Privacy Notice Payless Mexico

By entering and using the website www.PAYLESS.com.mx you declare that you are understanding and accepting the terms and conditions contained in this Privacy Notice and expressly grant your acceptance and consent using electronic means for this purpose, in terms of the provisions of Article 1803 of the Federal Civil Code.

If the HOLDER does not fully and completely accept the terms and conditions of this notice, he/she must refrain from providing any personal data to PAYLESS MEXICO by any means, including its website, so if the HOLDER does not express his/her opposition for his/her personal data to be processed, it will be understood that he/she has given his/her consent to do so.

The OWNER hereby grants his/her express consent in terms of article 8 of the LFPDPPP, for PAYLESS MEXICO to process his/her personal data, including financial and/or patrimonial data contained in this Privacy Notice, in order to comply with the purposes set forth herein. It should be noted that financial data, in accordance with the exceptions set forth in articles 10 and 37 of the LFPDPPP, are not considered as requiring consent to be used.

In the event that the OWNER accepts the present terms and/or provides PAYLESS MEXICO with his/her personal data, such action shall be deemed as his/her absolute and express acceptance of the Privacy Notice published by PAYLESS MEXICO on the website www.PAYLESS.com.mx, at the time the OWNER provides his/her personal data and/or at the time he/she has access to or is provided with this Privacy Notice.

For the purposes of this Privacy Notice, PAYLESS MEXICO indicates Auto Gran GG, S.A. de C.V. with address at Entronque Aeropuerto sin número, Colonia Las Veredas, Los Cabos C.P. 23435 as the party responsible for the collection, disclosure, storage, use, handling, exploitation, transfer or disposal of personal data (hereinafter the "Processing").

1. You are informed that PAYLESS MEXICO may obtain your personal data in the following ways:

2. Personally: When the HOLDER goes to any of the branches or customer service modules of PAYLESS MEXICO, on the occasion of the request or procedure to acquire our services, consisting of car leasing and services inherent to them.
   Directly: When the HOLDER provides PAYLESS MEXICO with his/her personal data to request or contract our services, either through our website, via telephone, applications for mobile devices or any other technological means.
   Indirectly: From any other documentary source or commercially available information or that is permitted by Law, and when provided by another holder by way of reference for the provision of the services provided by PAYLESS MEXICO, it will be considered complete and correct until the HOLDER does not state otherwise or submit a request to update the data.

3. For the purposes of the provisions of this Privacy Notice, PAYLESS MEXICO may collect and process, by itself or through its representatives, the following personal data:

1. Full name, image or photograph, local and cell phones, address (zip code, state, country, city or municipality, neighborhood, town, street, exterior and interior number), R.F.C., e-mail, official identification with photograph, name of the contact person, CURP, bank account data, credit card data, name of the legal representative of the company, company for which he/she works, electronic invoice; data and/or documents necessary for the follow-up of the contractual/commercial matters that link the Holder with PAYLESS MEXICO. Copy documentation: Official identification with photograph, articles of incorporation of the company, power of attorney of the representative registered in the Public Registry of Property and Commerce, RFC card and proof of address.
2. In case of visitors to the physical address of PAYLESS MEXICO: Full name, time of entry and exit, date, signature, official identification with photograph, image of the visitor captured through video surveillance services.
3. In case of sensitive data: health status, physical characteristics and conditions, personal characteristics, ideological data, union or political affiliation, data of origin, data of minors; biometric dataii consisting of fingerprint, voice recognition, facial identification features, iris and those established by the authorities to determine and record identity, for which the consent of the OWNER shall be obtained expressly and in writing.

The processing of personal data of the OWNER, including sensitive personal data collected, and unless the OWNER provides otherwise through the means described in this Privacy Notice, is intended to be used for the following purposes:

1. Main:
   To provide the HOLDER with the services consisting of the leasing of automobiles and services inherent to the same, so that the HOLDER may benefit from the required services.
   To contact the OWNER by telephone, or by any other technological means, in order to attend and follow up on the requests for services offered.
   Verify and confirm his/her identity as well as the authenticity of the information he/she provides us with.
   Integrate files and databases necessary for the granting and operation of the services that are contracted, as well as the obligations arising therefrom.
   Contact the HOLDER by any means, in order to make clarifications and follow-up on payments or any other situation arising from the services provided, such as complaints or comments on them.
   Make contact with the HOLDER to carry out the management and collection of debts; in its case, contact the persons that the HOLDER has authorized as payment contacts.
   Carry out transactions with credit institutions, resulting from the commercial operations object of the service provided.
   To generate a record in the database of "clients" and/or prospective clients of PAYLESS MEXICO that will be kept for the duration of the commercial relations with the HOLDER, and up to 10 years after the end of such relations.

2. Secondary:

• Valuate the quality of the services offered by PAYLESS MEXICO,

• as well as the quality of attention to your comments or requests.

• Conduct internal studies on consumer habits.

• Marketing, advertising, commercial prospecting and offering new products.

• Provide information and promotions, such as newsletters and launching of new services.

• To inform about changes or new services that are related to the service requested by the OWNER.

• To generate reports related to the use of PAYLESS MEXICO's website.

PAYLESS MEXICO undertakes to make its best effort to protect the security of the personal data that the OWNER is providing, through the execution of legal acts, the use of technologies and antivirus systems, which control the access, use or unauthorized disclosure of personal information; for such purpose, personal information is stored in databases with limited access that are located in controlled facilities with security mechanisms; PAYLESS MEXICO undertakes that the information provided by the OWNER, is considered confidential, and used under full privacy.

Additionally, we inform you that in order to avoid receiving advertising in general, you may register in the Public Registry to Avoid Advertising. For more information, please visit the website of the Federal Consumer Protection Agency (PROFECO).

PAYLESS MEXICO uses "cookies" in connection with certain features or functions that may be placed on your computer and may serve to facilitate the use of a website by saving passwords and preferences while the OWNER browses the Internet, storing your preferences on your computer in order to save you time, thus eliminating the need to repeatedly enter the same information and only display personalized content and appropriate advertising on your subsequent visits to the website. Cookies are specific types of information that a website transmits to the OWNER's computer hard drive for record-keeping purposes.

Web beacons are images inserted in an Internet page or e-mail, which can be used to monitor the behavior of a visitor, such as storing information about the user's IP address, duration of interaction time on that page and the type of browser used, among others.

Although most browsers accept "cookies" and "web beacons" automatically, the OWNER can configure his/her browser not to accept them.

Your computer's settings may automatically accept cookies, but you can usually modify your computer's settings to decline cookies if you prefer. If you choose to decline cookies, it will not be possible for PAYLESS MEXICO to store your preferences on the website.

The OWNER has the right to know what personal information PAYLESS MEXICO has about you, what we use it for and the conditions of the use we make of it (Access). Likewise, it is your right to request the correction of your personal information in case it is outdated, inaccurate or incomplete (Rectification); to have it removed from our records or databases when you consider that it is not being used in accordance with the principles, duties and obligations under the regulations (Cancellation); as well as to oppose the use of your personal data for specific purposes (Opposition). These rights, in accordance with the provisions of the LFPDPPP, are known as ARCO rights.

The OWNER may revoke the consent that, if applicable, has been granted to PAYLESS MEXICO for the processing of his/her personal data. However, it is important for the OWNER to bear in mind that not in all cases PAYLESS MEXICO will be able to respond to his/her request or terminate the use immediately, since it is possible that PAYLESS MEXICO may be required to continue processing his/her personal data due to a legal obligation. Likewise, the OWNER must consider that, for certain purposes, the revocation of his/her consent will imply that PAYLESS MEXICO will not be able to continue providing the requested service, or the termination of the relationship with PAYLESS MEXICO.

For the exercise of any of the ARCO rights, the mechanisms that have been implemented are through the sending of the respective request (whose format can be downloaded from the website: www.PAYLESS.com.mx; request to the email address: datospersonales@PAYLESS.com.mx or in writing to the following address: in Entronque Aeropuerto sin número, Colonia Las Veredas, Los Cabos C.P. 23435, with Attention to: Marketing Management - Protection of Personal Data.

In accordance with Article 29 of the LFPDPPP, the request must contain the requested information in all required fields marked as mandatory, among which are: the full name (name or names and surnames), indication of the email or physical address you designate for notifications, a contact telephone number and a clear and precise description of the personal data on which ARCO rights are being exercised, attaching a simple copy of your official identification, or in electronic media, a digitized version of the same (scan).

The deadline to respond to your request will be within a maximum of twenty working days from the date of receipt of your request for access, rectification, cancellation or opposition, you will be given an answer about the origin of the same by email addressed to your person, sent to the email address you have indicated in the request itself or by sending a letter to the physical address you have indicated for such purposes (the twenty days will be considered fulfilled at the time of delivery).

The area responsible for processing the requests is the Personal Data Committee: through the following e-mail address for attention in Spanish: datospersonales@payless.com.mx and for attention in English: personalinformation@payless.com.mx.

PAYLESS MEXICO may carry out the transfer and/or forwarding of data to:

1. Affiliates and subsidiaries of PAYLESS MEXICO and PAYLESS internationally.
   
   

2. Third party service providers for the fulfillment of legal obligations acquired by PAYLESS MEXICO or by any of PAYLESS's affiliates and subsidiaries.
   
   

3. Third party service providers for research and analysis of personal data.
   Banking institutions, in order to collect or pay for the services offered by PAYLESS MEXICO to its customers.
   
   

4. Commercial partners with whom PAYLESS MEXICO or any of the companies of PAYLESS, carry out agreements or contracts focused on the development and commercialization of new services for the benefit of the OWNER and according to his/her needs.
   
   

5. Third parties derived from a corporate restructuring, including, merger, consolidation, sale, liquidation or transfer of assets. g)
   
   

6. Applicable and auxiliary authorities of these.
   Other transmissions provided for in the LFPDPPP and
   
   

7. Regulations. Third parties and entities receiving personal data, assume the same obligations and/or responsibilities of PAYLESS MEXICO, as described in this Privacy Notice. The PERSONAL
   
   

8. DATA HOLDER who generates any request to enter into a legal relationship with PAYLESS MEXICO or by any of PAYLESS's companies, accepts the transfer of his/her personal data, under the terms described in this Privacy Notice.
   

The parties agree that the Privacy Notice may be modified in the time and manner that PAYLESS MEXICO determines, so it reserves the right to make updates to this Privacy Notice, any changes or modifications will be informed through any of the following means:

1. Notices at PAYLESS MEXICO branches and customer service offices.

2. Notices on PAYLESS MEXICO's website (www.PAYLESS.com.mx).

3. Any other public or private means of communication provided for in the contracts that cover the transactions entered into between the HOLDER and PAYLESS MEXICO or by any of PAYLESS's companies.

The HOLDER is recommended to consult the Privacy Notice, periodically, in order to be updated on the conditions and terms of the same. In any case it is available to you, directly and personally in our customer service channels, including any electronic, optical, audio, visual, or through any other technology.

1. Sensitive data are considered those that may reveal aspects such as racial or ethnic origin, present and future state of health, genetic information, religious, philosophical and moral beliefs, union affiliation, political opinions, sexual preference, medical questionnaire with illnesses or diseases, surgical interventions, disability, invalidity, deformity, lack of a limb, sexually transmitted infections, drug use, if pregnant, medical history of family members with illnesses or diseases, as well as medical studies.

2. Biometric data are those physical, biological or behavioral traits of an individual that identify him/her as unique from the rest of the population. Referral refers to the communication of personal data between PAYLESS MEXICO as Controller of personal data and its Processors (e.g., suppliers), within or outside the Mexican territory.