Personal data collected will be protected, incorporated, and processed in the GALERÍA EXU Personal Data System, based on Article 6, Section I of the Mercantile Establishments Law. Its purpose is to integrate and safeguard information of individuals or entities that register for billing or any other means obtained in the exercise of the functions of this establishment. They cannot be transmitted according to the Law for the Protection of Personal Data for Mexico City. Your data will not be disclosed without your express consent, except as provided by law. We commit to treating your personal data in accordance with the principles of legality, quality, consent, information, purpose, loyalty, proportionality, and responsibility established by law.
To exercise your rights, you must submit a request, either by email or at our address during business hours from 9:00 am to 1:00 pm. You can do it in person, presenting an original of your official identification, or if acting through a legal representative, you must present the original public deed accrediting your powers. If you are outside Mexico City, we may, exceptionally, allow you to send us copies of your identification documents or those necessary to prove your identity by email. However, we may require copies of other documents or ask you to send a copy of the original of such documents or use other authentication mechanisms that may be available to verify unequivocally that you are who you claim to be.
We may provide you with access to personal data, if any, either by providing a copy of the information or by giving you access to the information on a computer or by any other means established by law. This request must contain at least:
Name of the holder of the personal data;
Address, phone, and email to which we will communicate the response to your request;
Clear and precise description of the personal data for which you request to exercise any of the rights mentioned in this section; and
Any other element that facilitates the location of your personal data.
We will respond to your request within twenty days through the means provided by you, either by email or to your address. In addition, we may inform you: (i) the information that will be requested for you to identify yourself, as well as the documents you will need to send with your request; (ii) the deadlines for receiving a response to your request; (iii) how to submit your request, and; (iv) the modality or means in which we will provide you with the information. Your requests will be evaluated in the terms established by law and other applicable obligations.
The personal data that we could collect from you are:
Identification in general: Those necessary to differentiate you from others. They may include your full name, date of birth, nationality, gender, physical image by photograph and/or video recording within our facilities or at events organized by us.
To contact you: Information to keep in touch with you. It may include your address, personal or fixed and/or mobile phone number, email, social media usernames for contacting you (through your Facebook, Twitter, Instagram, Foursquare, Swarm, and/or Google+ accounts).
Financial or patrimonial: Related to the property or rights of individuals or their patrimonial situation. They may include results of socioeconomic studies, bank account numbers, income amounts (for payroll or consideration concepts), insurance, retirement fund administrators, results and annotations in credit bureaus, information on assets, tax declarations, and others.
Electronics: Includes data from you or your devices obtained when you access our Digital Property, as well as records of images and/or voice obtained through closed-circuit cameras and similar devices when visiting any of our facilities.
The ways to obtain your personal data can be through various means:
Directly from you: When you provide us with your data at one of our establishments.
Through other optical, electrical, or digital means: When you provide us with your data by phone, email, and/or when your image or voice is captured by our closed-circuit cameras and similar devices. Also, when we obtain information from you automatically, through Cookies, Web Beacons, or other tracking technologies, either directly or through a third party.
Automatically obtained data may include: (a) from devices you use (identifier, type of device, and advertising identifier); (b) geolocation data (location). If you do not want to share this information, you can choose not to do so by configuring it on your device; (c) information about the equipment used and the connection (statistics of page views, website traffic, referral URL, ads, IP address, web history, and registration).
A cookie is data stored on the hard drive when browsing our websites. Sometimes we also use another type of tracking technology called web beacons. Cookies and web beacons allow the exchange of “status information” between our websites and your device’s browser. “Status information” can provide us with the information referred to in the previous section automatically.
In general, when we collect your personal data for a purpose that we consider unnecessary or non-essential in the context of our legal relationship with you, we will provide you with a mechanism to express your refusal for us to process your data for that purpose. This mechanism will be available before collecting your data and generally will be a checkbox for you to express your consent or choose to refuse the processing. Also, these mechanisms will be available at all times, and to express your refusal, it will be sufficient for you to make your request in terms of the previous clause.
We have implemented and maintain administrative, physical, and technical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, as well as to keep them in a correct and updated manner for the purposes for which they were collected.
Last modification date: 20/05/2023