How we handle your personal data

About this notice

This notice explains what personal data we process, what we use it for, who we share it with and how you can exercise your rights, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties published in the Official Gazette of the Federation on March 20, 2025, and other applicable rules.

For legal review: confirm the reference to the law in force, its regulations and applicable guidelines.

1. Data controller

[RAZÓN SOCIAL] (“Novación”), with address at [DOMICILIO COMPLETO], is responsible for processing your personal data.

For any matter related to this notice, write to us at eduardo_farca@novacioncredito.com.

2. Who it applies to

The law protects the data of individuals. This notice applies to shareholders, legal representatives, attorneys-in-fact, guarantors, joint obligors, employees and contacts of the companies that hire or consult us, and to anyone who writes to or calls us.

Information about the company as a legal entity is protected by the confidentiality agreement we sign with it.

3. Personal data we collect

• Identification: name, signature, CURP, RFC, nationality, date of birth and official ID.
• Contact: email, phone and address.
• Employment: company, position and powers of representation.
• Assets and financial: income, assets, debts, account statements, tax returns and, if you choose to share it, your credit report. For guarantors and joint obligors, information on the assets backing the loan.
• Legal: deeds, powers of attorney, shareholder meeting minutes and public registry data.

To process your asset and financial data we ask for your express written consent.

Sensitive data

We do not request sensitive personal data. If a document you give us contains any, we do not use it for any purpose and will ask you for a version that omits it.

How we obtain it

Directly from you, from the company you represent and from publicly available sources, such as the Public Registry of Commerce, the Public Property Registry and the Sole Registry of Movable Collateral.

This website

This site uses no cookies, web beacons, analytics tools or forms that store information. If you write to or call us, we process the data you give us in order to reply. If you message us on WhatsApp, your messages go through that service, which Meta operates under its own policies. The provider hosting the site may log technical data, such as IP address, for the security and operation of the service.

4. What we use your data for

Primary purposes, necessary for the service you request

1. Respond to your request for information and prepare a service proposal.
2. Enter into and perform the advisory contract, including the confidentiality agreement.
3. Carry out the company's financial diagnosis (Rayos X).
4. Verify identity, shareholder structure, authority and powers of attorney.
5. Verify the collateral offered and its registry status.
6. Compile the credit file and present it to the lenders you authorize.
7. Compare offers and follow up on the deal and on the company's debt.
8. Invoice and collect our fees.
9. Comply with legal obligations and respond to requests from authorities.
10. Handle your ARCO rights requests and withdrawals of consent.

Secondary purposes, not necessary for the service

1. Send you information about our services and changes in business credit.
2. Ask for your opinion of our service.

If you do not want us to use your data for secondary purposes, write to eduardo_farca@novacioncredito.com with the subject “Secondary purposes”. You can do so at any time, and your refusal does not affect the service you hired.

5. Who we share your data with

We only transfer your data to the following third parties:

When signing the contract we will ask you to indicate whether you authorize each transfer. If you do not authorize transfers to lenders and, where one takes part, to the independent broker, we can carry out the diagnosis but cannot present your file.

We also share data with providers that process it on our behalf, such as email, storage or accounting providers. These disclosures do not require your consent, and those providers may only use the data to provide their service to us.

For legal review: confirm whether the transfer to the independent broker requires express consent or falls under a legal exception, and draft the consent boxes in the contract.

6. Your ARCO rights

You have the right to know what data we hold and how we use it (access), to correct it if it is inaccurate or incomplete (rectification), to ask us to delete it when no longer needed (cancellation) and to object to its use for specific purposes (objection). You may also withdraw your consent and limit the use or disclosure of your data.

How to exercise them

Send your request to eduardo_farca@novacioncredito.com with the subject “ARCO rights”. Include:

• Your name and an email address for our reply.
• A copy of your official ID or, if acting through a representative, the document proving representation.
• A clear description of the data and the right you wish to exercise.
• For rectification, the correction and a supporting document.
• Any information that helps us locate your data.

We will reply by email within a maximum of 20 days from receipt of your request. If it is granted, we will carry it out within the following 15 days. The process is free; only shipping or copying costs allowed by law may apply.

If a legal obligation requires us to keep certain data, we will explain it in our reply. If you believe we did not handle your request in accordance with the law, you may go to the personal data protection authority.

For legal review: confirm deadlines (business or calendar days) and requirements under the 2025 law, and name the competent authority in force (under that law, the Ministry of Anti-Corruption and Good Governance) with its contact details.

7. Retention and security

We keep your data while it is needed for the purposes of this notice and for the periods required by law, such as tax and commercial law. After that we block and delete it.

We apply administrative, technical and physical security measures. Documents are read and analyzed on Novación's own computers.

For legal review: define retention periods by document type.

8. Changes to this notice

We may change this notice due to changes in the law, our services or our practices. We will publish the current version on this page with its update date. If you are a client, we will also notify you by email. If a change affects purposes or transfers that require your consent, we will ask for it again.

9. Consent

By signing the services contract and the consent form, you accept the processing of your data under the terms of this notice.