b                           Disfruta™

COMPREHENSIVE PRIVACY NOTICE FOR CUSTOMERS, VENDORS, AND VISITORS

In compliance with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations | Effective Date: September 2026

Corporate Commitment: Disfruta™ LATAM. acknowledges the fundamental significance of lawful, controlled, and transparent processing of your personal data. This Privacy Notice is structured in accordance with rigorous corporate compliance and data security standards to safeguard your privacy rights..

1.  IDENTITY AND DOMICILE OF THE DATA CONTROLLER

Disfruta™ LATAM S.A. de C.V. (hereinafter referred to as the "Data Controller"), having its legal and operational address established for notifications in the United Mexican States, and with official digital contact channels via the website www.disfruta.com.mx and the email address info@disfruta.com.mx, is the legitimate Data Controller responsible for the collection, handling, confidentiality, and protection of personal data gathered in the course of itscommercial, operational, and contractual relations.

​

2.  CATEGORIES OF PERSONAL DATA SUBJECT TO PROCESSING

To fulfill commercial, contractual, supply, and operational relationships, we collect and process the following categories of personal data:

​

​

Declaration on Sensitive Personal Data: The Data Controller does not routinely collect sensitive personal data concerning political opinions, religious beliefs, medical history, racial or ethnic origin, or sexual orientation during standard commercial transactions.

​

3.  PURPOSES OF DATA PROCESSING

A. Primary Purposes (Strictly necessary for the legal/contractual relationship):

• Verification and authentication of customer, user, vendor, and authorized legal representative identities.

•  Issuance of Internet Digital Tax Invoices (CFDI) pursuant to regulatory requirements issued by the Mexican Tax Administration Service (SAT).

• Order management, fulfillment, packaging, distribution routing, and scheduled delivery of commercial goods and produce.

• Onboarding, procurement workflows, quoting, and processing payments to authorized suppliers and service providers.

• Maintaining corporate physical security, operational continuity, and loss prevention through CCTV monitoring systems.

• Complying with statutory reporting requirements and official orders from judicial, administrative, and fiscal authorities duly authorized under applicable law.

​

B. Secondary Purposes (Optional; not conditioning the commercial relationship):

• Dispatching promotional announcements, seasonal catalogs, special inventory offers, product releases, and corporate newsletters.

• Conducting customer satisfaction surveys, market analytics, and service quality benchmarking.

Opt-Out Mechanism for Secondary Purposes: If you do not wish for your personal data to be utilized for secondary purposes, you may submit your refusal at any time by emailing privacidad@disfruta.com.mx with the subject line: "Opt-Out of Secondary Purposes".

4.  RESTRICTIVE POLICY REGARDING SECURITY SURVEILLANCE FOOTAGE (CCTV)

All audiovisual recordings and biometric data captured via surveillance systems deployed across Disfruta™ warehouses, corporate offices, packing facilities, and logistics centers are governed strictly under Mexican federal privacy regulations:

• Third-Party Confidentiality: Surveillance recordings concurrently encompass identifiable biometric data of multiple third parties (customers, contractors, logistics personnel). Pursuant to Mexican public policy and statutory privacy laws, Disfruta™ is strictly prohibited from releasing, broadcasting, or displaying CCTV footage to private
individuals or customers in connection with incidents involving lost property, personal disputes, or suspected thefts.

• Exclusive Law Enforcement Disclosure: In strict observance of Mexican constitutional and criminal procedural law, surveillance footage will solely be disclosed, extracted, and delivered to the Public Prosecutor’s Office (Ministerio Público) or competent judicial authority upon issuance of an official, legally grounded written requisition issued within
an open criminal investigation.

•  Retention and Overwrite Schedule: Recorded video footage is retained under automated system parameters for a standard technical cycle of 15 to 30 calendar days (contingent upon local storage array capacity), following which it is permanently, irreversibly overwritten.

​

5.   TRANSFER OF PERSONAL DATA

Disfruta™ may transfer personal data without requiring prior authorization from the data subject in accordance with Article 37 of the LFPDPPP under the following circumstances:

1. Holding companies, affiliates, subsidiaries, or operational entities under the common corporate control of the same management group.

2. Third-party freight, courier, and specialized transport logistics providers responsible for the physical dispatch and delivery of shipments.

3. Banking institutions, payment gateways, and licensed electronic transaction processors managing commercial payments and settlements.

4. Authorized Tax Certification Providers (PAC) certified by SAT for official timestamping and digital invoicing. 

5. Competent judicial, administrative, or criminal prosecution authorities pursuant to enforceable statutory mandates.

​

6.  MEANS AND PROCEDURE FOR EXERCISING ARCO RIGHTS

 (Access, Rectification, Cancellation, Opposition)

You or your duly accredited legal representative hold the recognized rights to Access your personal data in our possession; Rectify any inaccurate or incomplete details; request Cancellation when data is deemed unnecessary for established purposes; or Object (Oposición) to the processing of your data for specific reasons (ARCO Rights), as well
as revoke previously granted consent.

Requirements for Filing an ARCO Request:

•  Full legal name of the data subject and a verifiable email address or physical domicile for service of notice.

•  Legible copy of valid government-issued photo identification (Passport, National Voter ID, or Consular ID) or formal power of attorney demonstrating legal representation..

•  Clear, specific description of the personal data concerning which you seek to exercise ARCO rights.

•  Any supplementary documentation assisting in locating the relevant records within Disfruta™ corporate databases.

Requests must be remitted directly to the Privacy Officer at info@disfruta.com.mx. The Data Controller will communicate its determination within a statutory maximum of twenty (20) business days from official receipt. 

If deemed admissible, the corresponding determination will be fulfilled within fifteen (15) business days following notification.

​

7.  USE OF WEB TRACKING TECHNOLOGIES (COOKIES AND WEB BEACONS)

Our online storefront and digital infrastructure deploy cookies, tracking pixels, and digital analytics to optimize user navigation, retain cart inventory, and store transactional preferences. 

Users may restrict, block, or disable cookie placement directly through their browser configuration settings without compromising standard checkout workflows.

​

8.  INFORMATION SECURITY MEASURES

Disfruta™ enforces robust administrative, physical, and technical safeguards designed to protect personal data againstaccidental loss, unauthorized destruction, alteration, interception, or illicit access. These measures include SSL/TLS encryption protocols on web channels, segmented enterprise network architecture, and role-based credential access control.

​

9.  AMENDMENTS TO THIS PRIVACY NOTICE

The present Comprehensive Privacy Notice may undergo changes, modifications, or updates resulting from regulatory reforms, internal security policies, or adjustments to our catalog of products and services..

 These updates will be permanently available to the holders through from the official website: https:// www.disfruta.com.mx/aviso-de-privacidad.

​

​