Comprehensive Privacy Notice: CIMA Business Center

Last updated:

1. Identity and address of the data controller

CIMA STRATEGY MX, S.A.S. DE C.V., operating under the trade name CIMA Business Center (hereinafter, “CIMA” or “the Controller”), located at Blvd. García de León 1035, Int. 28, Piso 5, Col. Chapultepec Sur, C.P. 58260, Morelia, Michoacán, Mexico, is responsible for processing your personal data in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on March 20, 2025 (the “Law”), and other applicable regulations.

This notice applies to the data we collect through the website https://www.cimacenter.mx, the online store and the “My account” section, the management system, our WhatsApp, telephone, email and social media channels, as well as in person at our premises and events.

Privacy contact: corporativo@cimacenter.mx · Tel. (443) 314 0667 · Monday to Friday, 9:00 a.m. to 7:00 p.m.

2. Personal data we process

Depending on your relationship with us (prospective customer, customer, member, supplier, visitor or event attendee), we may process the following categories of data:

  • Identification: full name, signature, photograph of a valid official identification document and, where applicable, CURP.
  • Contact: email address, landline and/or mobile number, WhatsApp number and address.
  • Tax and billing: RFC, legal business name, tax regime, postal code and tax address, tax status certificate and CFDI use.
  • Business and professional: company name, business activity, position, website and professional social media accounts; for legal entities, articles of incorporation and the legal representative’s power of attorney.
  • Financial and payment: transaction details (amount, date, payment method and reference). Complete bank card details are processed directly by the payment provider; CIMA does not store them.
  • Correspondence: recipient’s name, sender and details of parcels or correspondence received in your name (CIMA does not open correspondence unless you expressly instruct us to do so).
  • Image and voice: images captured by the video surveillance system at our premises; photographs and videos taken at events, networking activities and masterclasses.
  • Access and use of services: username and password for “My account” and the ERP (stored in encrypted form), room and office booking history, check-in and check-out records and registered guests.
  • Technical browsing data: IP address, browser and device type, operating system, pages visited and identifiers associated with cookies and similar technologies.

Sensitive personal data: CIMA does not collect or process sensitive personal data (for example, racial or ethnic origin, health status, religious beliefs, political opinions, sexual preferences or biometric data). Please do not provide such data through any channel.

Third-party data: if you provide us with other people’s data (for example, guests, coworkers or recipients of correspondence), you declare that you have obtained their consent and informed them of this notice.

3. Purposes of processing

3.1 Necessary purposes (your consent is not required)

These purposes are essential to the legal relationship you establish with CIMA or to compliance with legal obligations:

  1. Respond to requests for information, quotations and visits scheduled through forms, telephone, WhatsApp or email.
  2. Contract, activate, renew and administer memberships (Virtual Office, Classic, Gold and Platinum) and additional services (meeting rooms, private offices, day passes, events and podcasts).
  3. Create and administer your user account and manage bookings, access and guests.
  4. Provide commercial and/or tax address services, as well as receive, safeguard and notify you of correspondence and parcels.
  5. Process payments, issue digital tax receipts (CFDI) and collect outstanding amounts.
  6. Maintain the safety and security of people, property and premises through access control and video surveillance.
  7. Compile your customer file and follow up on the contractual relationship, clarifications, complaints and technical support.
  8. Update the database.
  9. Any purpose analogous to or compatible with the purposes above.
  10. Comply with legal obligations and respond to requests from competent authorities.

3.2 Purposes requiring your consent

Additionally, with your consent, we will process your data to:

  1. Send you promotions, newsletters and invitations to events, masterclasses and networking activities.
  2. Conduct satisfaction surveys and market research.
  3. Publish your name, company, logo and professional details in the digital member directory, the “Spotlight” section and CIMA’s internal screens (depending on your membership).
  4. Use photographs and videos featuring you, captured at events, for publication on CIMA’s website and social media accounts.
  5. Show you personalized advertising on third-party platforms (for example, Meta/Facebook and Instagram) based on your browsing activity on our website.
  6. Invite you to join the CIMA Community.

3.3 How can you object to the purposes in section 3.2?

You may express your objection by emailing corporativo@cimacenter.mx with the subject line “Negativa de finalidades privacidad”, stating your name and the purposes to which you object. Your objection will not be grounds for denying you the services you contract with us. CIMA will not process your data for purposes other than those stated in this notice without first obtaining your consent.

4. Disclosures to processors and data transfers

To fulfill the purposes above, CIMA relies on providers that process data on our behalf and under our instructions (processors), including hosting and website providers, the payment gateway, an authorized CFDI certification provider, Google services (Calendar, Drive and OAuth 2.0 authentication), Meta Platforms (WhatsApp, Facebook, Instagram and Meta Pixel) and the platform for the CIMA Community. Some of these providers may store information outside Mexico.

CIMA does not sell or rent your personal data. It may only disclose your data to third parties without your consent in the circumstances provided for by the Law, such as when necessary to fulfill the contract entered into with you or to comply with a legal mandate or a request from a competent authority (for example, the Servicio de Administración Tributaria).

Google integration: CIMA’s use of information obtained through Google APIs is limited to synchronizing calendars, storing files and authenticating users, and complies with the Google API Services User Data Policy, including its Limited Use requirements. You may revoke these permissions at any time through your Google account’s security settings.

5. ARCO rights and withdrawal of consent

You have the right to Access your personal data, Rectify it if it is inaccurate or incomplete, request its Cancellation when you consider that it is no longer required for any of the stated purposes, and Oppose its processing for specific purposes (ARCO rights). You may also withdraw the consent you have given us, provided that no legal or contractual obligation prevents this.

Procedure: email your request to corporativo@cimacenter.mx or submit it in writing at our address, providing:

  1. The data subject’s name and a means of communicating our response.
  2. A copy of your official identification document and, where applicable, your representative’s identification and the document establishing their authority to represent you.
  3. A clear description of the right you wish to exercise and the data concerned.
  4. Any document or information that helps locate your data and, for rectification requests, documentation supporting the change.

We will respond within a maximum of 20 business days from receipt of your complete request; if the request is granted, we will implement it within the 15 business days following our response. These periods may be extended once for an equal period when circumstances justify it. The response and provision of information are free of charge, except for justified shipping or reproduction costs.

If you believe your right to personal data protection has been violated, you may contact the Secretaría Anticorrupción y Buen Gobierno, the competent authority in this matter.

6. Options to limit the use or disclosure of your data

In addition to the mechanisms above, you may: (a) request inclusion in our internal exclusion list by writing to corporativo@cimacenter.mx to stop receiving promotional communications; and (b) register with the Registro Público para Evitar Publicidad (REPEP) of the Procuraduría Federal del Consumidor (Profeco).

7. Use of cookies and tracking technologies

Our website uses cookies, pixels and similar technologies to maintain your account session and shopping cart, remember preferences, obtain usage statistics, and measure and personalize advertising through the Meta pixel (Facebook/Instagram). The data obtained includes IP address, browser and device type, pages visited, browsing time and online identifiers.

You can disable or delete cookies through your browser settings and manage your advertising experience through your Meta account’s ad settings. If you disable technical cookies, some website functions (such as the shopping cart or “My account”) may not work correctly.

8. Security measures and retention

CIMA maintains administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing. These include transmission encryption (SSL/TLS), encrypted passwords, access restricted to authorized personnel and periodic backups.

We will retain your data only for the time necessary to fulfill the stated purposes and for the periods required by applicable legal provisions (for example, tax and commercial provisions). Video surveillance recordings are retained for [30] calendar days, unless required for an investigation or legal proceeding.

9. Changes to this privacy notice

This notice may be modified due to changes in the law, our services or our privacy practices. Any changes will be published at https://www.cimacenter.mx/politica-privacidad/ with the last updated date. When a change is significant, you will also be notified by email.