PRIVACY NOTE

Last updated: October 16, 2026
 

1. Data Controller

This law firm, operating under the trade name Odilisa Gutiérrez Mendoza & Asociados (hereinafter referred to as “OGM&A” or the “Firm”), with its registered address at Bosque de Radiatas 32, Bosques de las Lomas, Cuajimalpa de Morelos, 05120, Mexico City, is responsible for processing your personal data in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, and other applicable provisions (hereinafter, the “Law”).

The Firm has a Personal Data Protection Department responsible for handling inquiries and requests regarding this Privacy Notice at contacto@ogmasociados.com.
 

2. Personal Data We Process

Depending on the services you request or engage, OGM&A may process the following categories of personal data:
 

a) Identification and contact information: Name, address, telephone number, email address, signature, official identification, Federal Taxpayer Registry number (RFC), and Unique Population Registry Code (CURP).
 

b) Professional and representation information: Occupation, position, company, ejido, community, or organization to which you belong or which you represent, as well as documents establishing your legal capacity or authority to act.
 

c) Property and financial information: Information concerning real estate and agrarian rights, including parcel certificates, certificates of rights over common-use lands, urban lot titles, assembly minutes, contracts, property transactions, and tax and banking information required for invoicing and collecting payment for services.
 

d) Legal information: Background information, judicial and administrative case files, rulings, legal opinions, and other documentation related to the matter entrusted to the Firm.
 

e) Sensitive personal data: Only when required by the nature of the matter, OGM&A may process information concerning ethnic origin (for example, in matters involving Indigenous communities) or health conditions (for example, in agrarian succession or legal capacity matters). Such data will be processed only upon obtaining your express written consent, through a handwritten or electronic signature.
 

Property and financial data are processed with your express consent, which you provide by accepting a service proposal, signing the corresponding agreement, or selecting the acceptance checkbox on the Firm's electronic forms, except where the Law permits processing without consent.
 

OGM&A obtains personal data directly from you or your representatives, from documents you provide, from publicly accessible sources such as the National Agrarian Registry and public property registries, and from proceedings conducted by the authorities involved in the matters handled by the Firm.
 

3. Purposes of Data Processing

Your personal data will be processed for the following purposes necessary to respond to your requests and provide our services:
 

a) To receive and respond to inquiries and requests for information or services.
 

b) To conduct a preliminary assessment of matters, evaluate their feasibility, and verify the absence of conflicts of interest.
 

c) To prepare service proposals and fee quotations.
 

d) To formalize and administer contractual relationships.
 

e) To provide the contracted legal advisory, consulting, and representation services, including proceedings before agrarian, registry, administrative, and judicial authorities.
 

f) To compile, manage, and maintain case files and records.
 

g) To issue invoices, collect payments, and comply with the Firm's accounting and tax obligations.
 

h) To respond to requests from competent authorities and comply with applicable legal obligations.
 

i) To document professional activities and, where appropriate, exercise or defend the rights of the Firm or its clients.
 

The receipt of an inquiry or documentation does not constitute acceptance of a matter or establish an attorney-client relationship with OGM&A. Such relationship is established only upon acceptance of a service proposal or execution of the corresponding agreement.
 

4. Transfers of Personal Data

To the extent strictly necessary for the matter entrusted to the Firm, OGM&A may transfer your personal data to:
 

a) Agrarian, registry, administrative, and judicial authorities for the purpose of conducting proceedings, complying with legal obligations, or responding to duly founded and substantiated official requests.
 

b) Notaries public, other authorized certifying officers, expert witnesses, specialists, and other professionals whose participation is required in connection with the matter.
 

c) Opposing parties and their representatives, exclusively in connection with negotiations, proceedings, or actions related to the matter.
 

These transfers are carried out pursuant to Article 36 of the Law, which does not require your consent when the transfer is provided for by law; is necessary under a contract entered into or to be entered into in your interest; is necessary for the administration or pursuit of justice; is required for the recognition, exercise, or defense of a right in judicial proceedings; or is necessary to maintain or fulfill the legal relationship between you and the Firm.
 

OGM&A informs recipients of this Privacy Notice and the purposes for which you have authorized the processing of your personal data.
 

OGM&A does not sell or commercialize personal data or transfer such data for commercial purposes unrelated to its professional activities.
 

The Firm does not currently carry out transfers requiring your consent. Should any such transfer become necessary, you will be informed of its characteristics and your express consent will be requested beforehand.

If you do not wish your personal data to be transferred in circumstances requiring your consent, you may communicate your decision at any time to contacto@ogmasociados.com.
 

Service providers that process personal data on behalf of OGM&A, including web hosting, email, cloud storage, and productivity service providers, act as data processors under the Firm's instructions and confidentiality obligations. Such providers may process information using infrastructure located outside Mexico. These data-processing arrangements do not constitute transfers within the meaning of the Law.
 

5. Personal Data of Third Parties Involved in Legal Matters

In the course of its professional practice, OGM&A may process personal data relating to individuals other than its clients, including opposing parties, ejido members (ejidatarios), community members (comuneros), recognized residents (avecindados), possessors, witnesses, successors, public officials, and representatives.

​

Such information may be obtained from clients, official records, administrative or judicial proceedings, or publicly accessible sources.
 

This information is processed exclusively for purposes related to the relevant legal matter, subject to professional secrecy and confidentiality obligations, and will not be used for unrelated purposes.
 

Where providing this Privacy Notice directly to such individuals is not feasible or would require disproportionate efforts, OGM&A makes it permanently available at www.ogmasociados.com.
 

If you provide the Firm with personal data relating to third parties, you represent that you have the authority to do so and that you have informed those individuals of the contents of this Privacy Notice.
 

6. Data Security and Confidentiality

OGM&A maintains administrative, technical, and physical security measures proportionate to the nature of the personal data processed, which shall be no less protective than those applied to its own information.

These measures are intended to protect personal data against damage, loss, alteration, destruction, and unauthorized use, access, or processing.
 

Access to personal data is restricted to individuals whose participation is necessary for the handling of each matter.

Members of the Firm and other individuals involved in data processing are subject to confidentiality and professional secrecy obligations, which remain in effect following the termination of their relationship with OGM&A.
 

In the event of a security breach that significantly affects your property or moral rights, the Firm will notify you promptly so that you may take the appropriate measures.
 

7. Rights of Access, Rectification, Cancellation, and Opposition (ARCO Rights)

You, or your legal representative, may exercise the following rights at any time:

• Access: Obtain access to your personal data and information regarding the conditions under which it is processed.

• Rectification: Request correction of personal data that is inaccurate, incomplete, or outdated.

• Cancellation: Request the cancellation of personal data when you consider that it is no longer necessary for the stated purposes or is being processed in violation of the Law.

• Opposition: Object to the processing of your personal data on legitimate grounds or when automated processing produces undesired legal effects.
   

To exercise your ARCO rights, please submit a request to contacto@ogmasociados.com, including:
 

a) Your name and an address or other means of receiving notifications.
 

b) Documents establishing your identity or, where applicable, the identity and legal authority of your representative.
 

c) A clear and precise description of the personal data concerned, except in the case of access requests.
 

d) A description of the right you wish to exercise or the action you are requesting.
 

e) Any additional information or documentation that may assist in locating the relevant personal data.
 

For rectification requests, you must also specify the corrections sought and provide supporting documentation.

OGM&A will communicate its determination within 20 business days following receipt of the request. If the request is granted, the corresponding action will be implemented within the following 15 business days.
 

These periods may be extended once for an equivalent period where justified by the circumstances.

Personal data will be made available through electronic documents or simple copies, subject to verification of the requester's identity.
 

The exercise of ARCO rights is free of charge. Only justified costs associated with reproduction, copying, or delivery may be charged.
 

The Firm may deny ARCO requests, in whole or in part, in the circumstances provided for by the Law, including where the requester fails to establish their identity or legal authority; the requested data is not held by the Firm; the rights of third parties would be adversely affected; a legal impediment or official ruling prevents compliance; or the requested rectification, cancellation, or opposition has already been carried out.
 

The Firm is also not required to cancel personal data that must be retained pursuant to applicable law or to fulfill obligations arising from its legal relationship with you.
 

In all cases, the Firm will communicate the reasons for its determination through the same means used to submit the request.
 

8. Withdrawal of Consent and Limitation of Use or Disclosure

You may withdraw previously granted consent by submitting a request to contacto@ogmasociados.com, including the same information required for the exercise of ARCO rights.
 

Withdrawal of consent does not have retroactive effect.
 

In certain circumstances, withdrawal requests may not be fulfilled immediately or may prevent the Firm from continuing to provide its services, particularly where retaining the relevant data is legally required or necessary for the contractual relationship.
 

To limit the use or disclosure of your personal data, you may also request exclusion from the Firm's institutional communications by contacting the same email address.
 

These requests will be processed within the timeframes and under the conditions applicable to ARCO rights.
 

9. Data Retention

OGM&A retains personal data for the period necessary to fulfill the stated purposes and comply with applicable legal, contractual, tax, and professional obligations, including the applicable limitation periods for claims arising from the legal relationship.
 

Once the relevant retention period has expired, personal data will be blocked and subsequently deleted, unless a legal obligation requires its continued retention.
 

The retention of legal case files and records is also governed by applicable recordkeeping obligations and professional practice standards.
 

10. Cookies and Similar Technologies

The website www.ogmasociados.com uses cookies and similar technologies necessary for its operation and security.

Depending on the tools enabled, the website may also use analytics services, such as Google Analytics, to collect statistical information about website visits, including IP addresses, browser types, devices, pages visited, and session duration.

The Firm does not use this information to personally identify visitors.
 

You may manage or disable non-essential cookies through the website's cookie preferences panel or your browser settings. Disabling certain cookies may affect the functionality of some sections of the website.
 

11. Competent Authority

If you believe that your right to the protection of personal data has been violated, you may file a personal data protection complaint with the Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) within 15 business days following the date on which the Firm communicates its response or the expiration of the applicable response period without receiving a response.
 

12. Amendments to This Privacy Notice

OGM&A may amend this Privacy Notice to reflect changes in applicable laws, its services, or its data-processing practices.

Any amendments will be published at www.ogmasociados.com, together with the date of the most recent update.

Where an amendment requires renewed consent, the Firm will request such consent before implementing the relevant processing activities.
 

13. Contact Information

Odilisa Gutiérrez Mendoza & Asociados

Personal Data Protection Department

Email: contacto@ogmasociados.com

Telephone: +52 55 4956 7303