CARTON.COM: The new way of doing business in the packaging industry.

PRIVACY POLICY

Thank you for accessing www.carton.com (hereinafter, CARTON.COM) of which CARTON MACHINERY ASIA S.A. de C.V. is the company responsible for the processing of your personal data, domiciled in Av. Paseo Monte Miranda No.17 ORVIT BUSINESS CENTER Piso 5 Fracc. Monte Miranda 76240 El Marqués, Querétaro, Mexico. 

In CARTON.COM, every day we work to serve you better and better when you place an auction, bid or use our services. Taking care of the Personal Data you share with us is a fundamental part of this. Therefore, we want you to be sure that your information is protected and protected with us and know how we use it to provide you with a better and more personalized customer experience when you use our services.

This Privacy Notice explains our processing of your Personal Data, to whom, under certain conditions, we transfer and/or transmit your Personal Data, as well as the security measures we have taken to protect it. It also explains the rights you have as the Owner of your Personal Data and how you can exercise it.

We invite you to read this Privacy Notice in detail and if you have any questions, we ask that you please contact us by emailing [email protected], or by phone (442) 5000-445 or send a communication to Av. Paseo Monte Miranda No.17 ORVIT BUSINESS CENTER Piso 5 Fracc. Monte Miranda 76240 El Marqués, Querétaro, Mexico.

I.DEFINITIONS

Seller: Physical or moral person who "offers" a specific product, based on an "auction" published by the buyer.

Buyer: A natural or moral person who by posting an "auction" seeks to purchase a product with certain characteristics; (images, logos, marks, color combinations, structures, designs and other elements that distinguish it.) through an offer by sellers.

CARE CHANNELS: Means through which you can exercise your rights, which are through (i) email [email protected], (ii) or directly on Av. Paseo Monte Miranda No.17 ORVIT BUSINESS CENTER Piso 5 Fracc. Monte Miranda 76240 El Marqués, Querétaro, Mexico. or on the phone (442) 5000-445

CARTON.COM OR RESPONSIBLE: CARTON MACHINERY ASIA S.A. de C.V.

PERSONAL DATA: Any information concerning an identified or identifiable natural person. For example, CARTON.COM may collect the following Personal Data: name, identification number, address, telephone, email, geolocation data, website usage and visitation, browsing history and shopping habits.

SENSITIVE PERSONAL DATA: Sensitive data means data that affect the most intimate area of the USER, or whose misuse could give rise to discrimination or pose a serious risk to it. Sensitive data are considered, those that may reveal aspects such as racial or ethnic origin, present and moral health status, trade union membership, opinions, policies, sexual preference, etc.

Consent: Manifestation of the will of the USER of the data by which the processing of the data is carried out.

TREATMENT MANAGER: A natural or moral person, public or private, who, by himself or in conjunction with others, performs the Processing of Personal Data on assistance of the controller of Personal Data.

RESPONSIBLE FOR TREATMENT: A natural or moral person, of a private nature, who decides on the basis of data and/or the processing of data.

User: A natural person whose personal data are subject to Processing.

PROCESSING OF PERSONAL DATA: The collection, use, disclosure or storage of personal data, by any means. The use covers any action to access, manage, use, transfer or disposition of personal data.

II.AUTHORIZATION

By agreeing to this Privacy Policy, you CARTON.COM to process your Personal Data.

CARTON.COM will only process your Personal Data when you have your Authorization and only for the purposes indicated in section V of this document. You may revoke your authorization at any time by requesting it through any of the means listed in Section VIII.

III.TRANSFER OF PERSONAL DATA TO THIRD PARTIES

In addition, by accepting this Privacy Notice, you authorize CARTON.COM to share your Personal Data with The Related Companies and the CARTON.COM SELLER or BUYER as the case may be and to have them processed for the purposes set out in Section V. However, at any time, as a USER, you may revoke the authorization granted or object to the sending of commercial communications, requesting it by any of the means indicated in Section VIII.

Also, in the event of choosing the winner of the SUBASTA, you authorize CARTON.COM transfer to the SELLER the databases containing your Personal Data.

Other than the Privacy Notice, CARTON.COM may not disclose your Personal Data to third parties unless you have previously obtained your consent or are required to do so by law.

CARTON.COM shall be responsible for the effective fulfilment of the obligations relating to the Processing of Personal Data by its Related Companies and its SELLERS or BUYERS, without prejudice to their liability for any breach of such obligations. Similarly, in the event that the Processing of Personal Data is to be carried out by companies providing services for CARTON.COM, such provider companies must make confidentiality commitments and take measures that ensure proper compliance with the regulations of protection of Personal Data, in particular those established in the Federal Law on the Protection of Personal Data in Possession of Individuals and its Regulations.

IV. GENERAL PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA.

Our commitment is to ensure that all Processing of Personal Data that we carry out is always done in compliance with the rights that the Constitution and the laws grant it. Therefore, we want to make known the principles that move us in this matter:

PRINCIPLE OF LAWFULNESS: Personal data must be collected and processed lawfully. The collection of personal data should not be done through misleading or fraudulent means.

PRINCIPLE OF CONSENT: All Processing of Personal Data will be subject to the consent of THE USURIO. Consent shall be express where the will is expressed verbally, in writing, by electronic, optical or any other technology or by unequivocal signs. The USER has ancibly consenting to the processing of his/her data, when the privacy notice has been made available to him/her, he/she does not express his/her opposition.

PRINCIPLE OF INFORMATION: The Controller of Personal Data shall have the obligation to inform the USER of the Personal Data the information that is collected from them and for what purposes through the privacy notice.

QUALITY PRINCIPLE: The Data Controller will ensure that the personal data contained in the databases are relevant, correct and up-to-date for the purposes for which they were received.

PRINCIPLE OF PURPOSE: The Processing of Personal Data should be limited to the fulfillment of the purposes provided for in the privacy notice. If the controller intends to process the data for a purpose other than that that is not compatible or analogous to the purposes set out in the Privacy Notice, it will be necessary to obtain the user's consent again.

PRINCIPLE OF LEALTAD: It implies that the Processing of Personal Data must be carried out in a fair and tender way, that is, with full compliance with the legality and respect of the good faith and the rights of the USER, whose information is subject to Processing.

PRINCIPLE OF PROPORTIONALITY: The Data Controller shall only use the User's Personal Data, in accordance with the express purposes of the collection.

PRINCIPLE OF LIABILITY: The Data Controller shall ensure compliance with the principles of protection of Personal Data established by the Federal Law on the Protection of Data in Possession of Individuals, and must take the necessary measures for its application, even if they are processed by a third party at the request of the controller. The controller of personal data, must take the necessary and sufficient measures to ensure that the privacy notice disclosed to the USER, is respected at all times by him or by third parties with which he has any legal relationship.

CARTON.COM will be responsible for the effective fulfillment of the obligations related to the processing of the data by its Related Companies, without prejudice to the liability that comes with them for any breach of such obligations. Similarly, in the event that the data processing is to be carried out by companies providing services for CARTON.COM or its Related Companies, such service providers must make confidentiality commitments and take measures to ensure proper compliance with the obligations of the Data Protection Act.

V. PURPOSES FOR WHICH YOUR PERSONAL DATA MAY BE PROCESSED.

Your Personal Data may be processed by CARTON.COM, its Related Companies or through its suppliers, exclusively to:

  • Make the relevant arrangements for the development of the social object of CARTON.COM in terms of the fulfillment of the object of the contract concluded with the USER.
  • Comply with obligations with the USER.
  • To provide the Personal Data to third parties with whom CARTON.COM has a contractual relationship and that it is necessary to give it to them for the fulfillment of the contracted object. For example, CARTON.COM may use third parties to help you collect your payments, ship products, or operate our customer service systems.
  • Prepare, implement, promote and offer you new items and/or services, or new attributes, modalities or features to the items and/or services that are already available to you.
  • Automatically complete documents associated with transactions you make based on items and/or services purchased, or purchased in the future, in CARTON.COM and/or its Related Companies.
  • Develop commercial actions or after-sales services, of a general nature or personally addressed to you, aimed at improving your customer experience.
  • Send information via physical mail, email, text messages (SMS and/or MMS), digital media such as Facebook, or "WhatsApp" or other similar platforms, to the cell phone number or media you provide to us, to send you the following information to verify your Personal Data; and to send information about the SELLER chosen through the SUBASTA.
  • Share Personal Data with third parties that have the quality of Commercial Partners and Related Companies so that they can offer articles and /or services that allow to improve the offer of value intended for customers of CARTON.COM, all of the above in accordance with the provisions of the Federal Law on the Protection of Personal Data in Possession of Individuals.
  • Transfer personal data outside or within the country to Related Companies so that they can process their Personal Data in accordance with the purposes enshrined in this Policy, in accordance with the provisions of section V thereof.
  • Transmit Personal Data within or outside the country to third parties in accordance with section III of this policy.

VI. RIGHTS OF THE USER OF PERSONAL DATA IN ACCORDANCE WITH THE FEDERAL LAW ON THE PROTECTION OF PERSONAL DATA IN POSSESSION OF INDIVIDUALS.

The USER of Personal Data shall have the following rights:

  • ARCO Rights (Access, Rectification, Cancellation and Opposition) of your Personal Data.
  • Request proof of the authorization granted to CARTON.COM for the processing of your Personal Data
  • Be informed by CARTON.COM, upon request, in accordance with section VII of this Policy, regarding your use of your Personal Data.
  • Submit inquiries to the controller or Processor, in accordance with numeral 3 of this policy, and file complaints with the National Institute of Transparency, Access to Information and Protection of Personal Data.
  • Access for free the Personal Data that are processed in the terms of article 22 of the Federal Law on the Protection of Personal Data in Possession of Individuals.
  • Revoke the authorization granted for the processing of Personal Data.

The USER of the Personal Data shall have a duty to keep his/her information up to date and to guarantee, at all times, the veracity of the information. CARTON.COM shall not be liable, in any case, for any liability arising from the inaccuracy of such information.

VII. PROCEDURE FOR THE EXERCISE OF ARCO RIGHTS IN ACCORDANCE WITH THE FEDERAL LAW ON THE PROTECTION OF PERSONAL DATA IN POSSESSION OF INDIVIDUALS.

You may exercise the rights indicated in the preceding numeral and all other rights conferred by the Federal Law on the Protection of Personal Data in Possession of Individuals, by contacting CARTON.COM via email [email protected], or by telephone (442) 5000-445, or by sending a communication to Av. Paseo Monte Miranda No.17 ORVIT BUSINESS Piso CENTER 5 Fracc. Monte Miranda 76240 El Marqués, Querétaro, Mexico. The Management of Legal Affairs and Governance will be responsible for issuing the guidelines for the attention of requests, queries and complaints before which the USER can exercise his rights to know, update, rectify and delete the Personal Data and revoke the authorization of Processing of Personal Data.

ARCO Rights

In the event that you wish to exercise arco rights (access, cancellation, rectification and opposition to the processing of your personal data) or revoke the consent you have given to CARTON.COM, for the processing of your Personal Data that they rest in our databases, you must contact CARTON.COM through the Service Channels and generate the request for consultation of Personal Data. For the above, it is necessary that at the time of generating the request, (a) Send the documents proving the identity of the USER or the personality of the representative, (b) The name and address of the USER, (c) The clear and precise description of the Personal Data for which the USER seeks to exercise any of the rights, (d) The express manifestation to revoke his/her consent to the processing of his/her personal data and therefore , so that any other elements or documents that facilitate the location of Personal Data are not used. If the USER's request for Personal Data is unclear, erroneous or incomplete, CARTON.COM may ask the USER to provide additional information to respond to his request within five (5) business days of receipt of the request, if the USER does not respond within ten (10) business days of the request for additional information will be taken as not submitted his request.

CARTON.COM shall communicate to the USER, via email or any means it deems appropriate, within a maximum period of twenty (20) working days from the date of receipt of the user the determination adopted, so that, if appropriate, it will be effective within fifteen (fifteen) working days from the date on which the response is communicated. Where it is not possible to attend the consultation within the terms set out in the previous paragraph, the above deadlines may be extended only once for equal periods and this situation will be communicated to the USER, indicating the reasons for the delay and indicating the date on which their query will be attended.

Claim for rectification, cancellation or opposition of Personal Data

In the event that you wish to file a claim for rectification, cancellation or opposition of Personal Data you must contact CARTON.COM through the Service Channels and CARTON.COM will respond to your request in the same terms as the previous section of this instrument.

If you represent, by any of the Service Channels, that you do not wish to receive advertising, CARTON.COM will proceed to make its request effective within twenty (20) business days from receipt of the request. In this way, you will receive an email confirming the deletion of your Personal Data from the advertising databases of CARTON.COM. Additionally, you will be asked to confirm whether you want your account deleted CARTON.COM. The USER will have a term of five (5) business days from the sending of the mail to make such confirmation. In the event that the USER confirms that he/she wants his/her CARTON.COM account to be deleted, or that after five (5) days he/she does not respond to such email, CARTON.COM, in order to comply with current regulations on the protection of personal data, he/she will proceed to delete his/her account within five (5) working days.

The deletion of the CARTON.COM account will result in the deletion of all your Personal Data, causing the loss of your entire HISTORY of SUBASTAS as well as any other personal information that CARTON.COM owns the USER.

The request for opposition of the information and the revocation of the Consent will not proceed when there is a legal, contractual or commercial duty, for you to remain in our database.

VIII. COOKIES AND YOUR USE BY CARTON.COM

In CARTON.COM we use cookies and similar technologies to personalize and improve your customer experience and to show you relevant online advertising.

Cookies are small text files that contain a unique identifier that is stored on the computer or mobile device through which you access the Site, so that those may be recognized each time you use the Site.

You may choose to disable at any time some or all of the cookies we use. However, this may restrict your use of the Site and limit your experience on the Site. The use of cookies does not contain or affect Personal Data and does not pose a danger of viruses. For more information about cookies, please go to http://www.allaboutcookies.org. For information on the deletion of cookies visit the website webhttp://www.allaboutcookies.org/manage-cookies/index.html.

IX. CARTON.COM IS NOT RESPONSIBLE FOR THIRD PARTY SITES ADVERTISING ON THE SITE

To improve your customer experience, the Site may contain third-party advertising and links to other sites or frames on other sites. Please note that CARTON.COM is not responsible for the privacy or content practices of such third parties or sites, so you should review their privacy policies.

X. SAFEGUARDS YOU TAKE CARTON.COM TO PROTECT YOUR PERSONAL DATA

CARTON.COM maintains the physical, electronic and procedural safeguards required by legal regulations in relation to the collection, storage and transfer of your Personal Data and evaluates its effectiveness on a regular basis. The purpose of these safeguards is to prevent unauthorized or illegal access or accidental loss, destruction or occurrence of damage to your Personal Data.

Therefore, when CARTON.COM collects data from the Site, it does so through a secure server that has protection programs. In addition, the security procedures of CARTON.COM require that you are sometimes asked for proof of identity before you can provide information about your Personal Data. For electronic payment card information, CARTON.COM also uses Secure Socket Layer (SSL) encryption systems that encode the information avoiding fraudulent uses. While it is not possible to guarantee the above, these systems have proven effective in handling reserved information by preventing access to external threats (i.e. hackers). Notwithstanding the foregoing, we recommend that you do not send unencrypted credit or debit card data or from public or unsafe sites or computers. Please note that you are solely responsible for protection against unauthorized access to your password and computer.

XI. EFFECTIVE AND MODIFICATION OF THIS PRIVACY POLICY.

This policy will apply from January 28, 2021 and your Personal Data will remain stored only for as long as required by Law, or for the fulfillment of the purposes that have been authorized by you.

This policy may be modified by CARTON.COM at any time. Notwithstanding the foregoing, CARTON.COM shall inform you, by any means deemed appropriate, of any material changes prior to such modification being effective.