Protection of Your Personal Data

1. Identity and Address of the Data Controller

CityLaw — Legal Services (hereinafter "CityLaw" or the "Controller"), with offices in Mexico City, Mexico, is responsible for the processing of your personal data in accordance with the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares — LFPDPPP) and its Regulations.

For any matter related to this Privacy Policy, please contact us at: [email protected].

2. Personal Data We Collect

CityLaw collects the following categories of personal data:

• Identification data: full name, date of birth, nationality, passport or official ID number, CURP, RFC (Mexican tax ID).
• Contact data: email address, phone number, home address.
• Immigration data: immigration status, migration form number, visas and residency permits.
• Financial and asset data: information about real estate, contracts, deeds, proof of income or bank statements, when required for the legal matter entrusted to us.
• Health data (sensitive): only when the legal matter requires it, such as in cases involving medical decisions or health-related notarial powers of attorney.
• Third-party data: in some matters you may provide us with data about a spouse, family members, or business partners. By doing so, you declare that you have obtained their consent to share such data with CityLaw.

Sensitive personal data will be handled with special diligence and will only be collected when strictly necessary for the provision of the legal service.

3. Purposes of Data Processing

Primary purposes (necessary for the provision of the service):

• Identify the client and verify their legal capacity to contract.
• Provide the contracted legal services: real estate advisory, immigration procedures, company incorporation, contract review, expat orientation, and naturalization.
• Manage, process, and follow up on the legal, administrative, and notarial procedures entrusted to us.
• Communicate progress on matters and coordinate in-person or remote consultation appointments.
• Issue and manage the collection of professional fees.
• Comply with legal obligations and requirements from competent authorities.

Secondary purposes (you may opt out without affecting the service):

• Sending newsletters, legal guides, and relevant updates for expatriates in Mexico.
• Invitations to events, webinars, or CityLaw Studio content.
• Satisfaction surveys and service improvement.

If you do not wish your data to be used for secondary purposes, please send an email to [email protected] stating your objection within five business days of receiving this Notice.

4. Transfer of Personal Data to Third Parties

In order to carry out the legal procedures entrusted to us, CityLaw may transfer your personal data — without requiring additional consent when the transfer is necessary for the execution of the contracted service — to the following categories of recipients:

CityLaw does not sell, assign, or commercialize your personal data to third parties for purposes other than those stated in this Notice. All transfers are carried out under confidentiality agreements and with appropriate security measures.

5. ARCO Rights and How to Exercise Them

You have the right to Access your personal data, Rectify it if it is inaccurate or incomplete, Cancel it when you consider it is no longer necessary for the purposes of processing, or Object to its processing for specific purposes.

To exercise your ARCO rights, please send a request to [email protected] including the following:

• Full name and copy of official ID.
• A clear description of the right you wish to exercise.
• Any information that may help locate your data.

CityLaw will respond within a maximum of 20 business days from receipt of your request. The response will be made effective within the following 15 business days.

6. Withdrawal of Consent

You may withdraw the consent granted for the processing of your personal data at any time, provided there is no legal obligation that prevents it or that the withdrawal does not affect the execution of the contracted service. To do so, please follow the same procedure described in the ARCO Rights section above.

7. Use of Cookies and Tracking Technologies

The website citylaw.mx may use cookies and similar technologies to improve the browsing experience, analyze traffic, and personalize content. You may configure your browser to reject or delete cookies; however, some website features may be affected as a result.

8. Security Measures

CityLaw implements technical, administrative, and physical measures to protect your personal data against damage, loss, alteration, destruction, unauthorized use, access, or disclosure. Access to information is restricted to personnel who require it to perform their duties and who have assumed confidentiality commitments.

9. Changes to This Privacy Policy

CityLaw reserves the right to modify this Privacy Policy at any time. Any changes will be published at citylaw.mx/privacy-policy. We recommend reviewing this page periodically. Continued use of our services after changes are published implies your acceptance.

10. Competent Authority

If you believe your rights have been violated, you may file a complaint with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI) through its website: www.inai.org.mx.