PRIVACY NOTICE OF KRETO
In compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada, applicable privacy laws of the United States of America (USA), the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) of the United Mexican States, and other applicable provisions, KRETO, with domicile in Vancouver, British Columbia, Canada, hereby issues the present Privacy Notice under the following terms and conditions:
I. IDENTITY AND ADDRESS OF THE DATA CONTROLLER
KRETO, with domicile located in Vancouver, British Columbia, Canada, acting as the responsible party for the processing of personal data (hereinafter referred to as “the Data Controller”), informs the data subject (hereinafter referred to as “the Data Subject”) that their personal data shall be collected and processed in accordance with the purposes and terms set forth herein.
II. DEFINITION OF PERSONAL DATA
For the purposes of this Privacy Notice, personal data shall be understood as any information concerning an identified or identifiable natural person, excluding business contact information, such as name, title, business address, business telephone number, and business email address, when used for business communication.
III. PERSONAL DATA COLLECTED
The Data Controller may collect, directly or indirectly, through its website or other means of communication, the following categories of personal data from the Data Subject:
Identification data, including full name, nationality, and date of birth; contact data, including email address, telephone number, and postal address; financial data, including income level, credit history, and purchasing capacity; documentation data, including copies of valid passports or government-issued identifications, as well as proof of address; purchasing preference data, including the type of property of interest, preferred location, and price range; and technical data, including IP address, operating system, browser type, time zone, and data derived from cookies and tracking technologies.
The Data Controller shall not collect sensitive personal data, except in those cases in which it is strictly necessary to comply with applicable legal obligations, particularly those related to Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF).
IV. PURPOSES OF DATA PROCESSING
The personal data of the Data Subject shall be processed by the Data Controller for the following purposes:
A) Primary Purposes: To provide advisory and support services in real estate transactions involving properties located in the United Mexican States; to verify the identity and financial capacity of the Data Subject; to comply with contractual, legal, and regulatory obligations, including AML/CTF requirements; and to facilitate communication between the Data Subject and third parties involved in such transactions, such as real estate agents, legal advisors, and financial institutions.
B) Secondary Purposes: Subject to the express consent of the Data Subject, personal data may be used to send commercial information related to properties, services, events, or promotions offered by the Data Controller, as well as to conduct surveys, market research, and statistical analyses.
In the event that the Data Subject does not consent to the processing of their personal data for the secondary purposes described above, they may express their refusal by submitting a request in accordance with the procedure established in Clause VII of this Privacy Notice.
V. TRANSFER OF PERSONAL DATA
The Data Controller may transfer the personal data of the Data Subject, without requiring their consent, to:
i) Business partners, real estate agents, legal advisors, and financial institutions located in the United Mexican States, when such transfer is necessary for the fulfillment of the purposes described in Clause IV of this Privacy Notice;
ii) Technology service providers, including customer relationship management (CRM) platforms, cloud storage providers, email services, and analytics services, located in Canada, the USA, the United Mexican States, or other jurisdictions that ensure an adequate level of data protection in accordance with applicable legislation; and
iii) Competent authorities, when required to comply with legal obligations, particularly those related to AML/CTF.
The Data Controller guarantees that any transfer of personal data shall be subject to appropriate measures to ensure its confidentiality and security.
VI. COMPLIANCE WITH AML/CTF OBLIGATIONS
In accordance with applicable Canadian, U.S., and Mexican legislation, the Data Controller may request additional documentation from the Data Subject for the purpose of complying with AML/CTF obligations. Such documentation may include, but shall not be limited to, official identification documents, proof of address, and information regarding the lawful source of funds involved in real estate transactions.
The Data Subject acknowledges that refusal to provide such information may result in the inability of the Data Controller to provide the services described herein.
VII. RIGHTS OF THE DATA SUBJECT
The Data Subject shall have the right to access, rectify, cancel, or oppose the processing of their personal data (ARCO rights), in accordance with the provisions of the LFPDPPP, as well as the right to access and correct their personal data under the PIPEDA and relevant U.S. privacy regulations.
To exercise these rights, the Data Subject shall submit a written request to the Data Controller via the email address hello@mexicopropertiesbykreto.com, including their full name, the specific right they wish to exercise, a clear description of the personal data involved, and a copy of valid government-issued identification.
The Data Controller shall respond to such request within a period not exceeding twenty (20) business days, counted from the date of receipt of the request, in accordance with applicable legislation.
VIII. WITHDRAWAL OF CONSENT
The Data Subject may revoke their consent for the processing of their personal data for the secondary purposes described in Clause IV, at any time and without retroactive effect, by submitting a request in accordance with the procedure established in Clause VII of this Privacy Notice.
The Data Subject acknowledges that the withdrawal of consent for primary purposes may affect the provision of services by the Data Controller.
IX. LIMITATION OF LIABILITY REGARDING THIRD-PARTY DATA
In the event that the Data Subject provides personal data of third parties, the Data Subject represents and warrants that they have obtained the prior, express, and informed consent of such third parties, and that they have informed them of the contents of this Privacy Notice. The Data Controller shall not be held liable for any unauthorized processing of third-party data provided without consent.
X. SECURITY MEASURES
The Data Controller shall implement and maintain appropriate administrative, technical, and physical security measures to safeguard personal data against damage, loss, alteration, destruction, or unauthorized access or disclosure. These measures shall include, but shall not be limited to, secure storage systems, restricted access controls, and encryption protocols, in accordance with the applicable regulatory framework.
XI. USE OF COOKIES AND TRACKING TECHNOLOGIES
The Data Controller informs the Data Subject that its website, www.mexicopropertiesbykreto.com/privacy, uses cookies and other tracking technologies to enhance user experience, analyze website traffic, and provide personalized content. The Data Subject may disable the use of cookies through their browser settings, although such action may affect certain functionalities of the website.
XII. JURISDICTION AND APPLICABLE LAW
This Privacy Notice shall be governed by the laws of Canada, the United States of America, and the United Mexican States, as applicable to the nature of the processing and the location of the Data Subject.
Any disputes arising from the interpretation or enforcement of this Privacy Notice shall be submitted to the competent courts of the Province of British Columbia, Canada, the State of (appropriate state based on location) USA, or the City of Mérida, Yucatán, United Mexican States, as applicable. The parties expressly waive any other jurisdiction to which they may be entitled by reason of present or future domicile.
XIII. MODIFICATIONS TO THE PRIVACY NOTICE
The Data Controller reserves the right to modify or update this Privacy Notice at any time, for the purpose of reflecting changes in applicable legislation, internal policies, or services provided. Any modifications shall be made available to the public through the website www.mexicopropertiesbykreto.com/privacy. The continued use of services provided by the Data Controller after such modifications shall be deemed as acceptance thereof.
LAST UPDATED: April 2025.