Comprehensive Privacy Notice

1. Identity and address of the data controller

HH INTEGRA RH, S.C. (hereinafter "HHintegra") is responsible for the processing of the personal data that it collects, uses, stores and protects through its human resources administration and management technology services and platforms.

HHintegra recognizes the importance of protecting the privacy and security of the personal information of its customers, users and data subjects, and therefore processes personal data in accordance with the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality and accountability set out in Mexican law.

2. Personal data we may collect

To provide our services, HHintegra may process the following categories of personal data:

Identification data

• Full name.
• Date of birth.
• Nationality.
• CURP.
• RFC.
• Social security number.
• Official identification documents.
• Handwritten or electronic signature.
• Photograph.

Contact data

• Email address.
• Landline or mobile phone.
• Home address.
• Emergency contact details.

Employment data

• Job title.
• Department.
• Employment history.
• Professional experience.
• Training.
• Performance evaluations.
• Attendance.
• Vacation.
• Incidents.
• Information related to the employment relationship.

Academic data

• Level of education.
• Certifications.
• Professional degrees.
• Training certificates.

Financial and asset data

• Bank.
• CLABE interbank number.
• Account number.
• Salary information.
• Earnings.
• Deductions.
• Benefits.
• Tax information related to payroll.

3. Sensitive personal data

Depending on the services contracted by our customers, HHintegra may process sensitive personal data necessary for labor administration and compliance with legal obligations. These may include:

• Information about health status.
• Medical leave.
• Workplace accidents.
• Occupational medical information.
• Work-related medical restrictions.
• Biometric data for attendance or access control.
• Union membership where legally required.
• Beneficiary information for employment benefits.

Such data will be processed under strict security and confidentiality measures.

HHintegra will only use sensitive data for purposes related to labor administration, compliance with legal obligations and the services expressly contracted by its customers.

4. Purposes of data processing

Primary purposes

Personal data will be used to:

• Create and manage user accounts.
• Manage digital personnel files.
• Process payroll-related information.
• Manage vacations, leave and incidents.
• Manage recruitment and selection processes.
• Coordinate performance evaluation processes.
• Manage training activities.
• Manage benefits and entitlements.
• Comply with labor, tax and social security obligations.
• Provide technical support.
• Ensure the security of the platform.
• Respond to requests, inquiries and requirements.

Secondary purposes

Additionally, we may use information to:

• Evaluate service quality.
• Conduct satisfaction surveys.
• Generate aggregated and anonymized statistics.
• Improve platform features.
• Inform about updates or new services.

Data subjects may object to the processing of their data for secondary purposes by sending a request to the contact channels indicated in this notice.

5. Data controller and data processor

When HHintegra provides technology services to customer companies for human resources administration, the customer companies act as controllers of their employees' personal data. In such cases, HHintegra acts as processor and processes the information only in accordance with its customers' instructions and the agreements entered into between the parties.

Customers will be responsible for:

• Obtaining the necessary consents.
• Issuing their own privacy notices.
• Handling ARCO rights requests.
• Complying with the obligations established by applicable law.

6. Transfers of personal data

HHintegra may transfer personal data without requiring consent in the cases provided by law, including:

• Competent administrative or judicial authorities.
• Social security institutions.
• Tax authorities.
• Technology providers necessary for the operation of the platform.
• Affiliated or related companies that take part in providing the contracted services.

All third parties that receive information will be contractually bound to maintain the confidentiality and security of the personal data.

7. Use of cookies and similar technologies

The platform may use cookies, session identifiers, activity logs and similar technologies to:

• Recognize users.
• Keep sessions active.
• Improve the user experience.
• Analyze platform performance.
• Detect unauthorized access.
• Prevent security incidents.

Users may change their browser settings to limit or disable such technologies.

8. Security measures

HHintegra implements physical, administrative and technological measures to protect information against:

• Unauthorized access.
• Alteration.
• Loss.
• Theft.
• Misuse.
• Unauthorized disclosure.

Such measures include:

• SSL/TLS encrypted connections.
• Role-based access management.
• User authentication.
• Periodic information backups.
• Access monitoring.
• Encryption of sensitive information.
• Confidentiality agreements with employees and providers.

9. ARCO rights

Data subjects may exercise at any time their rights of:

• Access.
• Rectification.
• Cancellation.
• Opposition.

They may also revoke their consent where appropriate under applicable law.

Requests must be sent to:

Email: deyanira@hhintegra.com

The request must contain at a minimum:

• Full name of the data subject.
• A means to receive a reply.
• A clear description of the request.
• Documentation proving identity or legal representation.

10. Retention of information

Personal data will be kept for the time necessary to:

• Fulfill the purposes described.
• Meet contractual obligations.
• Meet legal and tax requirements.
• Maintain audit and security records.

Afterwards they will be deleted, blocked or anonymized in accordance with applicable legal provisions.

11. Limiting the use or disclosure of data

Data subjects may request that the use of their personal data for promotional or commercial communication purposes be limited by sending a request to the contact channels established in this notice.