Privacy Notice

1. Identity and address of the data controller

CO2 Servicios Forestales de Chiapas, S. de R.L. de C.V., hereinafter “CO2SFC”, with Federal Taxpayer Registry (RFC) number CSF161013AH4 and address at Calle Cuauhtémoc núm. 35-B, between Gómez Farías and Morelos streets, colonia Del Carmen, alcaldía Coyoacán, C.P. 04100, Mexico City, is responsible for processing the personal data it collects through its website, contact channels, forms, electronic communications and other means of interaction, in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties and other applicable provisions.

The purpose of this Privacy Notice is to inform data subjects about the personal data that may be collected, the purposes of processing and the mechanisms available to exercise their personal data protection rights.

2. Personal data we may collect

CO2SFC may collect the personal data that data subjects voluntarily provide through its contact and communication channels, including:

• Identification data: full name.
• Contact data: email address, telephone number and, where applicable, address.
• Professional and employment data: company, institution, position and field of activity.
• Data related to service requests: information needed to handle inquiries, information requests, business proposals, quotations, meetings and potential professional or contractual relationships.

CO2SFC will not, as a rule, request sensitive personal data through its website. If it becomes necessary to collect such data for a specific purpose, the data subject will be informed in advance and the corresponding consent will be obtained when required by applicable law.

3. Purposes of processing personal data

Personal data may be used for the following purposes:

Primary purposes:

• To respond to information requests, inquiries, comments and messages received through our contact channels.
• To follow up on requests for environmental, forestry, ecosystem conservation and sustainability project management services, and other services offered by CO2SFC.
• To prepare and follow up on quotations and technical and commercial proposals, as well as potential contractual relationships.
• To maintain communication with clients, suppliers, strategic partners, project participants and other persons with whom there is a professional or business relationship.
• To comply with applicable legal and contractual obligations.

Secondary purposes:

• To send institutional information about activities, projects, services, events, training and news related to CO2SFC's areas of work.
• To share invitations to training, sustainability, environmental conservation and project development activities.
• To carry out institutional outreach and promotion of the company's services.

Data subjects may request that their data not be used for secondary purposes through the contact channels listed in this Privacy Notice. This will not affect the handling of their primary requests.

4. Transfer of personal data

CO2SFC will not sell the personal data it collects. When it is necessary to share data with third parties to fulfill the purposes described, this will be done in accordance with applicable law and, where appropriate, with the data subject's consent.

In particular, data may be disclosed to competent authorities when there is a legal obligation, and to third parties involved in providing services or in activities related to a contractual relationship, provided that applicable personal data protection provisions are met.

When a transfer requires consent, it will be requested in advance, unless a legal exception applies.

5. Security and confidentiality measures

CO2SFC implements administrative, technical and physical security measures designed to protect personal data against damage, loss, alteration, destruction, and unauthorized access or processing.

It also seeks to ensure that data processing is limited to the purposes stated in this Privacy Notice and that access to the data is restricted to authorized persons, according to their duties.

6. Use of cookies and similar technologies

The CO2SFC website may use cookies and other similar technologies to enable its operation, remember certain preferences, obtain statistical information about browsing and improve the user experience, when these technologies are enabled.

Cookies are files that may be stored on the user's device while browsing. Their settings can be managed through the browser's options.

Disabling certain cookies may affect how some features of the website work. If analytics, measurement or third-party service tools are used, CO2SFC will inform users of their use and, where appropriate, enable the applicable consent mechanisms.

7. Rights of access, rectification, cancellation and objection (ARCO)

Data subjects may exercise their rights of:

• Access: to know what personal data CO2SFC holds and how it is processed.
• Rectification: to request the correction of inaccurate, incomplete or outdated data.
• Cancellation: to request the deletion of their data when appropriate under applicable law.
• Objection: to request that their data no longer be processed in the cases provided for by law.

To exercise these rights, data subjects may send a request to contacto@co2chiapas.org, with the subject line “Solicitud de derechos ARCO” (ARCO rights request).

The request must include the information needed to identify the data subject, describe the data involved and specify the right they wish to exercise, together with the documents required to prove their identity or legal representation.

CO2SFC will process requests in accordance with the requirements and deadlines set out in applicable law.

8. Withdrawal of consent and limitation of data use

Data subjects may withdraw the consent they have given for the processing of their personal data, and request that its use or disclosure be limited, by sending a request to the email address indicated in this Privacy Notice.

Withdrawal will not have retroactive effect and may be subject to the limitations provided for by applicable law, particularly when there is a legal or contractual obligation to retain certain information.

9. Retention of personal data

CO2SFC will retain personal data for as long as necessary to fulfill the purposes for which it was collected and, where applicable, to meet legal, contractual or administrative obligations.

Once the data is no longer necessary, it will be deleted or processed as required by applicable provisions.

10. Changes to this Privacy Notice

CO2SFC reserves the right to update or amend this Privacy Notice to reflect changes in its activities, personal data processing or applicable legal provisions.

Changes will be available on the official CO2SFC website, in the Privacy Notice section.

11. Contact

For any question, clarification or request related to the processing of personal data, data subjects may contact CO2SFC through:

• Email: contacto@co2chiapas.org
• Mexico City office: Calle Cuauhtémoc núm. 35-B, between Gómez Farías and Morelos streets, colonia Del Carmen, alcaldía Coyoacán, C.P. 04100, Mexico City
• Tuxtla Gutiérrez office: Calle Ángel Albino Corzo núm. 49, colonia Burocrática, Tuxtla Gutiérrez, Chiapas, C.P. 29060
• Pijijiapan office: 4a. Calle Sur Poniente s/n, between 1a. and 2a. Sur Poniente, Pijijiapan, Chiapas, C.P. 30540
• Website: co2chiapas.org

CO2SFC reaffirms its commitment to the responsible processing of personal data and to respecting the privacy of the people with whom it communicates and maintains professional relationships.