Privacy Notice – Customers and Suppliers

I. IDENTITY AND ADDRESS OF AUTOBUSES DE LA PIEDAD S.A. DE C.V.

Autobuses de la Piedad S.A. de C.V., a legal entity incorporated under the laws of the United Mexican States, with its registered office at Blvd. La Luz No. 2011, Col. Las Fuentes, Zip Code 37270, León, Guanajuato, Mexico, in its capacity as the Data Controller, and in compliance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter “LFPDPPP”) and its Regulations, makes this Privacy Notice available to the Data Subject.

For any matter related to the processing of your personal data or the exercise of your rights, you may contact Autobuses de la Piedad S.A. de C.V. through the following channels:

Email: misdatos@flecha-amarilla.com
Mailing Address: Blvd. La Luz No. 2011, Col. Las Fuentes, C.P. 37270, León, Guanajuato, Mexico.

II. PERSONAL DATA COLLECTED

Autobuses de la Piedad S.A. de C.V. collects personal data from various Data Subjects in accordance with its primary corporate purpose of establishing and operating a public passenger transportation service in the following categories:

Luxury, executive, first-class, economy, and mixed-class services;
Parcel delivery, courier, express courier, package shipping, and door-to-door pickup and delivery services, both domestically and internationally.

Data may be collected directly, when the Data Subject provides it; or indirectly, through publicly available sources, digital platforms, or authorized third parties.

Autobuses de la Piedad S.A. de C.V. may request and process passengers’ Unique Population Registry Code (CURP) as identification and identity verification data, in order to strengthen security measures in the provision of services, as well as to comply with requests from competent authorities in accordance with applicable law. The processing of such personal data will be carried out under security measures, confidentiality protocols, and restricted access, in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties and other applicable regulations.

a) Customers, Passengers, and the General Public.

Identification data, necessary to verify the Data Subject’s identity.
Contact information, used to communicate with the Data Subject.
Financial and/or asset data, collected exclusively for the management and processing of payments.
Technical browsing data, obtained automatically through the use of tracking technologies (such as cookies) when the Data Subject interacts with the websites of Autobuses de la Piedad S.A. de C.V., for the purposes of operation, security, and improvement of digital services.

b) Participants in Promotional Activities.

Identification data, necessary to reliably verify the Data Subject’s identity.
Contact information, used to establish and maintain communication with the Data Subject within the scope of the purposes of the processing.
Data related to participation in promotional activities, collected for the purpose of managing, documenting, and delivering benefits, prizes, or complimentary items resulting from organized promotional activities.

c) Suppliers

The following documents and information will be collected:

Identity information and legal structure of the legal entity or individual.
Tax information and proof of tax compliance.
Identification and legal representation information for the individual. (If applicable).
Banking and financial information for payment processing.
Legal authorization information, such as registrations, permits, licenses, and certifications
applicable to the service or good being offered.
Business and corporate contact information regarding the nature and terms of the business relationship and formal means of communication.
Location and image information of the establishment.
Consent and internal compliance documentation, including a conflict of interest statement.

d) Authorized Personnel of Suppliers, Contractors, Subcontractors, and Related Third Parties

This Privacy Notice also applies, by way of example but not limited to, to individuals who, in connection with the provision of services or the fulfillment of obligations arising from a business or contractual relationship with Autobuses de la Piedad S.A. de C.V., enter its facilities as employees, technicians, contractors, subcontractors, authorized representatives, or any other third party related to the suppliers.

To fulfill the purposes related to access control, facility security, and the protection of people and property, as well as for the internal registration of visitors and service providers, the following personal data may be collected:

Full name.
Contact information.
Company of origin.
Position, title, or role held.
Information contained in the official identification presented for access.
Reason for entry.
Person, area, or administrative unit being visited.
Date and time of entry and exit.
Areas visited within the facilities.
License plate numbers and general characteristics of the vehicle used for access, when necessary.

III. SENSITIVE PERSONAL DATA

In accordance with Articles 8 and 9 of the LFPDPPP, Autobuses de la Piedad S.A. de C.V. hereby informs you that, for certain purposes, it may collect personal data considered sensitive. The processing of sensitive personal data will be carried out only with the Data Subject’s express consent, provided in writing or through an equivalent mechanism that allows for the verification of such consent, and with the enhanced technical, administrative, and physical security measures established by applicable regulations. Autobuses de la Piedad S.A. de C.V. will not collect sensitive personal data when it is not strictly necessary for the purposes set forth in this notice.

IV. PURPOSES OF PERSONAL DATA PROCESSING

a) Primary Purposes

The personal data collected will be used for the following purposes, which are necessary for the establishment, maintenance, and fulfillment of the legal relationship between the Data Subject and Autobuses de la Piedad S.A. de C.V.:

Parcel and/or express courier shipping, sale of bus tickets, and preparation of contracts for tourist bus rentals through official channels (digital and in-person).
Recording, acknowledgment of receipt, and documentation of transactions in the event of potential chargebacks, claims, or inquiries arising from the provision of the service.
Generation of a case number and notification to the Customer through official communication channels.
Management and processing of transfers, cancellations, and requests for information related to contracted services.
Onboarding, evaluation, management, and monitoring of domestic and foreign suppliers, as well as the formalization of commercial and contractual relationships.
Processing of credit or debit card payments, as well as the management of financial transactions related to the services of Autobuses de la Piedad S.A. de C.V.

b) Secondary Purposes

Personal data may also be used for the following purposes, which are not necessary for the primary legal relationship but allow Autobuses de la Piedad S.A. de C.V. to offer you a better experience:

Conducting market research, satisfaction surveys, and quality control activities.
Sending commercial, promotional, and informational communications related to the products and services of Autobuses de la Piedad S.A. de C.V.
Generating and assigning coupons and promotional benefits for customers, partners, and employees in accordance with established programs.
Entering into collaboration agreements for the creation of digital content in exchange for complimentary items, in accordance with the agreed-upon terms and conditions.
Documenting and verifying the winner’s eligibility in promotional activities regarding the receipt of prizes and complimentary items.
Video surveillance for security, deterrence, and crime prevention purposes at the facilities of Autobuses de la Piedad S.A. de C.V.
Ensuring the proper functioning of the Autobuses de la Piedad S.A. de C.V. websites, evaluating platform usage, and supporting promotional campaigns through the use of cookies and tracking technologies.
To monitor, record, and manage the entry, presence, and exit of employees, technicians, contractors, subcontractors, authorized representatives of suppliers, and other third parties involved in the provision of services, as well as to safeguard the security of individuals, facilities, assets, and information belonging to Autobuses de la Piedad S.A. de C.V., through identity verification, access logging, and visitor control.

If the Data Subject does not wish for their personal data to be processed for secondary purposes, they may indicate this at any time through the means specified in Section VII of this notice, without such refusal affecting the provision of the contracted services.

V. TRANSFER OF PERSONAL DATA

Autobuses de la Piedad S.A. de C.V. will not transfer personal data to third parties outside its organization, except in the cases provided for in Article 36 of the LFPDPPP, or when the Data Subject has given express consent. Specifically, personal data may be shared in the following circumstances:

When necessary for the provision of the services contracted by the Data Subject, in which case the third-party recipients will be subject to the same confidentiality and security obligations as Autobuses de la Piedad S.A. de C.V.
By court order or ruling issued by the competent authority.
At the request of a competent health authority, within the framework of the National Epidemiological Surveillance System (SINAVE) or any other public health agency legally authorized to do so.
When necessary for medical prevention or diagnosis, the provision of healthcare, medical treatment, or the management of health services.
By law or at the request of a competent administrative authority acting within the scope of its powers.

Financial data provided for the processing of credit or debit card payments will not be transferred to third parties, except to banking institutions and payment processors strictly necessary to complete the transaction, which will be subject to their own privacy policies and applicable financial regulations.

VI. VIDEO SURVEILLANCE AND TRACKING TECHNOLOGIES

a) Video Surveillance

The facilities of Autobuses de la Piedad S.A. de C.V. are equipped with video surveillance systems operated for security, deterrence, and crime prevention purposes, in accordance with applicable regulations. The recorded footage will be stored on the servers of Autobuses de la Piedad S.A. de C.V. for a maximum period of 15 to 30 days (depending on the technology), after which it will be securely and irreversibly deleted.

Images obtained through video surveillance systems may also be used to verify the entry, presence, and exit of visitors, suppliers, contractors, subcontractors, workers authorized by suppliers, and other individuals who access the facilities, exclusively for the purposes of security, access control, and compliance with requests from the competent authority.

b) Cookies and Tracking Technologies

When you interact with the websites of Autobuses de la Piedad S.A. de C.V., non-personal technical information—including your Internet Protocol (IP) address, operating system, browser type, referring website, and navigation path—will be collected through the use of cookies and similar technologies. This information is used exclusively to ensure the proper functioning of the platform, evaluate website usage, and support promotional campaigns. The Data Subject may disable cookies through their browser settings; however, doing so may limit access to certain features of the site.

VII. ARCO RIGHTS AND MECHANISMS FOR EXERCISING THEM

In accordance with Articles 27 through 34 of the LFPDPPP and Articles 87 through 111 of its Regulations, the Data Subject has the right at all times to:

Access: To know what personal data Autobuses de la Piedad S.A. de C.V. holds, for what purposes it is used, and the conditions under which it is used.
Correction: To request the correction of your personal data when it is inaccurate, incomplete, or out of date.
Deletion: Request the deletion of your personal data from processing, following its prior blocking.
Objection: Object to the processing of your personal data for specific purposes.

Furthermore, the Data Subject has the right to revoke at any time the consent granted for the processing of their personal data, provided that doing so does not violate any legal provision.

To exercise any of the above rights, the Data Subject must submit a request to the Office of Personal Data Protection at Autobuses de la Piedad S.A. de C.V. through the following channels:

Mailing Address: Blvd. La Luz No. 2011, Col. Las Fuentes, ZIP Code 37270, León, Guanajuato, Mexico.
Email: misdatos@flecha-amarilla.com

The request must contain, at a minimum, the following information:

The Data Subject’s full name and address or other means of communicating the response to them;
Documents proving the Data Subject’s identity or, where applicable, the Applicant’s legal representation;
A clear and precise description of the personal data regarding which the Data Subject seeks to exercise the corresponding right; and
Any other information that facilitates the location of the personal data.

Autobuses de la Piedad S.A. de C.V. will notify the Data Subject, within a maximum of twenty (20) business days from the date of receipt of the request, of the decision reached, so that, if applicable, it may be implemented within the fifteen (15) business days following the date on which the response is communicated, in accordance with Article 31 of the LFPDPPP. The aforementioned time limits may be extended once for an equal period, when justified by the circumstances of the case.

VIII. SECURITY MEASURES

Autobuses de la Piedad S.A. de C.V. has implemented and maintains the necessary technical, administrative, and physical security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, in accordance with the provisions of Article 18 of the LFPDPPP and its Regulations. Access to personal data will be restricted exclusively to authorized personnel who require such information to fulfill the purposes set forth in this notice.

IX. AMENDMENTS TO THE PRIVACY NOTICE

Autobuses de la Piedad S.A. de C.V. reserves the right to make any necessary amendments or updates to this Privacy Notice at any time, in response to changes in legislation, case law, internal policies, or new requirements for the provision of services. Any changes will be notified to the Data Subject through the following channels:

The official websites of Autobuses de la Piedad S.A. de C.V. and its affiliated companies;
Sales and customer service counters;
A national newspaper; and
Autobuses de la Piedad S.A. de C.V.’s telephone operators.

The Data Subject is advised to periodically review this notice to stay informed of any updates.

X. COMPETENT AUTHORITY

If the Data Subject believes that Autobuses de la Piedad S.A. de C.V. has violated his or her rights regarding the protection of personal data, he or she may file a complaint or report with the Secretariat for Anti-Corruption and Good Governance (SABG), the competent authority in this matter, in accordance with the procedure set forth in the LFPDPPP and its Regulations.

XI. CONSENT

The Data Subject declares that he or she has read and understood the terms of this Privacy Notice at the time of providing his or her personal data, when purchasing a ticket, contracting any of the services offered, participating in promotional activities, establishing any legal or commercial relationship, or when providing information in connection with their entry, stay, or exit from the facilities as a visitor, supplier, supplier-authorized worker, contractor, subcontractor, or any other third party related to the provision of services for Autobuses de la Piedad S.A. de C.V., thereby granting their consent to the processing of their personal data in accordance with the purposes described in this Privacy Notice.

For the processing of sensitive personal data, the data subject’s consent will be obtained expressly and in writing, through a handwritten signature or any other mechanism that reliably verifies that consent has been given, in accordance with the provisions of Article 9 of the Federal Law on the Protection of Personal Data Held by Private Parties.