Privacy policy

L. Y M. DE MEXICO is a company aware of the value of your information and of the trust that you, as a customer or supplier (data subject), place in our team in order to provide you with our products and services. For this reason we commit to, and take responsibility for, the processing of your data, maintaining the confidentiality of the information you provide at all times and acting under the general principles of lawfulness, quality, consent, information, purpose, proportionality and loyalty regarding your personal data. In compliance with Articles 15, 16 and the following of the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its regulations, we make available to you the general terms and conditions of this comprehensive privacy notice addressed to customers and suppliers.

Collection of personal data

Personal data shall be understood as all information “private” general and/or specific, of individuals or legal entities related to the customer (or prospect) and suppliers.

The ways in which our company may collect your personal data are the following:

  • In person.- When you, or someone on your behalf, provide your information directly and in person.
  • Remotely.- When you, or someone on your behalf, provide your information (your data) by means including but not limited to: phone calls, physical documents, emails, messages through electronic devices, mobile applications, communications through social media, as well as contact messages through the website: www.mesabi.com.mx

Purposes of data collection and processing

We hereby inform you that your personal data, collected or generated in connection with the operations carried out with L. Y M. DE MEXICO , will be processed for the following related purposes:

  • Recording personal data in our contacts database.
  • Sending information about our products and/or services.
  • Collecting the information needed to begin or follow up on any contractual relationship or project between you (or your company) and our company.

Other main purposes of data collection and processing are all those that allow us to fulfill the obligations arising from our legal relationships, such as those arising when you contact us to request institutional information, to request information regarding this privacy notice, to submit data-protection rights requests, or to share your opinions, complaints and suggestions about our products and services.

To achieve the purposes described above, we may request general personal data and/or specific personal data, including but not limited to the following:

  • General personal data of individuals (name, home address, landline, mobile phone, email, date of birth).
  • General personal data of legal entities (company name, name of the attorney-in-fact and/or legal representative, postal code, registered address, corporate email, landline, mobile phone).
  • Public documents in general (official ID, public deeds (articles of incorporation, powers of attorney, etc.), registration numbers of various documents before the Public Property Registry; official letters from government entities, etc.).
  • Private documents in general (documents not registered before the Public Registry, articles of incorporation, contracts, powers of attorney, personal or business plans or projects, credit bureau history, etc.).
  • Payment method data.
  • Reference requests.
  • Other similar data.

In this legal instrument we inform you that our company does not collect or generate personal data considered sensitive that require special treatment under the LFPDPPP.

Sensitive personal data, as provided in Article 3, Section VI of the LFPDPPP, is understood as the following: “Those personal data that affect the most intimate sphere of the data subject, or whose improper use may give rise to discrimination or entail a serious risk for the subject. In particular, those that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union membership, political opinions, and sexual preference are considered sensitive.”

Transfer of personal data

L. Y M. DE MEXICO strictly undertakes not to transfer or disclose your personal information to third parties; however, Article 37 of the LFPDPPP provides that, notwithstanding the foregoing, transfers of personal data may be carried out without the consent of the data subject (customer or supplier) when any of the following circumstances apply: “Article 37.-

I. When the transfer is provided for in a Law or Treaty to which Mexico is a party;

II. When the transfer is necessary for medical prevention or diagnosis, the provision of healthcare, medical treatment, or the management of healthcare services;

III. When the transfer is made to holding, subsidiary or affiliated companies under the common control of the controller, or to a parent company or any company within the same group as the controller operating under the same internal processes and policies;

IV. When the transfer is necessary by virtue of a contract entered into, or to be entered into, in the interest of the data subject, between the controller and a third party;

V. When the transfer is necessary or legally required to safeguard a public interest, or for the prosecution or administration of justice;

VI. When the transfer is required for the recognition, exercise or defense of a right in legal proceedings; and

VII. When the transfer is required for the maintenance or fulfillment of a legal relationship between the controller and the data subject.”

Consent

If this privacy notice has been made available to you and you do not express your right to object in this regard, it will be legally deemed that you grant our company tacit consent so that we may process your general personal data under the guidelines established in this legal instrument, as set forth in Articles 3 sections IV and V, 7, 8, 12, 17 and 37 section V of the law (LFPDPPP). Likewise, please note that without the need for your consent we may obtain and/or process your personal data that appear in public domain sources, as provided in Article 10 section II of the law. Furthermore, under the obligations arising from our legal relationship, we may collect, process (or, where applicable, generate) your financial and/or asset-related personal data without the need for your express consent, as provided in the fourth paragraph of Article 8 in relation to Article 10 section IV of the law, since it is linked to the services contracted with our company.

Likewise, by not objecting to this privacy notice you declare and accept that you have your own consent and that of any third parties whose data you provide, on the understanding that such data will be governed by the legal guidelines of this legal instrument and our company's privacy policy.

Use of cookies and web beacons.

Cookies are text files that are automatically downloaded and stored on the hard drive of the user's computer when browsing a specific website, which allow the internet server to remember certain data about that user, including their preferences for displaying the pages on that server, username and password.

Web beacons, in turn, are images inserted into a website or email that can be used to monitor a visitor's behavior, such as storing information about the user's IP address, the duration of interaction on that page, and the type of browser used, among others.

We inform you that we use cookies and web beacons to obtain personal information about you, such as the following:

  • Your browser type and operating system.
  • The websites you visit.
  • The links you follow.
  • The IP address.
  • The site you visited before entering ours.

These cookies and other technologies can be disabled. To learn how to do so, please consult the help section of your specific browser.

Safeguarding of personal data

To limit the use and disclosure of your data, our company maintains security and confidentiality policies and procedures in accordance with this legal instrument, the LFPDPPP, and the (confidentiality) agreements that may be entered into between both parties.

The confidentiality of personal data is guaranteed and such data is protected by administrative, technical and physical security measures to prevent damage, loss, alteration, destruction, improper use, access or disclosure; likewise, the information and images contained in the emails we exchange, as well as the electronic documents and/or data attached to them, shall have the character of confidential information and of private, restricted and secret communication, under the terms of this privacy notice.

Likewise, we inform you that the confidentiality obligation of the persons involved in processing your information subsists even after the legal relationship with our company has ended; however, we inform you that we will not be liable for any misuse that former collaborators may make by taking advantage of their past role with respect to your personal data, so you must directly bring against them any applicable civil, administrative and/or criminal liability action.

Retention period of personal data

Your personal data will be handled for as long as the legal relationship between you and our company subsists, which may be extended when required by applicable Mexican law; you may object to its handling at any time you deem appropriate, in accordance with the mechanism indicated in this section, or, where applicable, once such personal data are no longer necessary to fulfill the purposes set out in this privacy notice and applicable legal provisions, for which reason the personal data will be cancelled, thereby complying with the provisions of Article 11 of the LFPDPPP.

Data protection rights (ARCO rights)

We inform you that, as the data subject, you have the right to know what information we hold about you, what we use it for, and the conditions of the use we give it (Access). You also have the right to request the correction of your personal information when it is outdated, inaccurate or incomplete (Rectification); to have us delete it from our records or databases when you consider that it is not being used properly (Cancellation); as well as to object to the use of your personal data for specific purposes (Objection). These rights are also known as ARCO rights.

Where you may exercise your data protection rights and revoke your consent to data processing

[email protected]

Procedure for exercising data protection rights and revoking consent to data processing

  • To exercise any of the data protection rights (ARCO rights) and to revoke consent to data processing, you as the data subject (customer or supplier), or through your legal representative, may send us an email or call us at the email or phone indicated in the previous section, addressing our data processing officer at the company L. Y M. DE MEXICO ; in any case, your ARCO rights request must invariably contain the following requirements:
  • Name of the data subject, phone number, email, and name of the legal representative (if any);
  • Attach the documents that prove the identity of the data subject (a simple copy of any official photo ID) and, if there is a legal representative of the data subject (a simple copy of the respective power of attorney with original handwritten signatures and a simple copy of the legal representative's official ID; if the data subject is a legal entity, it must provide a simple copy of the public deed granting power to its legal representative as well as a simple copy of the legal representative's official ID);
  • A clear and precise description of the personal data with respect to which you seek to exercise any of the data protection rights (ARCO rights); and
  • Attach any other element or document that facilitates locating the data subject's personal data.
  • In the case of personal data rectification requests, the respective data subject must also indicate the modifications to be made and provide documentation supporting the request.
  • In the case of requests to object to the use of personal data for certain purposes, the interested party must clearly describe the purposes for which they are exercising their right to object.
  • The admissibility of your request will be answered by email, providing a response within twenty business days from the date your email is received. This period may be extended by twenty additional days when there are justified reasons; this situation will be notified to the data subject in accordance with Article 97 of the Regulations of the LFPDPPP.
  • If your request is admissible in accordance with the LFPDPPP and other applicable regulations, the data protection right (ARCO right) or revocation requested will be granted within fifteen days following the date your request is answered. This period may be extended by fifteen additional days when there are justified reasons; this situation will be notified to the data subject in accordance with Article 97 of the Regulations of the LFPDPPP.

We inform you that data protection rights are exercised free of charge; if the interested party considers it necessary to use notarial certification to attest to facts or legal acts, the notary fees will be borne by the interested party (data subject).

If you consider that your data protection right has been harmed by any conduct of our employees or by our actions or responses, or you presume that there is any violation of the provisions of the Federal Law on Protection of Personal Data Held by Private Parties in the processing of your data, you may file the corresponding complaint or report before what is now the National Institute for Access to Information and Protection of Personal Data (formerly IFAI); for more information visit the current website: inai.org.mx

Changes to this privacy notice

L. Y M. DE MEXICO reserves the right to make modifications or updates to this privacy notice at any time, arising from changes in legislation, internal policies, or new requirements for providing or offering our products and services. So that you are aware of such modifications, a notice that the modification was made will be published on our website: www.mesabi.com.mx; of course, you may call us or send us an email to clarify questions or request more information about this notice and our privacy policy.

Last updated: July 8, 2021