Comprehensive Privacy Notice
MIP Real Assets
Identity and Address of the Data Controller
MIP Administración, S.C. (“MIP” or the “Data Controller”), with its address at Paseo de las Palmas 1005, Third Floor, Lomas de Chapultepec, Miguel Hidalgo, 11000, Mexico City, Mexico, recognizes the importance of privacy and the protection of any information concerning an identified or identifiable natural person (“Personal Data”), and is committed to the processing thereof, understood as any operation or set of operations performed with respect to such Personal Data, including its collection, use, recording, organization, retention, storage, access, handling, communication, disclosure, transfer, or disposal (the “Processing”), in a lawful, controlled, informed, and responsible manner.
Pursuant to the Mexican Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), its Regulations, and any other applicable privacy and data protection provisions (collectively, the “Applicable Law”), MIP makes this Comprehensive Privacy Notice (the “Notice”) available to all persons who access, browse, or interact with the website https://mexicoinfra.com (the “Website”), as well as to those who communicate with MIP through the means made available on the Website (the “Data Subjects”).
This Notice describes the categories of Personal Data that MIP may collect through the Website, the purposes for which such data may be processed, the circumstances under which it may be communicated to third parties, the general measures implemented for its protection, and the rights to which Data Subjects are entitled.
Where applicable by reason of the Data Subject's location or of the Processing activities carried out by MIP, the Processing of Personal Data shall additionally be subject to the data protection legislation applicable in other jurisdictions.
Personal Data Subject to Processing
The nature and scope of the Personal Data processed by MIP will depend on the manner in which the Data Subject uses and interacts with the Website. For such purposes, MIP may process the following categories:
Identification and contact data. Name and email address provided by the Data Subject when using the contact form or any other means of communication available through the Website.
Professional information. Name of the organization, company, or institution with which the Data Subject is affiliated and, where applicable, any other professional information voluntarily provided by the Data Subject in his or her communication with MIP.
Content of communications. The information included by the Data Subject in messages, requests, inquiries, or any other communication submitted through the Website.
Technical and browsing information. Information generated in connection with the access to and use of the Website, which may include the country from which the visit originates, the type of device used, the pages viewed and, depending on the technological configuration of the Website, IP address, browser type and version, operating system, date and time of access, referring website, identifiers associated with cookies or other similar technologies, and any other equivalent technical information.
Technical and browsing information may be collected automatically through cookies and similar technologies. The Data Subject may manage or disable such technologies through his or her browser settings or through the mechanisms that may be made available on the Website.
MIP does not request sensitive Personal Data through the Website. Accordingly, Data Subjects are requested to refrain from voluntarily including information of such nature in free-text fields or in communications addressed to MIP, unless strictly necessary and provided that MIP has previously furnished the relevant information and, where applicable, the consent mechanisms required under the law.
Purposes of Processing
MIP will process the Personal Data collected through the Website for the purposes described below.
Necessary Purposes
Personal Data may be processed in order to:
operate, administer, maintain, protect, and ensure the proper functioning of the Website;
receive, manage, respond to, and follow up on inquiries, requests, or communications addressed to MIP through the Website;
identify the sender of a communication and, where relevant, ascertain the organization or institution with which such sender is affiliated;
route the inquiries or communications received to the MIP department, person, or entity competent to address them in light of their nature;
maintain reasonable records of the communications received and the responses provided, for administrative, follow-up, and evidentiary purposes;
protect the security, integrity, and availability of the Website and of the systems associated with its operation, including the detection, prevention, and handling of unauthorized access, misuse, incidents, or potentially fraudulent activities; and
comply with applicable legal or regulatory obligations, respond to duly issued requests from competent authorities, and establish, exercise, or defend MIP's rights.
Analytics, Performance, and Website Improvement
Subject to the preferences expressed by the Data Subject and, where required by the Applicable Law, to his or her prior consent, MIP may process technical and browsing information for the purposes of:
obtaining statistical and aggregated information regarding the access to and use of the Website;
analyzing general browsing patterns, traffic, the country of origin of visits, the devices used, and the content viewed;
measuring and evaluating the performance, functionality, and effectiveness of the Website;
identifying opportunities to improve its structure, content, functionality, and user experience; and
Conducting web analytics and search engine optimization (SEO) activities.
MIP will not use the information collected for purposes incompatible with those described in this Notice without first providing the Data Subject with the relevant information and, where applicable, obtaining the consent required under the Applicable Law.
Transfers and International Processing of Personal Data
In order to fulfill the purposes set forth in this Privacy Notice, MIP may allow access to certain Personal Data by third parties that render services on MIP’s behalf and pursuant to its instructions, including, among others, providers of technology services, information hosting, web analytics, contact form management, and electronic communications.
Where such third parties act as data processors on MIP’s behalf, they will process the Personal Data solely to the extent necessary for the rendering of the corresponding services and will be subject to the obligations applicable to them with respect to confidentiality, security, and the protection of Personal Data.
Likewise, MIP may transfer Personal Data to parent companies, subsidiaries, affiliates, or other entities belonging to the same corporate group, as well as to other third parties, where such transfer is necessary for the fulfillment of the purposes set forth in this Notice and is permitted under the Applicable Law, including, as the case may be, to comply with legal or regulatory obligations; to respond to requests from competent authorities; to establish, exercise, or defend rights; to maintain or perform a legal relationship between MIP and the Data Subject; or in any other circumstances provided for by law.
Where a transfer of Personal Data requires the Data Subject's consent under the Applicable Law and none of the legally established exceptions applies, MIP will obtain such consent prior to carrying out the corresponding transfer.
Due to the nature of the technology services used for the operation of the Website, certain providers or recipients may be located in, or may process or store Personal Data in, jurisdictions other than Mexico. In such cases, the Processing and, where applicable, the international transfers of Personal Data will be carried out in accordance with the requirements applicable under the Applicable Law.
To the extent that the data protection legislation of the European Economic Area or of the United Kingdom applies, international transfers of Personal Data will be subject to such mechanisms and safeguards as may be legally required.
Retention of Personal Data
MIP will retain Personal Data only for the period reasonably necessary to fulfill the purposes for which it was collected, taking into consideration the nature of the information, the duration and characteristics of the interaction with the Data Subject, the applicable legal or regulatory retention obligations, and the relevant statutes of limitations for the establishment, exercise, or defense of rights.
Once the Personal Data is no longer necessary for the purposes that justified its Processing and the applicable retention periods have elapsed, MIP will proceed to block it and subsequently delete it or, where appropriate, to anonymize it, in accordance with the Applicable Law.
Security Measures and Confidentiality
MIP adopts and maintains administrative, physical, and technical security measures that are reasonable and proportionate to the nature of the Personal Data subject to Processing, the purposes for which it is processed, and the risks associated with such Processing, aimed at protecting it against damage, loss, alteration, destruction, or unauthorized use, access, or Processing.
Likewise, MIP establishes and maintains controls and mechanisms designed to ensure that the persons involved in any phase of the Processing of the Personal Data maintain due confidentiality with respect thereto, and that any third parties or service providers that may have access to Personal Data on MIP's behalf implement appropriate security and protection measures consistent with the nature of the services they render and with the Applicable Law.
The confidentiality obligation with respect to the Personal Data will survive the termination of the relationship that may have given rise to its Processing. MIP periodically reviews and updates its security measures, taking into consideration technological developments, applicable best practices, and the risks associated with the Processing, with a view to ensuring at all times the adequate protection of the Personal Data under its responsibility.
Rights of the Data Subject
The Data Subject may exercise before MIP the rights of access, rectification, cancellation, and objection (the “ARCO Rights”, as they are known by their Spanish acronym), as well as revoke any consent previously granted for the Processing of his or her Personal Data and request the limitation of its use or disclosure, in accordance with the Applicable Law.
In particular, the Data Subject will have the right to: (i) access his or her Personal Data and be informed of the general conditions of its Processing; (ii) request its rectification where it is inaccurate or incomplete; (iii) request the cancellation of his or her Personal Data from MIP's files, records, and systems, in which case such data will be subject to the applicable blocking period and subsequent deletion in accordance with the Applicable Law; and (iv) object to the Processing of his or her Personal Data on legitimate grounds.
Any request relating to the exercise of the ARCO Rights must contain, at a minimum: (i) the name of the Data Subject; (ii) an address, email address, or other means for communicating the corresponding response; (iii) documents evidencing the identity of the Data Subject and, where applicable, the legal authority of his or her representative; (iv) an indication of the right sought to be exercised; (v) a clear and precise description of the Personal Data with respect to which the exercise of the corresponding right is requested; and (vi) any other element or document that may facilitate the location of the Personal Data or that may be relevant to address the request.
The request must be sent to the email address contacto@mexicoinfra.com or submitted by written communication delivered to the address at Paseo de las Palmas 1005, Third Floor, Lomas de Chapultepec, Miguel Hidalgo, 11000, Mexico City, Mexico.
MIP will communicate to the Data Subject the determination adopted with respect to his or her request within a maximum period of 20 (twenty) business days from the date on which the request is received. If the exercise of the requested ARCO Right is found to be appropriate, MIP will give effect to such rights within the 15 (fifteen) business days following the date on which it communicates the corresponding response.
The foregoing periods may be extended, on a single occasion and for an equal period, where justified by the circumstances of the case, in accordance with the Applicable Law.
If the information provided in the request is insufficient or inaccurate for purposes of addressing it, or if the necessary documentation is not attached, MIP may require the Data Subject, on a single occasion and within the 5 (five) business days following receipt of the request, to provide the elements or documents necessary to process it. The Data Subject will have 10 (ten) business days, counted from the day following receipt of such requirement, to respond to it. Failure to do so within such period will result in the request being deemed not to have been submitted.
The Data Subject may at any time revoke any consent previously granted for the Processing of his or her Personal Data, without retroactive effect, by means of a request sent to contacto@mexicoinfra.com, in which he or she must provide the information reasonably necessary to evidence his or her identity and to identify the Processing with respect to which the revocation is requested. MIP will address such request in accordance with the periods and procedures set forth in the Applicable Law.
Likewise, the Data Subject may request the limitation of the use or disclosure of his or her Personal Data through the same means, without prejudice to the specific mechanisms that may be made available on the Website, including those relating to the management of cookies and similar technologies.
Changes to this Privacy Notice
MIP may amend or update this Privacy Notice as necessary to reflect changes in its Personal Data Processing practices, in the functionalities of the Website, in its corporate structure, or in the Applicable Law.
Any amendment or update will be made available to Data Subjects through the publication of the then-current version of the Privacy Notice on the Website, indicating the date of its last update. Where required by the Applicable Law, MIP will adopt such additional mechanisms as may be appropriate to inform Data Subjects of such amendments.
Contact
For any question, comment, or request relating to this Privacy Notice or to the Processing of his or her Personal Data, the Data Subject may contact MIP’s personal data protection office at the email address contacto@mexicoinfra.com, or by written communication delivered to the address at Paseo de las Palmas 1005, Third Floor, Lomas de Chapultepec, Miguel Hidalgo, 11000, Mexico City, Mexico.
Language
This Privacy Notice has been prepared in the Spanish language and subsequently translated into English. This English translation is provided for convenience of reference only. In the event of any discrepancy or inconsistency between the Spanish-language version of this Privacy Notice and this English translation, the Spanish-language version shall prevail.