Privacy Policy

Herce | Vázquez — Privacy Notice

Last updated: [February 9, 2026]

In accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, the “LFPDPPP”), its Regulations, and the Privacy Notice Guidelines, [LEGAL NAME OF THE ENTITY], commercially known as Herce | Vázquez (“Herce | Vázquez” or the “Controller”), with registered address at [Sierra Gamón 120, Lomas de Chapultepec, C.P. 11000, Mexico City], makes this Comprehensive Privacy Notice available to you.

1. Identity and Address of the Controller

The Controller responsible for processing your personal data is [LEGAL NAME OF THE ENTITY], with address at [FULL ADDRESS], and the privacy contact email: [privacy email, e.g., privacidad@hva.com.mx].

2. Personal Data We Collect

We may collect, directly or indirectly, the following categories of personal data:

• Identification data: full name, date of birth, nationality, signature, government-issued ID, RFC and/or CURP (when applicable).

• Contact data: address, email address, landline and mobile phone number.

• Employment/professional data: job title, company, department, professional experience.

• Asset or financial data: only when strictly necessary to provide legal services or to comply with contractual and regulatory obligations.

• Billing data: business name, RFC, tax address, tax status certificate, payment method.

• Website browsing data: IP address, browser type, operating system, pages visited, cookies, and similar technologies.

Sensitive Personal Data

In certain legal matters, we may process sensitive personal data (for example, health data, union membership, beliefs, biometric data, or other categories defined by law) only when indispensable to provide our services, protect your interests, or comply with legal obligations.

In such cases, we will request your express consent when required by applicable law.

3. Purposes of Processing

Primary Purposes (Necessary)

We process your personal data to:

• Identify you and verify your identity.

• Create and maintain files for clients, prospects, vendors, and/or related third parties.

• Evaluate conflicts of interest and matter viability.

• Provide legal services, criminal compliance, corporate investigations, defense, and legal advice.

• Respond to inquiries, requests, and appointments.

• Prepare contracts, proposals, reports, pleadings, and legal documents.

• Billing, collections, and compliance with tax, contractual, and regulatory obligations.

• Comply with requests from competent authorities and applicable legal obligations.

• Communicate with you regarding your matter or contractual relationship.

Secondary Purposes (Not Necessary)

Additionally, we may process your personal data for:

• Sending newsletters, publications, invitations to events, webinars, or trainings.

• Marketing activities, institutional positioning, and internal statistical analysis.

• Satisfaction surveys and service improvement.

If you do not want your data used for secondary purposes, you may request this at any time by emailing: [privacy email].

4. Transfers of Personal Data

Your personal data may be transferred without your consent where permitted by law, including to:

• Judicial, administrative, or prosecutorial authorities when legally required.

• Service providers supporting the Controller’s operations (e.g., IT services, document storage, courier services, audit), subject to confidentiality and security obligations.

• Correspondent law firms, expert witnesses, or specialists in Mexico or abroad, when necessary for proper legal representation.

• Financial institutions, notaries, and other third parties involved in transactions or matters you have entrusted to us.

When a transfer requires your consent under applicable law, we will obtain it in advance.

5. How to Exercise ARCO Rights

You or your legal representative may exercise your rights of Access, Rectification, Cancellation, or Opposition (ARCO), and/or revoke consent, by sending a request to: [privacy email] with the subject line: “ARCO Rights – [Data Subject Name]”.

Your request must include:

• Data subject’s name and a means to communicate our response.

• Documents proving identity or legal representation.

• A clear description of the right you wish to exercise.

• Any data or documents that help locate your information.

Response times:

• Acknowledgment and review in accordance with the LFPDPPP.

• Response within a maximum of 20 business days, and if applicable, implementation within the following 15 business days (unless a legal extension applies).

6. Revocation of Consent

You may revoke your consent for the processing of your personal data, to the extent permitted by law, by emailing [privacy email].
Revocation will not have retroactive effect and will not apply where we are legally required to retain information.

7. Options to Limit Use or Disclosure

You may limit the use or disclosure of your personal data by sending a request to [privacy email].
You may also opt out of promotional communications through the “unsubscribe” mechanism included in emails, when applicable.

8. Cookies and Similar Technologies

Our website may use cookies, web beacons, and similar technologies to:

• Improve your browsing experience.

• Analyze site traffic and performance.

• Remember user preferences.

You can disable cookies through your browser settings. Disabling cookies may affect some site functionality.

9. Security Measures

Herce | Vázquez implements reasonable administrative, technical, and physical safeguards to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing.

10. Data Retention

We will retain your personal data for as long as necessary to fulfill the purposes described above and to comply with legal, contractual, tax, regulatory requirements and/or to protect the Controller’s legal rights.

11. Minors

Our services are primarily intended for adults. If we collect data from minors, we will do so with the consent of parents or legal guardians, as required by applicable law.

12. Changes to This Privacy Notice

We reserve the right to modify or update this Privacy Notice at any time.
Any changes will be posted at: [Website URL, e.g., https://hva.com.mx/aviso-de-privacidad] and/or through any other means we deem appropriate.

13. Competent Authority

If you believe your right to personal data protection has been violated, you may file a complaint with the INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales), in accordance with applicable law.