Data Subject Rights (ARCO)

1 What are ARCO rights?

Under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), every individual whose personal data is processed has the right to exercise four fundamental data subject rights, known collectively as ARCO:

These rights are personal and non-transferable. They may only be exercised by the data subject or their duly authorized legal representative.

2 Access

You may request a copy of all personal data we hold about you. In response, we will provide:

• The personal data we process
• The purposes for which it is processed
• The source from which it was collected
• Third parties to whom it has been disclosed
• The legal basis for processing

We will deliver the information in a clear and legible format by email within the legally required timeframe.

3 Rectification

If your personal data is inaccurate, incomplete, or out of date, you may request that we correct or update it. Please include with your request:

• Which data you believe is incorrect and why
• Supporting documentation where applicable (e.g., official ID, updated contact information)

We will notify you of any changes made or explain why a correction cannot be made.

4 Cancellation

You may request deletion of your personal data. The right to cancellation is subject to certain limitations under the LFPDPPP:

• Data may not be deleted while a contractual or legal obligation requires its retention
• Participation records (attendance, certificates) may be retained by the organizing institution for its own record-keeping obligations
• Accounting and tax records must be kept for the periods required by Mexican law

When cancellation is not immediately possible, we will place the data in a blocking period (período de bloqueo) during which it is not actively used, until it can be deleted. We will inform you of the applicable retention period.

5 Opposition

You may object to the processing of your personal data for specific purposes. Common grounds for opposition include:

• Receiving commercial or promotional communications
• Processing for secondary or optional purposes described in our Privacy Policy
• Any processing that causes legitimate harm and for which there is no overriding legal basis

Opposition to processing that is strictly necessary to provide the contracted service may result in service termination.

6 How to submit a request

Send your ARCO request to our privacy office:

Your request must include:

Requests submitted without sufficient information to verify your identity may not be processed. We will inform you within 5 business days if additional information is required.

7 Response timelines

Right	Acknowledgement	Resolution	Extension (if applicable)
Access	5 business days	20 business days	+20 business days
Rectification	5 business days	20 business days	+20 business days
Cancellation	5 business days	20 business days	+20 business days
Opposition	5 business days	20 business days	+20 business days

Extensions are permitted by law when the volume or complexity of the request justifies it. We will notify you before any extension takes effect. All timelines run from the date a complete, valid request is received.

8 Rights for event participants

If you are a participant in an event organized by an institution that uses Attendae (not an institutional administrator), please note the following:

• The institution that organized the event is the Data Controller for your attendance records and personal data collected during registration.
• Attendae acts as a Data Processor on behalf of that institution.
• For rights related to attendance records, certificates issued, or your participation data, you should direct your request to the organizing institution in the first instance.
• For rights related to data that Attendae processes in its own capacity (platform access logs, verification records), you may submit your request directly to privacidad@attendae.com.

Attendae will cooperate with institutions to fulfill participant ARCO requests and will assist institutions in responding within the required timeframes under the Data Processing Agreement (DPA).

9 Escalation to INAI

If you believe your ARCO request was improperly denied, partially fulfilled, or not responded to within the legal timeframes, you have the right to file a complaint with:

Filing a complaint with INAI does not require prior exhaustion of a formal complaint with Attendae, though we encourage you to contact us first so we can address your concern directly.