Privacy

I. IDENTITY AND ADDRESS OF THE RESPONSIBLE PARTY

In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter, the “Law”), CLEAN POINT MEXICO, S.A. DE C.V., hereinafter “THE COMPANY”, with address at AV. EUGENIO GARZA SADA NO. 7821 COL. VALLE ALTO, MONTERREY NUEVO LEON, and with current registration in the Public Registry of Contractors of Specialized Services or Specialized Works (REPSE), is responsible for the processing of the personal data it collects from:

• Candidates
• Employees
• Clients (Contracting Companies)
• Legal Representatives and Authorized Contacts

Correo de contacto para datos personales: *[[correo@empresa.com](mailto:correo@empresa.com)]**

II. PERSONAL DATA COLLECTED

A. CANDIDATES

Identification data:

• Full Name
• CURP
• RFC
• Social Security Number
• Official identification
• Date and place of birth

Contact information:

• Home address
• Phone
• Email

Academic and professional information:

• Academic record
• Work experience
• Work references

Financial data:

• Banking information (if applicable)

Sensitive data (where applicable):

• Medical information to determine fitness for work
• Criminal background check (when required by the position)

The processing of sensitive data will require explicit consent.

B. EMPLOYEES

In addition to the above data:

• Employment contract
• Beneficiary information
• Data for integration of employment file
• Medical disabilities
• Information for compliance with obligations to IMSS, INFONAVIT an tax authorities

C. CLIENTS (Contracting Companies)

Identification and representation data:

• Name of legal representative
• Official identification
• Position

Contact information:

• Telephones
• Corporate email

Tax information:

• RFC
• Tax domicile
• Tax status certificate

Financial data:

• Banking information for payments and billing

III. PURPOSES OF THE PROCESSING

Personal data will be processed under the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality and accountability.

A. Purposes for Candidates:

• Recruitment, selection and evaluation
• Integration into the job bank
• Reference check

B. Purposes for Employees:

• Labor relations management
• Contract preparation
• Payroll and benefits payment
• Compliance with tax and social security obligations
• Compliance with obligations arising from the REPSE
• Handling labor or customer audits

C. Purposes for Clients

• Formalization and execution of contracts
• Billing and collection
• Operational coordination of assigned personnel
• Compliance with legal and tax obligations

Secondary Purposes:

• Sending corporate information
• Satisfaction surveys
• Service promotion

The data subject may express their refusal for secondary purposes by submitting a request to **[[correo@empresa.com](mailto:correo@empresa.com)]**.

IV. DATA TRANSFERS

THE COMPANY may transfer personal data without requiring additional consent when:

• Whether necessary to comply with legal obligations to tax, labor, or judicial authorities.
• It's required for compliance with obligations to IMSS, INFONAVIT, SAT or labor authorities.
• It's necessary to demonstrate compliance to clients in accordance with the specialized subcontracting legislation (REPSE).
• It's transferred to technology providers, accounting firms, auditors or legal advisors under confidentiality agreements.

Adequate data protection will be guaranteed at all times.

V. SECURITY MEASURES

THE COMPANY implements administrative, technical, and physical security measures that include:

• Physical files under controlled custody
• Digital systems with restricted access
• Passwords and login profiles
• Confidentiality agreements
• Internal data protection policies
• Internal audit protocols

VI. ARCO RIGHTS

The data subject may exercise the rights of Access, Rectification, Cancellation or Opposition by sending a request to :

[[correo@empresa.com](mailto:correo@empresa.com)]

The application must contain:

1. Full name of the holder
2. Document proving identity
3. Clear description of the right to exercise
4. Means to communicate response

The response will be provided within the applicable legal timeframes.

VII. REVOCATION OF CONSENT

The data subject may revoke the consent given for the processing of their personal data, except in cases where there is a legal or contractual obligation that prevents such revocation.

VIII. DATA RETENTION

Personal data will be kept for as long as necessary to fulfill:

• Employment obligations
• Tax obligations
• REPSE Registry Requirements
• Legal deadlines for document retention

IX. CHANGES TO THE PRIVACY NOTICE

THE COMPANY reserves the right to modify this Notice to comply with legislative, regulatory or internal updates.

Las notificaciones estarán disponibles en:

**[[www.empresa.com](http://www.empresa.com)]**

**Las update: 16 febrero de 2026.