Privacy notice — communication channel

SERMIMEX

Intake and handling of reports is carried out by an external law firm acting on behalf of the company, as data processor.

If the report is anonymous, no identifying data is collected: the system does not ask for a name, email, phone number or employee number, does not store the IP address or the device used, and does not use cookies.

If you choose confidential or open mode, the name you provide is processed, along with any contact means you write.

From the report itself, the data you choose to include is processed: your account of the facts, place, date, persons named or mentioned, witnesses, and any files you attach.

Sensitive data. Depending on the subject, your account may contain sensitive personal data —for example health, sexual life where sexual harassment is reported, ethnic origin where discrimination is reported, or beliefs—. Such data is processed solely to handle the report and access is restricted to the case handler.

Photographs. Hidden file data (GPS location, time and device model) is removed from uploaded images before storage.

Necessary purposes — without these the channel cannot operate and they require no additional consent:

• Registering the report or suggestion and assigning a case number.
• Assessing, investigating and closing it, including the conversation through the case number.
• Adopting any resulting measures and keeping a record of what was done.
• Complying with the company’s obligations on workplace violence and organisational environment (Mexican standard NOM-035-STPS-2018) and on corporate integrity.

Purposes that do require your consent — and which you may refuse without it affecting how your report is handled:

• Contacting you through any contact means you wrote, instead of through the case number. This is deemed granted only if you provide such contact means.
• Disclosing your name to persons involved in the investigation. If you chose confidential mode, it is NOT disclosed.

Report content is stored encrypted, and the encryption key is not kept in the database.

• The simplest option, and the default: report anonymously. If you do not give your name, there is no personal data of yours to limit.
• Choosing confidential mode: your name is restricted to the case handler.
• Not providing contact means, and communicating only through the case number.
• Asking, through your own case, that any contact means you gave no longer be used.

Two ways:

1. Through this same channel, entering with your case number and password and writing your request in the case. This is the route that preserves your anonymity.
2. In writing, delivered at SERMIMEX offices, stating which right you are exercising and over which data, with identification. If the report was anonymous, the company has no way to link it to you without the case number.

One limit worth knowing: cancellation or objection does not apply to information the company must keep to comply with a legal obligation or to support an investigation already under way, nor to third-party data recorded in a case file.

Any change is published on this page, with the last-updated date at the bottom. If the change is substantial and your case is still open, a notice is also left inside your case.

• The external law firm that receives and handles the report on behalf of the company.
• Company staff who need to know the case in order to act on it. If you indicated that an owner, director or area manager is implicated, the case is restricted and company staff cannot see it.
• The competent authorities, where the law requires reporting or where the facts must be reported.

The case file is kept while open and, once closed, for as long as needed to evidence that the report was handled and to respond to any claim or request arising from it. Afterwards it is deleted or de-identified, leaving only statistical data (type of conduct, area and date), which identifies no one.