Privacy Notice

Last updated: October 12, 2026

1. Identity and address of the data controller

BCF MG Consultores, S.C. ("BCF"), operating under the BCF Strategic Law brand, with its address at Av. Insurgentes Sur 1079, 7th floor, Col. Nochebuena, Benito Juárez, 03720, Mexico City, Mexico, is the data controller responsible for processing your personal data under the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), published in the Official Gazette of the Federation on March 20, 2025 (the "Law").

For any matter related to this notice, please write to info@bcflaw.mx.

2. Personal data we process

BCF may process the following categories of personal data:

1. Identification and contact data: name, email address, telephone or WhatsApp number, city and company name, as well as the content of the messages you send us through the contact form, by email or by WhatsApp.

2. Newsletter subscription: your email address, if you choose to subscribe.

3. Tax and billing data: Mexican taxpayer ID (RFC) or tax identification number, tax address and payment details, only when a service engagement is formalized.

4. Browsing data: IP address, browser type, pages visited and visit duration, collected through analytics cookies only if you accept them (see Section 8).

BCF does not request sensitive personal data through this website, and we ask you not to include it in your messages. If processing sensitive data becomes necessary in connection with a matter, BCF will inform you and obtain your express written consent before doing so, as required by Article 8 of the Law. In the course of its advisory work, BCF may have access to the client's tax, financial or legal information, which it processes with enhanced security measures and under strict professional confidentiality.

3. Purposes of processing

Purposes that give rise to our relationship with you and do not require your consent:

1. To respond to your contact, information or fee-proposal requests.

2. To provide the legal, regulatory and tax services you engage.

3. To issue invoices, manage payments and administer the engagement.

4. To comply with legal obligations and keep the website secure.

Purposes that require your consent:

5. To send you newsletters and updates on legal and tax developments.

6. To inform you about new services offered by the firm.

7. To analyze use of the website through analytics cookies.

You may refuse the processing of your data for purposes 5, 6 and 7 at any time, without affecting the services you request or engage, through the means described in Section 4.

4. Options and means to limit the use or disclosure of your data

You may limit the use or disclosure of your personal data by:

• Not subscribing to the newsletter, or using the unsubscribe link included in every mailing.

• Rejecting or configuring analytics cookies in the website's cookie banner, which you can reopen at any time.

• Sending a request to info@bcflaw.mx with the subject line "Limit use of personal data".

• Revoking, by the same means, any consent you have given us. Under Article 7 of the Law, revocation has no retroactive effect.

5. Data sharing and transfers

Your personal data may be shared with providers that render website hosting, email, messaging, newsletter and website analytics services to BCF, some of which are located outside Mexico. These providers act as data processors: they process the data only on behalf of BCF, in accordance with its instructions and subject to confidentiality obligations.

BCF does not sell or assign your personal data for commercial purposes. It will transfer your data to third parties without your consent only in the cases provided for in Article 36 of the Law, including when the transfer is provided for in a law or treaty to which Mexico is a party; is necessary under an agreement entered into, or to be entered into, in your interest; is necessary or legally required for the administration or enforcement of justice; is required to establish, exercise or defend a right in judicial proceedings; or is required to maintain or perform the legal relationship between BCF and you.

6. Retention periods

Your personal data will be kept for as long as necessary to fulfill the purposes described and the applicable legal obligations, as follows:

• Contact data with no engagement: up to 24 months from the last contact.

• Newsletter subscribers' data: for as long as the subscription remains active.

• Client data: for the duration of the engagement and, after it ends, for the five-year period set forth in Article 30 of the Mexican Federal Tax Code (Código Fiscal de la Federación) for tax documentation, or any longer period applicable under that article or other provisions.

• Browsing data: up to 24 months.

Once those periods expire, BCF will block and delete the data in accordance with Article 10 of the Law.

7. How to exercise your ARCO rights

You or your legal representative may at any time exercise your rights of access, rectification, cancellation or opposition (known in Mexico as "ARCO rights"), and revoke your consent, by sending a request to info@bcflaw.mx. Under Article 28 of the Law, your request must include:

1. Your name and address, or another means to receive notifications.

2. Documents evidencing your identity or, where applicable, the identity and authority of your representative.

3. A clear and precise description of the personal data regarding which you wish to exercise an ARCO right, except in the case of the right of access.

4. A description of the ARCO right you wish to exercise, or of what you are requesting.

5. Any other information or document that helps us locate your personal data.

BCF will inform you of its decision within a maximum of twenty business days from the date it receives your request and, if the request is granted, will carry it out within fifteen business days after informing you of the decision. These periods may be extended once for an equal period when the circumstances of the case justify it (Article 31 of the Law). Our response will be sent to the email address from which we received your request, or to any other means you indicate.

Exercising your ARCO rights is free of charge; only the costs of reproduction, copies or shipping may be charged (Article 34 of the Law).

If you believe your request was not handled in accordance with the Law, you may file a data protection request with Mexico's Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the authority responsible for overseeing compliance with the Law under its Article 38, within fifteen business days after you receive our response, or after the response period expires if you do not receive one (Article 40 of the Law).

8. Cookies and similar technologies

This website uses technical cookies, which are necessary for it to function and to remember your cookie preferences, and analytics cookies, which provide statistical information on how the website is used. Analytics cookies remain disabled until you accept them in the cookie banner, and you can reject them or change your choice at any time from that banner or from your browser settings.

Analytics cookies are managed by Google (Google Analytics), which receives the browsing data described in Section 2 and processes it under its own privacy policies.

9. Changes to this Privacy Notice

BCF may amend this notice to reflect legal reforms or changes in its services or internal practices. Any changes will be published on this page with the date of the last update. When a change is material, such as a new purpose or a new transfer that requires your consent, you will also be notified through the contact details you have provided.

10. Language

This Privacy Notice is available in Spanish and English. In case of any discrepancy, the Spanish version shall prevail.