COMPREHENSIVE PRIVACY NOTICE AND AUTHORIZATION FOR THE USE OF IMAGE AND VOICE

In compliance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares – “LFPDPPP”) and other applicable regulations, Saving our Sharks, A.C. (hereinafter referred to as the “ORGANIZATION” or the “ASSOCIATION”) hereby informs you, through this document, about the characteristics, purposes, and procedures applicable to the processing of your personal data held by Saving our Sharks, A.C.

I. IDENTITY AND ADDRESS OF THE DATA CONTROLLER

The “ORGANIZATION” is a Civil Association duly incorporated under the laws of the United Mexican States, with registered address at:

Calle Coral SM 009 M 055, int. L008-L012-L019, Isla Mujeres, Quintana Roo, ZIP Code 77400, Mexico

Email: admin@savingoursharks.org

Telephone: +52 9981959176.

The ORGANIZATION hereby informs you of its Personal Data Protection Policy in compliance with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), and advises that your personal data, including sensitive personal data, whether currently collected or collected in the future, shall be processed and/or used by the ORGANIZATION, its collaborators, and/or third parties who, by virtue of the nature of their work or functions, are required to process and/or use your personal data.

II. PERSONAL DATA WE COLLECT AND USE

This Privacy Notice is general in nature and applies to all personal data processing activities carried out by the ORGANIZATION.

The personal data listed below, together with the sensitive personal data described in Section III, may be collected, including but not limited to, depending on the legal relationship or type of interaction maintained with the ORGANIZATION, whether as employees, service providers, donors (individuals or legal entities), partners, volunteers, project participants, scholarship recipients, or any other persons related to the fulfillment of the institutional purposes of the ORGANIZATION.

The personal data we may collect, depending on the nature of the data subject, include:

RECRUITMENT CANDIDATES / EMPLOYEES / SERVICE PROVIDERS

Identification and Physical Data

  • Full name
  • Valid official identification (voter ID card, passport, professional license, or immigration document for foreign nationals)
  • CURP (Unique Population Registry Code)
  • Tax Status Certificate
  • Social Security Number
  • Date of birth
  • Social Security registration/affiliation
  • Birth certificate
  • Nationality

Contact Information

  • Telephone number
  • Email address
  • Proof of address
  • Name, telephone number, and relationship of emergency contact
  • Name, Tax ID (RFC), telephone number, and relationship of beneficiary

Academic and Professional Information

  • Position/function
  • Curriculum vitae or employment history
  • Professional license
  • References and performance evaluations
  • Handwritten and/or electronic signature
  • Supporting documentation for hiring purposes

DONORS (INDIVIDUALS)

Identification and Physical Data

  • Full name
  • Valid official identification (voter ID card, passport, professional license, or immigration document for foreign nationals)
  • Federal Taxpayer Registry (RFC)
  • CURP

Contact Information

  • Telephone number
  • Email address
  • Address

Donation-Related Information

  • Amount
  • Date
  • Donation method
  • Payment receipts/reference numbers
  • Donation history

DONORS (LEGAL ENTITIES, TRUSTS, GOVERNMENT ENTITIES, AS APPLICABLE) / PARTNERS

Data of Natural Persons

  • Full name of:
    • Legal representative
    • Associates, partners, shareholders, or attorneys-in-fact
    • Board members
    • Beneficial owners
    • Other individuals appearing in the documentation
  • Position of the legal representative
  • Copy of the articles of incorporation of the legal entity
  • Copy of the power of attorney granted to the legal representative
  • Date of birth of the legal representative and beneficial owners
  • Identification documents of the legal representative and beneficial owners (voter ID card, passport, professional license, immigration document for residents, tax status certificate, and proof of address)

Contact Information

  • Email address
  • Telephone number
  • Tax address

VOLUNTEERS

Identification and Physical Data

  • Full name
  • Valid official identification (voter ID card, passport, professional license, or immigration document for residents)
  • Age
  • Date of birth
  • CURP

Contact Information

  • Email address
  • Telephone number
  • Address
  • Name, telephone number, and relationship of emergency contacts

Academic and Professional Information

  • Skills
  • Interests
  • Availability
  • Curriculum vitae, employment history, or prior experience
  • Language(s)
  • Professional license

PROJECT PARTICIPANTS (BENEFICIARY OR USER POPULATION)

Identification and Physical Data

  • Full name
  • Valid official identification (voter ID card, passport, professional license, or immigration document for residents)
  • Age
  • Gender
  • CURP

Contact Information

  • Email address
  • Telephone number
  • Address

Project Management Information

  • Attendance and participation
  • Activity results
  • Evaluations
  • Reports

Academic and Professional Information

  • Educational background
  • Occupation
  • Institutional affiliation
  • Interests
  • Language(s)

Financial Information

  • Banking information (partial or complete), including:
    • Bank card details for payments (bank, account number and/or interbank CLABE, as well as payroll/service fee information)
    • Credit/debit card information for recurring donations (cardholder name, card number, expiration date, and CVV)
    • Copy of the bank account statement cover page (CLABE, account number, account holder name, transactions performed)

Such information shall be safeguarded under strict security measures.

Express Consent

If, after granting your express consent, you do not wish your financial or patrimonial personal data to be collected or processed for the purposes established herein, you may express your refusal by sending an email to admin@savingoursharks.org or by submitting a written request to our address.

The information provided must be truthful and complete. Therefore, you are responsible for the accuracy of the data provided, and under no circumstances shall the ORGANIZATION be liable in this regard.

Any information provided directly through our website https://www.savingoursharks.org, mobile application, or email shall be subject to the provisions of this Privacy Notice.

III. SENSITIVE PERSONAL DATA TO BE COLLECTED

Sensitive personal data refers to data affecting the most intimate sphere of the data subject, or whose improper use may lead to discrimination or entail a serious risk.

The ORGANIZATION may collect only the following sensitive personal data:

Health Data

  • Alcohol or substance consumption
  • Mental health status
  • Medical history
  • Chronic conditions
  • Allergies
  • Blood type
  • Medical treatments

Other Sensitive Personal Data

  • Photograph
  • Gender
  • Indigenous languages spoken
  • Political affiliations

If you do not wish your sensitive personal data to be processed for the purposes set forth herein, you may express your refusal pursuant to the mechanisms established in Section VII of this document.

IV. PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

Your personal data shall be used for the following primary purposes:

Recruitment Candidates / Employees / Service Providers

  • Conduct recruitment procedures
  • Create employment or service provider files
  • Internal administrative management, activity control, and operational communication
  • Compliance with legal and tax obligations (payroll/service fees, accounting support, audits)
  • Payments/transfers and tax/accounting verification

Donors

  • Registration and management of donations and issuance of receipts or invoices (including tax-deductible receipts where applicable)
  • Institutional communication: acknowledgments, activity reports, donor reports
  • Compliance with accounting, tax, audit, and anti-money laundering obligations

Volunteers

  • Registration and management of participation (calls, assignment of activities, attendance control)
  • Communication and follow-up
  • Security and logistical organization during activities, where applicable

Project Participants

  • Registration, operation, monitoring, and evaluation of social or community intervention/research activities
  • Preparation of technical and administrative project reports (including reports to funders/donors), prioritizing aggregated or anonymized data whenever possible
  • Operational communication (calls, reminders, follow-up) when required by the project

Other Common Purposes

  • Identify, locate, and contact you
  • Send communications, invitations, calls, acknowledgments, reports, or other information
  • Comply with legal, tax, and contractual obligations
  • Register, issue, and deliver tax receipts and donation certificates
  • Manage administrative, labor, accounting, or audit processes
  • Follow up on services, collaborations, requests, or support
  • Conduct surveys and evaluations of our services and programs
  • Carry out statistical analyses and internal reports
  • Register the participation of volunteers and scholarship recipients, ensuring safety and logistical organization during activities
  • Implement new programs and plans
  • Coordinate and channel support with allied organizations, public institutions, and donors when necessary to provide benefits, services, or programs related to the corporate purpose of the ORGANIZATION

In all cases, we shall endeavor to collect only the data strictly necessary for the aforementioned purposes. Whenever possible, identification numbers, codes, and anonymization methods shall be used.

Secondary Purposes

Additionally, your information may be used for:

  • Sending newsletters, news, invitations to events, or campaigns
  • Dissemination of institutional activities and promotion of achievements or objectives
  • Evaluating the quality of the services we provide
  • Carrying out advertising and promotional activities

If you do not wish your data to be processed for secondary purposes, you may notify us by email at admin@savingoursharks.org or by written request submitted to our address.

V. HOW DO WE COLLECT YOUR DATA?

Personally

When data subjects complete forms to access our services or make donations.

Directly

When data subjects provide personal data through email, telephone, instant messaging services (WhatsApp), SMS services, social networks (Facebook, Instagram, among others), or through our website or digital forms.

Indirectly

When a third party provides us with the personal data of another individual. For example, when a representative of the organization where the user works shares the data of persons accessing the services offered by the ORGANIZATION, or when beneficiary and/or emergency contact information is provided.

VI. DATA TRANSFERS

Your personal data may only be shared in the following cases:

  • With Civil Society Organizations with which the ORGANIZATION enters into contracts, collaboration agreements, or alliances, for the purpose of managing and monitoring activities related to such agreements.
  • With Santander Mexico S.A., Institución de Banca Múltiple, Grupo Financiero Santander Mexico, for the management of donations and payments to employees and service providers.
  • With COEO Asesores, David Jesús Kuyoc Escamilla, and BTM Mérida, for accounting, invoicing, tax compliance, anti-money laundering obligations, and audits.
  • With PayPal and Stripe, for the processing of donations and payments through the banking information provided.
  • With the Tax Administration Service (SAT) and the Government of the State of Quintana Roo, for issuance of electronic tax invoices (CFDI), tax returns, withholding obligations, audits, identity/tax verification, and accounting retention obligations.
  • With other competent tax or administrative authorities such as the Mexican Social Security Institute (IMSS) and the National Workers’ Housing Fund Institute (INFONAVIT), only when legally required.

If you do not object to transfers requiring your consent, your consent shall be deemed granted.

However, your consent shall not be required when:

  • The transfer is provided for by law or international treaty;
  • It is necessary for medical prevention, diagnosis, healthcare, treatment, or health services management;
  • It is made to controlling companies, subsidiaries, or affiliates operating under the same internal processes and policies;
  • It is necessary pursuant to a contract entered into in the interest of the data subject;
  • It is legally required for public interest or the administration of justice;
  • It is necessary for the recognition, exercise, or defense of a right in judicial proceedings; or
  • It is necessary to maintain or fulfill a legal relationship between you and the data controller.

VII. EXERCISE OF ACCESS, RECTIFICATION, CANCELLATION, AND OPPOSITION RIGHTS (ARCO RIGHTS)

You have the right to access your personal data held by us, request rectification or cancellation thereof, or object to its processing (ARCO Rights). You may also limit the use and disclosure of your personal data and revoke your consent, pursuant to Articles 27 through 34 of the LFPDPPP.

Requests may be submitted through:

  • Email: admin@savingoursharks.org
  • Address: Calle Coral SM 009 M 055, int. L008-L012-L019, Isla Mujeres, Quintana Roo, ZIP Code 77400, Mexico.

Your request must include:

  • Full name
  • Contact information
  • Documents evidencing identity or legal representation
  • Clear description of the right you wish to exercise

We shall respond within a maximum period of twenty (20) business days. If applicable, the request shall be executed within the following fifteen (15) business days.

Rights Protection Procedure

If the data subject believes that their ARCO rights have been violated, they may file a Rights Protection request before the Ministry of Anti-Corruption and Good Governance (Secretaría de Anticorrupción y Buen Gobierno).

The request must be filed within fifteen (15) business days following the unsatisfactory response of the data controller, or after the legal response period has elapsed without a response.

The Ministry may request additional evidence and must issue a resolution within a maximum of fifty (50) business days, extendable once for justified reasons.

VIII. SECURITY MEASURES

Personal data shall be protected through strict administrative, technical, and physical security measures to guarantee confidentiality, integrity, and availability, and to prevent damage, loss, alteration, destruction, or unauthorized use.

In the event of a security breach significantly affecting the rights of data subjects, the ORGANIZATION shall immediately notify affected individuals.

Such notification shall include:

  • A brief description of the incident and estimated date/time
  • Categories of compromised data
  • Possible consequences and associated risks
  • Corrective and containment measures adopted
  • Practical recommendations for mitigation
  • Contact information of the ORGANIZATION

Notifications shall preferably be made via email.

The ORGANIZATION shall maintain internal records of incidents and corrective actions implemented.

IX. SELF-REGULATION

The data controller may voluntarily adhere to binding self-regulation schemes regarding personal data protection with individuals, legal entities, civil organizations, or governmental entities, whether national or international, to complement legal provisions.

Such schemes may include codes of ethics, best practices, trust seals, or other mechanisms establishing standards for proper personal data processing.

The ORGANIZATION shall inform data subjects regarding the terms, scope, and complaint mechanisms of any applicable self-regulation scheme.

For more information, please contact: admin@savingoursharks.org

X. CHANGES TO THE PRIVACY NOTICE

This Privacy Notice may be modified or updated at any time. Any modifications shall be available at our facilities and/or on our website: https://www.savingoursharks.org/

Changes shall be communicated through:

  • Email notification to the registered email address of the data subject; and/or
  • A prominent notice on our website indicating the effective date and a link to the updated Privacy Notice.

XI. AUTHORIZATION FOR THE USE OF IMAGE AND VOICE

The ORGANIZATION is a non-profit entity and may accept donations of images, photographs, and videos from amateurs, photographers, and other individuals for educational purposes.

Likewise, the ORGANIZATION and/or any related organizations or entities may capture, reproduce, or publish photographs, videos, or other media including the image and voice of signatories in videos, magazines, brochures, badges, advertisements, websites, social media, promotional campaigns, training sessions, academic events, meetings recorded for documentation purposes, and other promotional or marketing materials deemed appropriate for dissemination and promotion in fulfillment of the corporate purpose of the ORGANIZATION.

This authorization shall remain in force until a written request objecting to the capture, dissemination, or use of such image and voice is submitted via email to: admin@savingoursharks.org

XII. CONTACT INFORMATION

If you have any questions or comments regarding this PRIVACY NOTICE AND AUTHORIZATION FOR THE USE OF IMAGE AND VOICE, or if you wish to exercise your ARCO Rights, please contact:

Saving our Sharks, A.C.

  • Address: Calle Coral SM 009 M 055, int. L008-L012-L019, Isla Mujeres, Quintana Roo, ZIP Code 77400, Mexico
  • Email: admin@savingoursharks.org
  • Telephone: +52 9981959176

XIII. EXPRESS CONSENT

We hereby inform you that your personal data, financial or patrimonial personal data, and sensitive personal data shall be safeguarded under strict security measures. Likewise, data transfers shall be conducted under strict security standards.

The ORGANIZATION’s website may contain links to third-party websites over which the ASSOCIATION has no control. In such cases, the ORGANIZATION assumes no responsibility regarding the privacy policies of such websites.

By browsing the ASSOCIATION’s website, you acknowledge that you have read, understood, and agreed to the terms set forth herein.

Acceptance of the privacy notice and image/voice authorization checkboxes through your IP address (“Internet Protocol”) and web browser shall constitute express consent.

☐ I grant my consent for my personal data, sensitive personal data, and financial/patrimonial data, if requested, to be processed and transferred in accordance with this Privacy Notice.

Name of the Data Subject: ____________________________

Signature: ____________________________

Last updated: February 2026