that are related parties of Destilería Orendain, for the use of facilities and other infrastructure that you may have access to, as well as to contact you in case an employment opportunity arises that matches your profile;
  2. Insurance companies, for insurance management and/or reimbursements;
  3. Competent authorities, in cases legally provided;
  4. Labor authorities and/or other competent authorities, to comply with legal provisions;
  5. Institutional savings bank, for the administration of the savings bank;
  6. Certification service providers with whom we have agreements, in cases where you are a legal representative, to register you as a user of the digital document signing platform with advanced electronic signature;
  7. Companies providing vouchers for meal benefits, for the delivery of meal vouchers;
  8. Airlines, for your transportation to perform your duties and work tasks, including the transportation of your family to the place where you will be working temporarily or permanently;
  9. Accommodation companies for you and your family, for the management of accommodation at the place where you will be working;
  10. Banking institutions, to make the corresponding payroll payments and other benefits that you are entitled to;
  11. Public bodies of the federal and Mexican government, to carry out the necessary steps for certifications that fit your personal and professional profile;
  12. Other third-party companies, to follow up on reports related to the complaints system regarding behaviors that may be contrary to our code of ethics;
  13. Third-party providers of technological and software services with whom we have service contracts, to manage your access privileges, administration, and use of technological tools and software for the fulfillment of your work and/or professional functions;
  14. National and foreign educational companies and institutions that have collaboration and/or service agreements with Destilería Orendain, to allow you access to online educational platforms and the delivery of distance courses;
  15. Other third-party companies, to contact you and send you communications and surveys, through emails and other physical and/or electronic means of communication, containing information for statistical purposes, to allow and facilitate participation in rankings to improve and promote the work environment; as well as to carry out the promotion and offering of products and services offered by us and by third parties;
  16. Business partners in the insurance industry with whom we have binding legal agreements, so that these third parties can contact you, identify your insurance needs, and offer you products and/or services that match your profile;
  17. Add medical expenses insurance companies to register you and share information related to your current health status and past medical history of yourself and direct family members;
  18. Third-party companies authorized by you, to provide labor references and information about your work performance.

You can express, at any time, your refusal for Destilería Orendain to transfer your Personal Data to third parties by exercising the ARCO Rights indicated here, through the means established for this purpose in this Privacy Notice. Your refusal to transfer your Personal Data could result in the termination of the relationship when such transfer is strictly necessary to maintain the employment relationship.

PROTECTION OF PERSONAL DATA

Destilería Orendain will adopt all security measures, whether administrative, technical, technological, and/or physical, to protect your Personal Data to prevent any damage or corruption of the information, loss, alteration, theft, or misuse, as well as unauthorized access, disclosure, modification, or destruction.

DISCLOSURE OF PERSONAL DATA PERMITTED BY LAW

You acknowledge that Destilería Orendain may have to disclose your Personal Data under some provision of the law, judicial, administrative procedures, legal actions, and/or a request made by a competent governmental authority through a founded and motivated order.

OPTIONS AND MEANS TO LIMIT THE USE OR DISCLOSURE OF PERSONAL DATA

As the Owner of Personal Data, you may limit at any time the use or disclosure of the Personal Data provided through the exercise of the ARCO Rights indicated here.

Additionally, you are informed that there are other mechanisms to limit the use or disclosure of Personal Data provided to Destilería Orendain, such as the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI), the Public Registry to Avoid Advertising (REPEP), and the Federal Consumer Protection Agency (PROFECO), from which you can obtain more information on the websites of these agencies.

ARCO RIGHTS

In terms of the “Law”, you have the rights of Access, Rectification, Cancellation, and Opposition to the Processing (the “ARCO Rights”) of your Personal Data provided to Destilería Orendain, so you can oppose or revoke your consent for the processing or transfer of the same, at any time, as long as there is no legal impediment. You can exercise any of the ARCO Rights by submitting a free, duly signed written request, which can be sent to the following email address: [email protected], or present it at the address indicated in this Privacy Notice during office hours from 9:00 a.m. to 5:00 p.m.

Based on Article 32 of the Law, Destilería Orendain will inform the owner, within a maximum period of 20 (twenty) days from the date the request for Access, Rectification, Cancellation, or Opposition was received, the determination made, so that, if applicable, it becomes effective within 15 (fifteen) days following the date the response is communicated.

INFORMATION AND/OR DOCUMENTS NECESSARY FOR THE EXERCISE OF ARCO RIGHTS

  • Written request specifying the ARCO Right you wish to exercise (Access, Rectification, Cancellation, or Opposition), also indicating the name of the Owner of the respective Personal Data.
  • Copy of the documents accrediting the Owner of the Personal Data or their Representative:
      The Owner of the Personal Data will prove their identity by attaching a scanned copy of a valid official identification document (IFE, INE, or passport).
      The representative or legal agent of the Owner of Personal Data must prove their identity by attaching a public document or power of attorney signed before two witnesses or a declaration in the personal appearance of the Owner of Personal Data.
  • Contact details (full name and email address) of the Owner of the Personal Data and the means by which Destilería Orendain can contact them to receive notifications and/or any response related to their request.
  • Clear and precise description of the Personal Data with respect to which any of the ARCO Rights mentioned above are exercised.
  • Any complementary information, element, or document that facilitates the location of the Personal Data provided.

The aforementioned email is solely and exclusively for the request and attention of ARCO Rights. Any other type of request will not be answered and is at the discretion of the applicant to direct it to the corresponding area.

SPECIFIC PROCEDURES FOR THE EXERCISE OF ARCO RIGHTS

In terms of what is established by Article 35 of the Law and Article 93 of the Regulation, Destilería Orendain informs you that the exercise of ARCO Rights is simple and free, with the Owner of the provided Personal Data only needing to cover the costs of shipping, reproduction, and, if applicable, certification of documents, except for the exception provided in the Law. Reproduction costs may not be greater than the recovery costs of the corresponding material and the corresponding shipping expense.

OWNER'S CONSENT

The Owner states

  • Implicit consent. Destilería Orendain adheres to the general rule of “Implicit Consent”, so this Notice will be understood to be consented to by making it available and providing the Owner’s data.
  • Explicit consent. Only in cases where the personal data collected include patrimonial or financial data, or in the case of biometric and identification data that involve a validation process before Destilería Orendain, Destilería Orendain, through the signing of the corresponding contract, whether in printed format or using electronic means and their corresponding processes, will obtain the “Explicit Consent” of the Owner.

REVOCATION OF CONSENT

You can submit to Destilería Orendain the revocation of your consent for the processing of your Personal Data provided by sending a written request to the following email address: [email protected] through which you will receive more information.

In accordance with Article 32 of the Law, Destilería Orendain will communicate the determination adopted regarding the revocation request, within a maximum period of 20 (twenty) days from the date the corresponding request was received. If the revocation of consent is deemed appropriate, it will become effective within 15 (fifteen) days following the date the corresponding determination is communicated.

In terms of what is established by Article 35 of the Law and Article 21 of its regulations, Destilería Orendain informs you that the revocation of your consent is simple and free.

CHANGES TO THE PRIVACY NOTICE

This Privacy Notice may be modified, changed, altered, or updated due to new legal requirements; changes in the structure, operation, and marketing of the products and services provided by Destilería Orendain; changes, updates, and implementation of better privacy practices; changes in the business model of Destilería Orendain, or for other reasons. Destilería Orendain reserves the right to modify, change, alter, and/or update this Privacy Notice at any time, in which case it will be made known to you through the website https://www.destileriaorendain.com/privacidad. Any changes made to our privacy notice will take effect the day after the new version is published on our website.

If you do not agree with the modifications, please contact us at [email protected]. The continuous use you make of the Digital Properties, following a change to the Privacy Notice, represents consent to the new terms and conditions of the Privacy Notice, to the maximum extent permitted by law. Destilería Orendain invites you to periodically review our Privacy Notice to stay informed about how your personal data is used and about the rights you have.

As a result of the above, you give your consent for the Processing of your Personal Data when Destilería Orendain collects your Personal Data, to fulfill the purposes established in this Privacy Notice and/or at the time of expressing your will through the physical, electronic, or biometric means that correspond, in light of the above, you acknowledge that this Privacy Notice has been made known to you and you give your explicit consent for the processing of your Personal Data, including Sensitive Personal Data, Patrimonial Data, Financial Data, and Biometric Data.

CONTACT THE PERSONAL DATA DEPARTMENT ("PDD") OF DESTILERÍA ORENDAIN

If you have any questions, comments, or complaints regarding this Privacy Notice, please send an email to the following address: [email protected], or write to the following address: Tequila Orendain de Jalisco, S.A. de C.V., “Destilería Orendain”. Attention: Personal Data Department Address: Branch Av. Ignacio L. Vallarta 6230, Colonia Jocotán, Zapopan, Jalisco, C.P. 45010. Telephone attention: 01 33 37771818 / 01 33 3627 1373.