COMPREHENSIVE NOTICE OF PRIVACY FOR EMPLOYEES

In compliance with Articles 15, 16, and other applicable provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter referred to as the “Law”) and its Regulations, this Privacy Notice is made available to interested parties.  

1.- IDENTITY AND ADDRESS OF THE CONTROLLER.

Tiffanys de México, S.A. de C.V. (hereinafter referred to as “Tiendas Bu’tik”) is a company that has been duly incorporated in accordance with Mexican law, a member of Grupo BD, with its address at Condominio Playa Mujeres, Interior Hotel Atelier-Playa Mujeres, locales 1, 2 y 3,  Zona Continental Isla Mujeres, Q. Roo Mexico Zip Code 77400. Tiendas Bu’tik is responsible for processing the personal data that you provide us, which will be protected according to the provisions of the Law, its Regulations and the Notice of Privacy Guidelines.

2.- PERSONAL DATA TO BE COLLECTED AND SUBJECT TO PROCESSING.

Based on the legal relationship that you have established with Tiendas Bu’tik, the company may collect and process the following data:

• Identification and contact data: Full name, gender, email, address and information in proofs of address, private landline and mobile phone numbers, marital status, place and date of birth, nationality, age, languages you speak, Federal Taxpayer Registry (RFC) data, Population Registration ID (CURP), handwritten signature, electronic signature, photographs, images, the information contained on the voter’s card, passport, social security number, the data contained on certificates issued by the Civil Registry Office of the holder and his beneficiaries (birth, adoption, marriage, and death certificates), names of family members, dependents and beneficiaries.
• ‍Academic and work-related data: Employee number, type of personnel, assigned position or appointment, job level in the organizational structure, date of entry into position, educational background, titles, professional license number, diplomas, certificates of study, curriculum vitae, work history, information related to previous jobs.
• ‍Identification and third-party contact data: Full name, landline and mobile phone number, email, relationship to you, contact details of individuals who can provide personal and/or work references, and individuals to be contacted in case of emergency, as well as your spouse, partner, parents and children, as applicable.
• ‍Financial and asset-related data: Current and previous salary, other earnings and/or income, deductions, information related to tax obligations, bank account details such as account number and type, bank card number, CLABE account number, economic activity and tax regime in the Federal Taxpayer Registry (RFC) forms, Retirement Fund Administrator (AFORE) you belong to, information about your housing subaccount with the National Housing Fund Institute for Workers (INFONAVIT), National Fund for Worker’s Consumer Spending (FONACOT) information, insurance policies, results of socioeconomic studies conducted.

Tiendas Bu’tik may also request and process data that the Law considers sensitive, which is listed below and will henceforth be understood as included under the term “Personal Data”.

• Ideological data: union affiliation, affiliation with social organizations.

• Health data: Clinical history, blood type, allergies, psychological or psychiatric profile, medical disabilities, current or future health condition, and any other information that may help establish a clear profile of your health condition.

• Physical and personal characteristics: Fingerprints, height, weight (used to uniquely identify an individual).

• Images for video surveillance purposes. Tiendas Bu’tik prioritizes security on its premises, which is why there is a video surveillance system to ensure the safety of employees, clients, and individuals who visit our facilities. This system will collect your personal image through equipment and servers operated under the strictest confidentiality. This data will be used solely for purposes related to maintaining the safety and well-being of all individuals.

Tiendas Bu’tik may request at any time, that you show or provide original documents or copies thereof in order to verify the information previously provided.

3.- PURPOSES OF THE PROCESSING OF COLLECTED DATA.

This document is intended to define the scope and general conditions of use and processing that Tiendas Bu’tik will carry out regarding your Personal Data. The collection, use, handling, utilization, storage, disclosure, and/or transfer of your data aims to fulfill the necessary purposes outlined below:

• To conduct an analysis of your application for the position or job you applied for, as well as to evaluate your work skills and, if applicable, to formalize the employment relationship and identify you as an employee.
• Verify your identity, location, request references and to generally verify that the information you have provided is authentic.
• Carry out administrative procedures related to your hiring.
• Fulfill job profile requirements.
• Pay remunerations and benefits.
• If applicable, assign and verify travel allowances and tickets for national and international trips.
• Prepare accounting entries with supporting documentation for expenses.
• Provide insurance coverage and assign beneficiaries for the insurance.
• Monitor attendance.
• Provide social security, economic and healthcare benefits.
• Procedures related to FONACOT loans.
• Provide induction courses, training and/or coaching.
• Create a physical or digital file with your hiring data.
• Carry out affiliation procedures with the Mexican Social Security Institute (IMSS), the National Housing Fund Institute for Workers (INFONAVIT), the Tax Administration Service (SAT), banking institutions, and similar organizations where affiliation is necessary for the employment relationship.
• Grant labor benefits.
• Provide access and permissions to work on the premises and assign work tools.
• If applicable, arrange business trips or work assignments, whether within the same municipality, state, country, or abroad.
• Ensure the security of the workplace facilities and protect the property and rights of Tiendas Bu’tik, its parent companies, affiliates and/or subsidiaries, employees, clients, and suppliers, as well as the confidentiality of the information related to the aforementioned individuals.
• Conduct analyses, reviews or evaluations of your behavior and/or performance within the workplace facilities, aimed at ensuring compliance with policies, manuals, codes of ethics and conduct, internal regulations, and other internal work guidelines. For these purposes, we may periodically and randomly review the information contained in the computers and other devices provided to you as work tools, including use of the internet.
• If applicable, to collaborate with authorities in investigations concerning violations or breaches of laws.
• If necessary, contact the persons you have designated in emergency situations.
• Video surveillance for the safety of the individuals visiting our facilities.

Additionally, Tiendas Bu’tik may use your information for the following non-essential purposes:

• To provide objective references to third parties regarding your job performance, even after the legal relationship between Tiendas Bu’tik and you has ended, as permitted by applicable laws. This consent will be considered valid even after the legal relationship with Tiendas Bu’tik has concluded, unless you explicitly express your refusal of this processing.
• For application of surveys and evaluations.
• To promote and improve the workplace environment and climate (such as dissemination of congratulations for achievements, birthdays, and other special celebrations).

If you do not wish for your personal data to be used for these additional purposes, you can deny your consent by sending an email to the following address: datos@grupobd.mx.

4.- TRANSFER OF PERSONAL DATA.

You are hereby informed that, in accordance with Article 37 (Thirty-Seven) of the Law, there are certain circumstances under which we may transfer your personal data nationally or internationally without your authorization being necessary. Such circumstances include transfers made to parent companies, subsidiaries, or affiliates that belong to the same corporate group as Tiendas Bu’tik, and those transfers that are necessary for maintaining or fulfilling the legal/employment relationship between you and Tiendas Bu’tik.

The following are companies or entities other than Tiendas Bu’tik to which we may transfer your Personal Data:

‍

Tiendas Bu’tik informs you that it does not make transfers that are not in accordance with the provisions of Article 37 (Thirty-Seven) of the Law. In the eventuality that Tiendas Bu’tik decides to change this policy, you will be duly informed through the means and procedures outlined hereinafter, and you will be provided with the necessary tools to authorize or prohibit transfers that are not deemed essential.  

5.- ARCO RIGHTS, MEANING AND PROCEDURE FOR EXERCISING THEM.

You, as the owner of the Personal Data collected by Tiendas Bu’tik, have the right to request Access, Rectification, Cancellation, or Opposition regarding any data you have provided to us. For further clarity, below we provide the following definitions:

Access.- The right you have to access your data and know which of them are being used in accordance with the purposes for which they were collected.

Rectification.- The right you have to request correction or modification of your data if they are incorrect.

Cancellation.- The right you have to request the deletion of your data from Tiendas Bu’tik’ database when you believe they are not being processed in accordance with this Privacy Notice or with the Law and its regulations. The cancellation request can apply to all your data or only some of it.

Opposition.- The right you have to object to the processing of your Personal Data or to demand the cessation of its use.

Exercising any of the aforementioned rights does not limit or exclude the possibility of exercising any of the others, nor is there a specific order of execution; therefore, the exercise of one right will not be a requirement for exercising the others. However, the Law establishes circumstances in which it will not be possible to comply with your request, particularly in the case of requests related to Opposition and/or Cancellation.

You may submit your request to exercise your ARCO rights at any time and free of charge, either on your own behalf or through your legal representative. To do so, you must fill out the form titled "ARCO Rights Request". Download the ARCO Rights Request Form. You may also request the hard copy directly in Human Talent and Sustainability.

ARCO Rights requests may be submitted digitally via email sent to the address datos@grupobd.mx, They may also be submitted physically to the Human Talent and Sustainability Department, who will send the request to the Personal Data Department. In both cases, all requests must contain the following information:

• Your name, address, and the method through which we can inform you of the response to your request.
• Documents that verify your identity or that of your legal representative (official ID’s, power of attorney).
• A detailed description of the Personal Data you wish to subject to any of the aforementioned rights.
• Additional information that will help locate your Personal Data.
• In the case of a request for rectification, the modifications to be made and the documentation supporting your request.

Within a maximum period of 20 (twenty) business days from the date you made your request, Tiendas Bu’tik will send you a response through the means you specified in your request. If applicable, the approved resolution will be implemented within a maximum of 15 (fifteen) days from the date Tiendas Bu’tik communicated the response to you.

In the case of requests for access to your Personal Data, these will be considered as duly completed when Tiendas Bu’tik makes the requested information available to you, through any means or format.

ARCO Rights requests may be made by individuals other than yourself, provided that the designated person proves:

• Your identity as the owner of the data that will be subject to the request.
• The identity of your legal representative.
• The existence of the representation, either through a public document, a power of attorney signed in the presence of two witnesses, or through your personal declaration.

The request and delivery of Personal Data will be free of charge; however, the requesting party will be required to cover the costs of shipping, certification, copies, or reproductions in other formats.

As mentioned earlier, the Law establishes circumstances in which Tiendas Bu’tik may deny a request related to ARCO Rights. For more information on this, we suggest reviewing Article 34 (Thirty-Four) of the Federal Law on the Protection of Personal Data Held by Private Parties.

For any questions regarding the processing of your Personal Data, contact the Personal Data Department of Tiendas Bu’tik via email at datos@grupobd.mx or by phone at (998) 272 8040 ext. 5292 during business hours, Monday through Friday, from 9:00 a.m. to 1:00 p.m.

6.- REVOCATION OF CONSENT FOR THE PROCESSING OF YOUR DATA.

You may, at any time, revoke the consent you have granted to Tiendas Bu’tik for the processing of your Personal Data; however, you should be aware that revocation of consent for processing represents the definitive cessation of the use of information and it would mean a termination of the employment relationship between you and Tiendas Bu’tik.

You may personally submit your revocation request via email to datos@grupobd.mx, in which you should include your name, attach a copy of your official identification, and specify the method through which we can inform you of the response to your request. You may also request this through your legal representative, provided the designated person meets the requirements specified for ARCO Rights requests.

The deadlines, hours, and response mechanisms will be the same as those established for ARCO Rights requests.

7. USE OF COOKIES AND WEB BEACONS.

We inform you that we do not collect personal data through the use of Cookies or Web Beacons and other technologies to obtain personal information from you, such as the following:  

• Your type of browser and operating system.  
• The webpages you visit.  
• The links you follow.
• The IP address.
• The site you visited before entering ours.

8.- MEANS FOR LIMITING THE USE OR DISCLOSURE OF YOUR PERSONAL DATA.

Tiendas Bu’tik will not use or disclose your personal data for purposes other than those strictly necessary for fulfilling the employment relationship between you and Tiendas Bu’tik, always in accordance with the guidelines described in this Privacy Notice. Consequently, you will receive essential documentation for maintaining the employment relationship, such as your pay slips.

Tiendas Bu’tik will not send you, either directly or through third parties, information or documentation for marketing, advertising, or commercial prospecting purposes. However, if you believe Tiendas Bu’tik is using or disclosing your Personal Data for purposes other than those described in this document, you may exercise any of the ARCO Rights of which you have previously been informed. Additionally, as general information, you are hereby informed that you have the following options to restrict the sending of unauthorized advertising:

• Registration with the Public Registry to Avoid Publicity (REPEP), a registry managed by the Federal Consumer Protection Agency, aimed at ensuring that users’ data is not used for marketing or advertising purposes through phone calls and text messages.
• Registration with the Public Registry of Users, a registry that contains information about Users of the Mexican Financial System who do not wish to be bothered by advertising promotions from financial institutions.

9.- CHANGES TO THE PRIVACY NOTICE.

This Notice of Privacy may be subject to modifications, changes, or updates as necessary to remain in accordance with legal provisions regarding Personal Data. If applicable, Tiendas Bu’tik will inform you of any changes by publishing them on the website https://www.grupobd.mx/privacidad.

10.- CONSENT.

By signing at the bottom of this document, you are acknowledging that you have read the content of this Privacy Notice, are aware of the legal implications as well as your rights regarding Personal Data, and that you expressly consent to the processing of your Personal Data, including data considered sensitive. You also consent to transfers of your Personal Data to third parties under the terms stated in this Privacy Notice.

11.-COMPLAINTS AND GRIEVANCES.

If you believe that your right to personal data protection has been violated, or suspect that there has been a breach in the processing of your personal data in violation of the provisions set forth in the Federal Law on the Protection of Personal Data Held by Private Parties or its Regulations, you may file the corresponding complaint or report with the National Institute for Transparency, Access to Information, and Protection of Personal Data (INAI). For more information, please visit the website: https://home.inai.org.mx/