Personal Data Processing Policy of KEY CONSULTING TECHNOLOGIES

• I. Introduction
   At KEY CONSULTING TECHNOLOGIES, we are committed to protecting the privacy and security of the personal data of our customers, employees, suppliers, and any other individuals whose personal data is processed by us. In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and other applicable regulations in Mexico, we have implemented this Personal Data Processing Policy (hereinafter “the Policy”), which outlines how we collect, use, share, and protect the personal data we process.
  
  II. Responsible Party for Personal Data Processing
  La persona o entidad responsable del tratamiento de los datos personales es KEY CONSULTING TECHNOLOGIES, con domicilio en Avenida Paseo de la Reforma 199, Despacho 702, Renacimiento, Cuauhtémoc, CDMX, CP. 06500, y con correo electrónico de contacto emugica@kctech.com.mx. En adelante, la empresa.
  
  III. Definitions
• Personal Data: Any information that identifies or makes a person identifiable, such as name, address, phone number, email, etc.
• Sensitive Data: Personal data that affects the privacy of the data subject and whose improper use may lead to discrimination, such as health information, sexual orientation, religious beliefs, etc.
• Processing: Any action performed on personal data, such as collection, storage, usage, dissemination, or deletion.
  
  IV. Personal Data We Process
  The company may process the following types of personal data:

1. Identification Data: Full name, address, phone number, email, date of birth, nationality, RFC, CURP, and other personal identification details.
2. Employment Data: Information related to job position, salary, employment history, professional references, contact information, among others.
3. Financial Data: Information related to bank accounts, credit/debit cards, payments, transactions, and billing.
4. Browsing Data: Information on the use of our website and online services, such as IP address, browser type, site activity, cookies, etc.
5. Sensitive Data: When necessary, the company may process sensitive data in accordance with applicable legal provisions and with the express consent of the data subject. This data may include health information, disability, among others.

        V. Purposes of Personal Data Processing
 The personal data we collect is used for the following primary and secondary purposes:
 
1. Primary Purposes:
o  To provide hardware and software marketing products and services.

o To process payments, generate invoices, and comply with fiscal and legal obligations.

o To manage labor, administrative, and commercial relationships with employees, suppliers, and customers.

o To perform statistical and financial analyses to improve our products and services.

o To comply with local and foreign laws and regulations, including tax, labor, and social security laws.

2. Secondary Purposes (with the express consent of the data subject):
o To send commercial communications, advertisements, promotions, and newsletters about our products, services, and events.

o To conduct market research, satisfaction surveys, and other marketing activities.

o To perform internal and external audits to improve service quality and operational efficiency.

o To conduct data analysis and segmentation for statistical, research, and development purposes.

Data processing may also be carried out when necessary for purposes not specifically mentioned but compatible with the original purpose of collection.

     VI.Consent of the Data Subject: 
The processing of personal data will be based on the free, express, and informed consent of the data subject. This consent may be provided electronically, in writing, or verbally, depending on the circumstances. The data subject has the right to revoke consent at any time, in accordance with the procedures established by law.

   VII. Rights of the Data Subjects
Under the LFPDPPP and its regulations, the data subject has the following rights regarding their personal data processing:

1. Access: The right to know the personal data we hold about you and the purposes for which we process it.
2. Rectification: The right to request corrections to incorrect or incomplete personal data.
3. Cancellation: The right to request the deletion of personal data when deemed unnecessary for the purposes for which it was collected.
4. Opposition: The right to oppose the processing of personal data for specific purposes, unless there are legal or contractual reasons for processing.
5. Portability: The right to receive the personal data you have provided in a structured, commonly used, and machine-readable format, and to transmit it to another service provider.

To exercise these rights, the data subject must submit a request in accordance with the company’s established procedure, including the following information:

• Name of the data subject.
• Description of the personal data subject to the request.
• Documentation proving identity (if necessary).
• Any other information that facilitates locating the personal data.

   VIII. Security of Personal Data
The company has implemented technical, administrative, and physical security measures to protect personal data from loss, theft, unauthorized access, alteration, or destruction. 
These measures include:

• Use of data encryption systems for transmitting sensitive information.
• Implementation of internal access controls to restrict personal data access to authorized personnel.
• Continuous employee training on proper handling of personal data and information security.
• Periodic monitoring and auditing of security practices to ensure compliance with the policy and applicable regulations.

     IX. Transfer of Personal Data
The company may transfer personal data to third parties, domestically or internationally, under the following circumstances:

1. To comply with legal and tax obligations.
2. When necessary for contract fulfillment.
3. For service provision by suppliers and third parties with whom we have contractual agreements, ensuring they adhere to the same security and data protection measures as the company.

In all cases, the company will take necessary measures to ensure third parties comply with LFPDPPP provisions and respect the privacy of personal data.

   X. Modifications to the Privacy Policy
The company reserves the right to modify or update this Personal Data Processing Policy at any time to adapt to regulatory, technological, or operational changes. Any modifications will be published on the company’s website, and the date of the latest update will be clearly indicated.

  XI. Contact Information
If you have any questions, concerns, or wish to exercise any of your rights, please contact our Personal Data Protection Department via the following:

• Email: emugica@kctech.com.mx
• Phone: 55 52073066
• Address: Avenida Paseo de la Reforma 199, Suite 702, Renacimiento, Cuauhtémoc, CDMX, CP. 06500

Last updated: 09 abril 2025.