Comprehensive Privacy Notice for Video Surveillance

Who is responsible for your

data?

What data do we collect?

To fulfill the purposes described below, we may request and collect the following categories of personal data:

1.      Image.

What do we use your personal data for?

We may process your data for the following purposes:

Primary purposes:

1.      Surveillance and security of the Data Controller's premises, employees, and equipment.

2.      The safety of employees, customers, suppliers, and visitors with access to the Data Controller's premises.

3.      Access control at the Data Controller's premises.

The Data Controller will not use your personal data for secondary purposes.

Who may we share your data with?

We may transfer your personal data within the national territory in the following cases:

1.      To our parent company and/or controlling, affiliated, and/or subsidiary companies and/or any company operating under the same internal processes and policies, for the centralized safekeeping of information.

2.      To judicial and/or administrative authorities; municipal, state, and/or federal public administrations and/or any competent authority, to comply with judicial or administrative requests issued by competent authorities.

The transfers indicated above do not require your consent under Article 37 of the LFPD.

How can you exercise your ARCO rights?

You may exercise your rights of Access, Rectification, Cancellation, and Opposition (ARCO) at any time through the procedures we have implemented.

Your request must meet all requirements established by current legislation and be submitted in writing to our Personal Data Department, with “ARCO Rights” and/or “Withdrawal of Consent” as the subject of the communication.

Your request must contain the following:

a)      Your name and address, or another means of communicating the response to your request.

b)       A copy of the document proving your identity or, where applicable, legal representation.

c)      A clear and precise description of the ARCO rights you wish to exercise; and

d)      Where applicable, any other information or document that helps locate your personal data.

The decision on your request will be communicated within a maximum of twenty business days. If your request is valid, it will be implemented within fifteen business days following the date on which we communicate our response. If the information provided in your request is incorrect or insufficient, or the documents required to prove your identity or the relevant legal representation are not attached, we will request that these deficiencies be corrected within five business days following receipt of your original request. In these cases, you will have ten business days to respond to the request for correction. The request will be considered not submitted if you do not correct the error or deficiency within that period.

You may obtain the requested information or personal data through simple copies, electronic documents in conventional formats (Word, PDF, etc.), or any other lawful means that guarantees and demonstrates the effective exercise of the requested right.

The Data Controller wishes to keep your personal data up to date at all times. We therefore ask for your cooperation in promptly notifying us of any changes that

we should take into account so we can incorporate them into our databases. In all cases, you guarantee and

are responsible for the truthfulness, accuracy, currency, and authenticity of the personal

data provided for your personal service, or that of any third party under your care or legal representation.

Can you withdraw your consent?

You may withdraw your consent to the processing of your personal data, without retroactive effect, in all cases where such withdrawal does not make it impossible to fulfill obligations arising from an existing legal relationship between you and the Data Controller or result in a breach of general public-order provisions requiring the continued processing of your personal data for a specified period.

Where applicable, the procedure for withdrawing consent will be the same as that established in the immediately preceding section for exercising ARCO rights.

Limitations on the use and disclosure of your personal data

You may limit the use or disclosure of your personal data by sending the corresponding request to our Personal Data Department. The requirements for proving your identity and the procedure for handling your request will be the same as those stated in the section “How can you exercise your ARCO rights?”.

The Data Controller has means and procedures to ensure that some of your data are included in its own exclusion lists when you expressly request inclusion. The Data Controller will provide registered data subjects with the corresponding registration confirmation.

Changes or updates to this Privacy Notice

The Data Controller may modify, update, extend, or otherwise change the content and scope of this Privacy Notice at any time and at its sole discretion. In such cases, we will publish these changes on https://luxuryavenue.com/ in the “Privacy Notices” section.

Changes to this Privacy Notice will be communicated through our website https://luxuryavenue.com/. We recommend checking that website from time to time to see the latest version of this Privacy Notice. Updates and/or modifications to this document will take effect once they are published on that

website.