Pursuant to the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, the Privacy Notice Guidelines and the other applicable provisions (hereinafter, collectively, the “Law”), this Privacy Notice is issued on the following terms:
A. CONTROLLER OF THE PERSONAL DATA.
For purposes of this Privacy Notice, Kueski, S.A.P.I. de C.V., SOFOM, E.N.R. (hereinafter, the “Controller” or “Kueski”), with address at Av. Américas 1297, Floor 03-15, Col. Circunvalación Américas, Guadalajara, Jalisco, Mexico, C.P. 44630, is the legal entity responsible, under the terms of the Law, for the processing of your personal data, processing being understood as the obtaining, use, recording, organization, retention, preparation, utilization, communication, dissemination, storage, possession, access, handling, exploitation, disclosure, transfer or disposal of such data.
Kueski shall be responsible for the personal data it collects, both from individuals and from third parties who are neither customers nor employees, including, without limitation, affiliated merchants, suppliers, and interested third parties such as shareholders or officers of Kueski, as well as its related parties, affiliates, subsidiaries or parent companies (hereinafter, the “Data Subjects”).
B. PERSONAL DATA COLLECTED AND SUBJECT TO PROCESSING.
In accordance with the foregoing, we inform you that Kueski will obtain your personal data, whether directly, in person or indirectly, when you submit a request and provide your personal data for purposes of the provision of services with Kueski.
| Personal data comprising: | |
|---|---|
| 1. Identification data | |
| 2. Contact data | |
| 3. Employment and academic data | |
| 4. Personal/employment reference data |
| Financial and asset data comprising: | |
| 1. Financial and asset data | Bank accounts and CLABE. |
Kueski does not collect sensitive data for processing.
C. PURPOSES FOR WHICH PERSONAL DATA WILL BE PROCESSED.
Kueski uses your personal and financial data for the following purposes:
a) Primary purposes, necessary for the provision of the service.
- Compiling the information file.
- Contracting.
- Identifying risks in contracting and/or appointment to any role.
- Market research.
- Notices of changes in terms and conditions.
- Responding to legal requirements of competent authorities.
- Analysis of the viability of the collaboration, if any, between Kueski and the Data Subject.
- Criminal record information.
- Requesting employment references from third parties.
The purposes described above give rise to, and are necessary for, the legal relationship with Kueski.
In addition, Kueski may use your personal data for the secondary purposes indicated below:
- Providing references of any kind to third parties.
- Marketing and/or commercial prospecting purposes.
If you do not wish your data to be used for these additional purposes and/or you wish to update your prior consent, please follow the instructions in section H.
Your personal data will never be used for marketing, advertising or commercial purposes.
D. OPTIONS AND MEANS THAT KUESKI OFFERS TO DATA SUBJECTS TO LIMIT THE USE OR DISCLOSURE OF THEIR PERSONAL DATA.
You may limit the use of your personal data by sending your ARCO rights request, with the elements described in section F of this Notice, to the email address dataprotection@kueski.com
E. AUTOMATIC MEANS OF COLLECTING PERSONAL DATA.
Kueski only uses cookies and/or web beacons to facilitate browsing on the website https://kueski.com
F. MEANS FOR EXERCISING THE DATA SUBJECT’S ARCO RIGHTS.
In order to protect personal data and the privacy and trust of our candidates, we make available the email address dataprotection@kueski.com, through which the Data Subject may at any time limit the use or disclosure of their personal data, and refuse or revoke authorization for its processing, by exercising the rights of access, rectification, cancellation or objection (ARCO) provided for by the Law.
You may submit your request by meeting all the requirements set out in the ARCO Rights request form, in accordance with the LFPDPPP:
The request must contain, and be accompanied by, the following:
- The name of the Data Subject and their address or any other means of receiving notifications;
- The documents proving the identity of the Data Subject or, as applicable, the capacity and identity of their representative;
- A clear and precise description of the personal data with respect to which any of the ARCO rights is sought to be exercised, unless the right of access is concerned;
- A description of the ARCO right sought to be exercised, or otherwise what the Data Subject is requesting, and
- Any other element or document that facilitates locating the personal data.
- In the case of requests to exercise the right of rectification of personal data, the Data Subject must also state the modifications to be made and provide the documentation supporting the request.
Said request will be handled by the Legal and Compliance department.
Kueski will notify you of the determination adopted within a maximum period of twenty business days, counted from the date on which the corresponding request is received. If the request is granted, it will be implemented within the fifteen business days following the date on which the Controller communicates its response.
If the information provided in your request is erroneous or insufficient, or is not accompanied by the documents necessary to prove your identity or the corresponding legal representation, or any other document necessary to exercise your rights, the Controller shall, within five business days following receipt of your request, require you to cure the deficiencies so that the request may be processed. In such cases, you will have ten business days to comply with the requirement, counted from the day following the day on which you received it. The corresponding request shall be deemed not filed if you do not respond within that period.
Please remember that, in the event of dissatisfaction or non-compliance on our part, you may go before the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) to request the initiation of the rights protection procedure.
As the Data Subject, you shall be responsible for keeping your personal data held by Kueski up to date. Accordingly, you warrant and are liable in all cases for the truthfulness, accuracy, currency and authenticity of the personal data provided to Kueski, and you undertake to keep it duly updated, notifying the Controller of any change.
The exercise of ARCO rights may be restricted for reasons of national security, public order provisions, public safety and health, or to protect the rights of third parties, in the cases and to the extent provided for in applicable law, or by resolution of the competent authority.
In addition, we inform you that Kueski shall not be obliged to cancel your personal data in any of the cases listed in Article 25 of the LFPDPPP.
Finally, Kueski may deny a request to exercise any of the ARCO rights in the following cases: (i) when the requester is not the Data Subject of the personal data, or the legal representative is not duly authorized to act; (ii) when the requester’s personal data are not found in Kueski’s database; (iii) when exercising them would infringe the rights of a third party; (iv) when there is a legal impediment, or a resolution of a competent authority restricting it; and/or (v) when the rectification, cancellation or objection has previously been carried out. In any of the foregoing cases, Kueski will inform the requester of the reason for its decision by the same means by which the request was made and within the periods established in the LFPDPPP and its Regulations.
Please remember that the exercise of your ARCO rights is completely free of charge and that Kueski will at no time charge any fee for this service.
G. TRANSFER OF PERSONAL DATA.
Kueski may transfer and/or remit data to:
Kueski may transfer your personal data to: |
Purpose and legal basis (Federal Law on the Protection of Personal Data Held by Private Parties) |
Can you limit it on the basis of your active legal relationship with Kueski? |
| Individuals or legal entities in the event of corporate restructuring, merger, acquisition, assignment of portfolio or any other form of business transfer. | Maintenance or performance of the legal relationship between Kueski and the Data Subject, as well as the entering into of a contract in the interest of the Data Subject. | No. |
| Controlling companies, subsidiaries or affiliates under the common control of Kueski, or a parent company or company of the same group operating under the same internal processes and policies. | For compliance with the legal obligations arising from the contractual relationship between the data subject and the controller. | No. |
| Service providers, subcontracted third parties and providers of risk management, information security and/or specialized software. | For compliance with the legal obligations arising from the contractual relationship between the data subject and the controller. | No. |
| Administrative, judicial or governmental authorities. Other transmissions provided for in the aforementioned LFPDPPP and its Regulations. | For compliance with the legal obligations arising from the contractual relationship between the data subject and the controller. | No. |
| Third-party service providers and/or business partners. | For compliance with the legal obligations undertaken with Kueski. | No. |
| Third parties requesting employment and/or commercial references.* | For employment references of Kueski’s service provider. | Yes. |
The third parties and receiving entities of personal data assume the same obligations and/or responsibilities as Kueski, in accordance with the terms of this Privacy Notice.
For the transfer marked with an asterisk (*), we require your consent, which you are granting to us by accepting this privacy notice. If you do not wish your data to be transferred for that purpose or you wish to update your prior consent, please follow the instructions in section H.
H. REVOCATION OF CONSENT
At any time, you may revoke your consent to the processing of your personal data, provided that such revocation is legitimate and does not make it impossible to comply with obligations arising from a contractual relationship in force between Kueski and you.
You may request the revocation and/or update of your consent at any time by sending your request to the email address dataprotection@kueski.com , meeting the requirements set out in section F.
Refusal of the processing of your personal data for these purposes will not affect your contractual relationship with Kueski.
I. CHANGES TO THE PRIVACY NOTICE.
Any change to this privacy notice will be communicated to you through the email address you provided to the Controller when providing your personal data.
Date of last update: October 2026.