This English translation is provided for convenience only. The Spanish version of this Privacy Notice is the only legally binding version and prevails in the event of any discrepancy. Versión en español.

1. Data controller

O&D Abogados, S.C., operating under the trade name O’Farrill, Dingler & Cervantes Abogados (the “Firm”), is responsible for the processing of the personal data described in this notice, pursuant to the Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”) and other applicable provisions.

• Address: Av. Fundadores 4001, Suite 1008, Col. Del Paseo Residencial, Monterrey, Nuevo León, C.P. 64920, Mexico.
• Privacy contact email: recepcion@oyd.mx
• Phone: +52 81 1933 5510

2. Who this notice applies to

This notice applies to the individuals whose data the Firm processes:

• Clients and prospective clients, as well as their representatives, attorneys-in-fact, partners, shareholders and beneficial owners.
• Counterparties, witnesses, experts and other third parties whose information is necessary to handle a matter.
• Suppliers and service providers, and their staff.
• Candidates who send us their CV or apply to work with us.
• Visitors to our office, including those recorded by our video surveillance cameras.
• Users of the oyd.mx website and its contact form.

3. Data we process

We process only the data necessary for each matter or relationship:

Category	Examples
Identification	Name, signature, date and place of birth, nationality, marital status, RFC (tax ID), CURP (population registry code), official ID details
Contact	Address, email, phone numbers
Employment	Occupation, position, company, professional background
Assets and financial	Assets, equity interests, income, bank accounts, account statements and tax information
Matter-related	Documents, contracts, case files, communications and filings in the matter entrusted to us
Image and access	Camera recordings, date, time and person visited

Asset and financial data. We process them with your express consent, except where the Law provides otherwise.

Sensitive data. Given the nature of our services, processing sensitive data is essential in some matters:

• In family and succession matters: family situation, health and data of minors.
• In criminal and administrative sanction matters: the person’s involvement in those proceedings.
• Any other sensitive data strictly necessary to exercise or defend a right in the matter.

Sensitive data are processed only with express written consent (handwritten or electronic signature), are limited to what is essential and are kept only as long as necessary. Consent is not required where the Law provides an exception, for example to exercise a right in court or by order of a competent authority.

4. How we use your data

Primary purposes (necessary for the relationship with the Firm):

1. Providing the legal services you entrust to us and designing the strategy for the matter.
2. Compiling, safeguarding and following up on the case file.
3. Identifying the client, their representative and, where applicable, their beneficial owner.
4. Checking for conflicts of interest before accepting a matter and while it is handled.
5. Representing you before courts, prosecutors’ offices, administrative authorities, notaries and public registries.
6. Preparing service proposals and engagement letters, invoicing and collecting fees.
7. Complying with anti-money laundering obligations where applicable (section 6).
8. Maintaining the security of the office, case files and our clients’ information (section 5).
9. Responding to requests from authorities and exercising or defending the Firm’s rights.
10. Responding to requests we receive through the contact form, email or phone.
11. Evaluating candidates who send us their CV.

Secondary purposes (not necessary; you may refuse them):

1. Sending you newsletters, alerts on legal reforms, publications and invitations to Firm events.
2. Conducting satisfaction surveys.
3. Generating internal statistics without identifying individuals.

To refuse any of the secondary purposes, write at any time to recepcion@oyd.mx with your name and the purpose you object to. Your refusal does not affect the services we provide to you.

5. Video surveillance

Our office has cameras inside and outside. The outdoor cameras point at the entrance door. Their presence is indicated by visible signs at the entrance.

• Purpose: solely the security of people, the office, case files and confidential information.
• Retention: recordings are kept for 30 days and then deleted, unless they are needed to investigate an incident or are required by an authority.
• Access: only authorized Firm personnel may view them. They are not disclosed or used for any other purpose.

6. Anti-money laundering

Some of the Firm’s services, such as incorporating companies on behalf of clients, may be vulnerable activities under the Federal Law for the Prevention and Identification of Transactions with Resources of Illicit Origin. In those cases we are required to:

• Identify the client and, where applicable, their beneficial owner, and request the documentation required by law.
• Compile and keep the identification file for the legally required period.
• File the corresponding notices with the competent authority.

This processing derives from a legal obligation and therefore does not require your consent.

7. Who we share your data with

Transfers (to third parties who use the data for their own purposes):

Recipient	Purpose	Is your consent required?
Courts, prosecutors’ offices and authorities	Pursuing and defending the matter entrusted to us	No
Competent authorities	Complying with legal obligations, including anti-money laundering obligations	No
Notaries and public brokers	Formalizing acts related to the matter (for example, incorporating a company)	No
Correspondent firms in other cities	Handling proceedings related to the matter outside Monterrey	Yes

Remittances (to providers who process the data on the Firm’s behalf, such as web hosting, email, accounting and experts retained by the Firm): these do not require consent, and providers are obliged to protect the information and use it only for the service they provide to us.

If you do not want your data transferred in the cases that do require your consent, write to recepcion@oyd.mx.

8. Your rights

You may access your data, rectify it, cancel it or object to its processing (ARCO rights). You may also revoke your consent and limit the use or disclosure of your data.

How to exercise them. Send your request to recepcion@oyd.mx or deliver it at our office, including:

1. Your name and a means for us to respond.
2. A copy of your official ID or, if you act on behalf of another person, your representative’s ID and the document evidencing the representation.
3. A clear description of the data and the right you wish to exercise.
4. Any document that helps us locate your data.

We will respond and, where applicable, give effect to your request within the time limits set by the Law.

When it does not apply. The Firm may deny cancellation or objection when the data are necessary to comply with a legal obligation, for ongoing legal proceedings or to protect the data subject’s own interests, under the terms of the Law. Attorney-client confidentiality is maintained in all cases.

Revocation. Revoking consent may prevent us from continuing to provide the service when the data are essential to the matter.

9. Security and retention

We protect your data with administrative, physical and technical measures, and our staff are bound by confidentiality and professional secrecy. We keep data for as long as the matter or relationship lasts and afterwards only for the time required by legal, tax or professional liability obligations. If a security breach significantly affects your rights, we will inform you without delay.

10. Website, changes and authority

Website. oyd.mx does not use cookies or tracking technologies to collect personal data. Data submitted through the contact form are used only to respond to your request.

Changes to this notice. Any changes will be published on this page, indicating the date of the last update.

Authority. If you believe your right to data protection has been violated, you may contact the competent authority, currently the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno).

Last updated: October 8, 2026.