PRIVACY NOTICE – Candidates and/or Employees

This “PRIVACY NOTICE” describes the ways in which we handle the information about the Candidates and/or Employees (hereinafter referred as “THE OWNER”),collected by ANDREA USA OESTE LLC., “ANDREA”)

ANDREA is a company committed and respectful of the rights of individuals and their personal information and it complies with the regulations stated in article 16 (sixteen); section II of the Political Constitution of the United Mexican States and the Federal Trade Commission of the US, as well as the provisions of the Federal Law on Protection of Personal Information Held by Private Parties. Therefore, ANDREA issues this Privacy Notice so that the personal information holder can exercise his/her right to informational self-determination.

By accessing and using this website, which domain name is: www.andrea.com and/or us.andrea.com, including the mobile applications, hereinafter referred to as “THE SITE”, owned by ANDREA, you (the Owner) state that you are accepting the terms and the conditions contained in this notice and expressly declare your acceptance and consent using electronic means to this end, in terms of the provisions of Article 1803 of the Federal Civil Code.

1. Identity and address of the information controller

1.1. The controller of the personal information is ANDREA USA OESTE LLC., its affiliates and subsidiaries (hereinafter ANDREA) which is a legal entity incorporated under the laws of the United States and whose address is 7603 Saint Andrews Ave, Suite AD 1 / 2 E, San Diego, CA. 92154.

1.2. The OWNER acknowledges that it is a private natural person, of legal age, with legal capacity, and also states that as a result of the commercial operations that it maintains with ANDREA, it is aware that it requires the processing of its personal data and, therefore, gives its consent for ANDREA to treat them, in terms of what is stipulated in this Privacy Notice.

2.- Definitions

2.1.- Owner.- The individual (THE OWNER) who owns the personal information.

2.2.- Responsible.- The private natural or legal person (ANDREA) that determines how to process the personal information.

2.3.- Entrusted.- The natural or legal person, (Von Gregg, S.A. de C.V.) which individually or jointly with others, processes personal information on behalf of the responsible party.

2.4.- Treatment.- The collection, use (including access, management, use, transfer or disposal of personal information), disclosure or storage of personal information by any means.

2.4.1 Transfer.- Any data communication made to a person other than the responsible or entrusted person.

2.4.2 Remission.- The communication of personal data between the responsible person and the person in charge, inside or outside Mexican territory.

2.5.-ARCO Rights.- Rights of access, rectification, cancellation and opposition.

2.6.-Tacit Consent.- The Owner has consented to the processing of information when, having made the Privacy Notice available, he does not oppose.

2.7.- Primary Purpose.- The main purpose of collecting personal information is to raise the relationship between ANDREA and THE OWNER.

2.8.- Secondary Purpose.- The purposes that are not essential for the relationship between ANDREA and THE OWNER but which treatment contribute to the fulfillment of the corporate purpose

3.- Information to be collected and its origin

THE OWNER agrees and acknowledges that ANDREA can directly obtain personal information by any means as follows:

General: Full name, address, telephone and / or mobile phone, email, marital status, Social Security Number and photographs.

Academics: Academics: level of studies, school, period of studies, languages and software, training courses, hobbies, personality characteristics, values.

Personal references (of which THE OWNER assures having the consent to share the personal data of said third parties): name, address, telephone number, work, time to know you and reason to know you.

Work references: companies where you have worked, names of immediate bosses, salaries received, telephones, reasons for leaving.

Family information: names and occupation of parents and siblings, names of children and spouse.

Medical Data: Current state of health, diseases, sicknesses, operations, accidents, eating habits, sports and addictions.

Social life: hobbies, groups, associations and religion.

Economic Data: Bank accounts, current expenses, acquired services and credits, level of income and expenses, properties.

THE OWNER hereby gives his express consent in terms of Article 9 of the law of the matter, for ANDREA, to treat your personal data, including the so-called sensitive, contained in this clause, to meet the purposes established by this Privacy Notice.

THE OWNER hereby, under protest to the truth, accepts that the data provided to ANDREA, are true, current and correct. In addition, you agree to hold ANDREA harmless from any lawsuit or claim arising from errors in the personal data you have provided to ANDREA

ANDREA states that it can obtain personal information of the Holder through third parties (Independent Representatives) and so-called public sources, in order to validate, update and contact the Holder, always respecting the reasonable expectation of privacy stated in Article 7 of the LFPDPPP.

ANDREA will use IP information (Internet Protocol) to analyze any type of threats to THE SITE as well as to gather demographic information. However, the IP information will never be used to identify the Owners, except when there is a likelihood of fraudulent activity.

ANDREA declares that before processing the sensitive personal data of the prospectuses, by itself or through managers, it will make this privacy notice available to THE OWNER and will obtain its consent expressly, in writing and with its autograph signature, in accordance with Article 9 of the Federal Law on the Protection of Personal Data in the Possession of Individuals.

ANDREA declares that the holder information will only and exclusively access and process the personal data of THE OWNER, in order to carry out the hiring and administration of personnel, and must carry out the processing of personal data in accordance with the instructions that ANDREA communicates in writing, exclusively for the fulfillment of the purposes of this Notice.

4.- Purpose of obtaining personal information

ANDREA agrees and acknowledges that it will use the personal information of THE OWNER, exclusively for the following primary purposes:

1. To identify him/her to carry out the formalities that are ongoing.

2. Validate the personal information submitted by the owner of the data.

3. Contact your family in case of emergency.

4. Make exchanges of job exchanges with third parties and make personal recommendations of THE OWNER or give references to it.

5. To know THE OWNER's language skills, work experience and state of health in order to identify any pathological, hereditary and traumatological antecedent that may influence its performance and development in the company and to know the viability of performing other functions.

6. Make a file of THE OWNER which will be kept in the Human Resources offices of the Manager either on physical, magnetic or electronic media. In the case of prospects/candidates who have not been selected by ANDREA for a specific position, their data will be kept for a period of 1-one year from the time of collection. For those prospects/candidates who have been selected to perform a certain position, their data will be kept for the duration of the labor relationship that unites them with ANDREA and until 10-ten years after the end of said labor relationship.

7. In its case, to carry out the procedures of selection and administration of personnel, such as registration with the Mexican Institute of Social Security and other institutions that are required.

8. To comply with the provisions of the tax reforms in force and/or that are about to enter into force.

4.1.- If THE OWNER does not want his personal data to be used for all or some of the purposes set forth above, must send a request for deletion of your data, specifying the purposes for which you want your personal data not be treated, to the following email: privacidad@grupoandrea.com

The parties agree that ANDREA undertakes to observe the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility with respect to the personal data collected from THE OWNER.

4.2.- The parties agree that ANDREA will cancel THE OWNER's personal data once the purposes for which the data have been collected are exhausted.

5.- Options and means to limit the use or disclosure of your personal information

5.1. ANDREA herein shall adopt, establish and maintain appropriate administrative, legal, technical and physical measures to protect your personal information against damage, loss, alteration, destruction or use, access or unauthorized use, to the extent of its capabilities among which are included, but are not limited to: (i) internal access to information policies, (ii) Verisign is used to encrypt information, (iii) firewall equipment (iv) no-breaks equipment, (v) restrictions on Internet in computer equipment (vi) protection through endpoint antivirus on all USB outputs and CD burners on all staff computers (vii) maintain backup equipment current, (viii) personalized accounts to access the system through user names and passwords; (ix) guarantees the confidentiality of information and personal information through confidentiality agreements with all suppliers, service providers and collaborators.

5.2. Consequently, ANDREA undertakes not to transfer THE OWNER’S personal information to third parties for purposes other than those set out in this Privacy Notice.

5.3. Notwithstanding the foregoing and in case security breaches occurred at any stage that significantly affect the economic or moral rights of THE OWNER, he/she will be informed in writing immediately, by ANDREA, so that he/she can take appropriate measures to defend his/her rights, releasing ANDREA of any liability as long as the violation is not attributable to it.

5.4. In this regard, ANDREA undertakes to take the necessary measures to ensure that the information holder at all times, is able to comply with the provisions of this Privacy Notice.

6.- Party responsible for processing claims

Should THE OWNER wish to revoke his/her consent, and access, modify, cancel or oppose the processing of the personal information he/she provided, he/she must request it to the following email address:

Nombre: Lic. Edgar López Garcia.
Correo electrónico: privacidad@grupoandrea.com

7.- Means to revoke consent

THE OWNER can revoke the consent granted herein. Such revocation of consent must follow the next procedure, using the format provided by ANDREA:

7.1 Send an email to the responsible party designated in paragraph 6 (six) of this notice.

7.2 Send a revocation of consent or message to the specified e-mail, indicating:

7.2.1 THE OWNER’s full name, address and the email where he/she wishes to receive the response to the request;

7.2.2 The reason for his/her request;

7.2.3 The reasons that support his/her request;

7.2.4 An official document proving his/her identity; and

7.2.5 The date on which the revocation of consent becomes effective.

7.3 ANDREA will notify THE OWNER of the decision, within a period of twenty (20) working days from the date on which the revocation request is received, so that if warranted, it becomes effective within 15 (fifteen) days after the date on which the response is sent, stating that all the steps have been taken to stop sharing THE OWNER’s information.

8.- Method to exercise the rights of access, rectification, cancellation and opposition (“ARCO rights”)

8.1.- The parties agree that in order to exercise the ARCO rights, ANDREA has made available to THE OWNER the email address listed in paragraph 6 (six) of this Notice. Said e-mail was specially created to process such requests.

8.2.- In order to exercise the ARCO rights, THE OWNER must follow this procedure, using the format provided by ANDREA:

8.2.1.- Send a request or message to the email provided, stating:
8.2.2.- The full name of the OWNER and the email where he/she wants to receive the response to his/her request;
8.2.3.- The reason for the request;
8.2.4.- Include the arguments that support the request;
8.2.5.- Official document certifying your identity and showing that you are who you claim to be;
8.2.6.- Clear and precise description of the personal information for which THE OWNER seeks to exercise any of his/her ARCO rights and any other item or document that can help ANDREA find his/her personal information.
8.2.7.- In the case of requests for correction of personal information, in addition to the above, THE OWNER must explain the amendments he/she wishes to be made and provide documentation supporting his/her request.
8.2.8.- ANDREA, will notify the OWNER of the resolution, within a period of 20 (twenty) working days from the date on which the request for access, rectification, cancellation or opposition was received, so that, if appropriate, the modification takes effect within 15 days from the time the answer is communicated.

In regards to requests for access to personal information, proof of identity of the applicant or legal representative, as appropriate will be required in order to release the information.

9.- Transfer of personal information

9.1.- Furthermore, under article 37 of the LFPDPPP, THE OWNER acknowledges and agrees that ANDREA may transfer his/her personal data to third parties without his/her consent if that is necessary to fulfill the purposes of this notice and applicable law between THE OWNER and ANDREA.
9.2.- For your information, ANDREA will share your personal information inside and outside the country with the following company:

Recipient of the personal data: Global Tres S.A. de C.V.
Purpose: To send communications with advertising or marketing purposes regarding the products or services it offers.

9.3.- Consequently, ANDREA undertakes not to transfer THE OWNER’S personal information to third parties for purposes other than those set out in this Privacy Notice.

9.4.- Notwithstanding the foregoing and in case security breaches occurred at any stage of the treatment, which significantly affect the economic or moral rights of THE OWNER, he/she will be informed via email, immediately, so that he/she can take the appropriate measures to defend his/her rights, releasing ANDREA from any liability, if the violation is not attributable to it.

10. Use of Cookies and Web Beacons

10.1.- ANDREA acknowledges that "THE SITE" may use cookies in connection with certain features or functions. Cookies are specific types of information that a website transfers to the hard drive of the computer of the user in order to keep records. Cookies can be used to facilitate the use of a website, saving passwords and preferences while the Holder surfs the web.

10.2.-THE SITE uses cookies to obtain or store personally identifiable information from the user’s computer that was not originally sent as part of the cookie.

10.3.- The Web Beacons are embedded images in a web page or email, which can be used to monitor the behavior of a visitor and store information about his/her IP address, the duration of interaction on that page and the type of browser used, among others.

10.4.- Although most browsers accept cookies and Web Beacons automatically, the user can set his/her browser not to accept them.

10.5.- To disable the cookies; follow the steps provided in these links:

a) Internet Explorer: http://support.microsoft.com/kb/283185;
b)Firefox:http://support.mozilla.org/es/kb/Habilitar y deshabilitar cookies?s=deshabilitar cookies&r=0&e=es&as=s;
c) Opera: http://help.opera.com/Windows/11.60/en/cookies.html;
d) Safari IPAD: http://manuals.info.apple.com/en_US/iPad_iOS4_User_Guide.pdf;
e) Safari IPHONE: http://manuals.info.apple.com/en_US/iPhone_iOS3.1_User_Guide.pdf; y
f) Chrome: http://support.google.com/chrome/bin/answer.py?hl=es&answer=95647

11. Amendments .

The parties agree that this Privacy Notice may be modified when and how ANDREA sees fit. ANDREA will notify THE OWNER of such changes by a pop up message on www.andrea.com, so that where appropriate; THE OWNER can exercise his/her ARCO rights

Also, it will be the responsibility of THE OWNER to review this Privacy Notice, which will be available to you at all times updated in the Human Resources area of ANDREA and on the ANDREA website www.us.andrea.com. The non-manifestation of nonconformity on the part of THE OWNER represents its consent and authorization to the same in all its terms.

12. Guarantor Authority .

If you believe your data protection rights have been breached by any conduct or omission on our part, or you believe there has been a violation of the provisions of the Federal Law on Protection of Personal Data Held by Private Parties, its rules and other applicable regulations, you may file an appeal or complaint with The National Institute for Transparency, Access to Information and Personal Data Protection (INAI is the Spanish acronym). For more information, we suggest you to visit their official website at www.inai.org.mx

13. Applicable Law and Jurisdiction

13.1. The parties state that this notice shall be governed by the applicable laws in Mexico, in particular, by the provisions of the Federal Law of Personal Information Held by Private Parties and its Regulations.

13.2. In the event of a dispute or controversy arises from the interpretation, enforcement or compliance of the notice and / or any of the documents derived therefrom, or in connection therewith, the parties amicably, will seek to reach an agreement within a period of 30 (thirty) calendar days from the date on which any difference arises, notifying in writing of such event to the counterparty, conducting the mediation process at the Centre for Alternative Justice Federal District, under the Alternative Justice Act of the High Court of the Federal District and its internal regulations, in force when the dispute arises.

13.3. If the parties do not reach an agreement, herein they accept to submit all disputes arising out of this notice and/or any of the documents derived therefrom, or in connection with this or those, to be resolved definitively and submit to the jurisdiction and laws of the Federal Administrative Authorities or the courts of Mexico City, Federal District expressly waiving any other jurisdiction that for reasons of their present or future domiciles may apply.

Last update: 28th February 2018.