Privacy Notice

CORPORACIÓN EDUCATIVA ANDURIÑA, S. C., with its registered office at Av. Emilio G. Baz, No. 51, Colonia Independencia, Naucalpan de Juárez, State of Mexico, ZIP Code 53830, hereby informs you that, in accordance with applicable regulations—specifically the Federal Law on the Protection of Personal Data Held by Private Parties and its Regulations—regarding the personal information in our possession that has been provided directly and/or by the student’s representative(s) in each case, for the purpose of controlling its processing and for the exercise of the rights of Access, Rectification, Cancellation, and Objectionwith respect to such information (“ARCO Rights”), we hereby provide the following information:

For the purposes of this notice, the following terms are defined as follows:

• Holder(s): The student, as well as the person(s) exercising parental authority and/or the person who, if applicable, serves as the student’s legal guardian.

• Database.—A collection of physical and/or electronic records containing the personal data of the student, the person(s) exercising parental authority, and/or the person exercising legal guardianship over the student, in each case, integrated and safeguarded by administrative, technical, and physical security measures.

• Data Administrator—Mr. Francisco Javier Zaragoza Flores, in his capacity as the person responsible for the administration and protection of personal data, in accordance with the provisions of this Privacy Notice.

• Authorized disclosure of personal information: The student's name , as well as the courses, academic programs, and/or academic years completed, exclusively for institutional and academic accreditation purposes.

• Sensitive personal data.—Under the terms of the Law, sensitive personal data is defined as data whose misuse could give rise to discrimination or pose a serious risk to the data subject, such as: racial or ethnic origin; current or future health status; genetic information; religious, philosophical, or moral beliefs; union membership; political opinions; and sexual preferences.

• ARCO Rights—Under the terms of the Regulations of the Federal Law on the Protection of Personal Data Held by Private Parties, these refer to the rights of access, rectification, cancellation, and objection.

• Processing.—The collection, use, disclosure, transfer, and/or storage of personal data in any form, in accordance with the provisions of this Privacy Notice and the purposes set forth therein.

• Emergencies: Extraordinary situations that require immediate medical and/or hospital care to safeguard the student’s physical well-being and health.

I. Purpose of the Privacy Notice 

The purpose of this Privacy Notice is to inform the subjects of Personal Data of the main characteristics of the processing to which their personal information will be subjected, in accordance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties and its Regulations, specifying that such information may not be used for any purpose other than the protection and proper handling of said Personal Data.

II. Categories of Personal Data Subject to Processing

To fulfill the purposes set forth in this Privacy Notice, the Data Controller may collect and process the following categories of personal data:

1. Identification information: Full name, official identification number, marital status, sex, signature, photograph, date and place of birth, nationality, and address.
2. Contact information: Landline and/or cell phone number, email address, and, if applicable, social media username.
3. Family Information: Information regarding parents, guardians, or legal representatives (name, date and place of birth, marital status, phone number, occupation, educational degree, voter registration number, and signature), as well as spouses, children, and siblings, to the extent strictly necessary for academic and administrative purposes.
4. Academic information: Grade level, previous school, academic record, transcripts, courses, languages, and accredited programs or academic years.
5. Sensitive personal data: As defined by law, this includes data that could lead to discrimination or pose a serious risk, such as: racial or ethnic origin; current or future health status; medical history; diagnoses; allergies; ongoing treatments; genetic information; religious, philosophical, or moral beliefs; union membership; political opinions; and sexual preferences. Such data will be processed only when it is essential to safeguard the student’s physical well-being and to provide appropriate care in emergency situations.

III. Purpose of the Processing of Personal Data.

The Data Controller will process the personal data collected for the purpose of complying with the legal, administrative, and academic obligations arising from the relationship with students and their parents or guardians. Such processing includes, but is not limited to, identification for the purposes of instruction, accommodation, care, and, where applicable, assistance for the student; the preparation and safekeeping of academic and administrative records; the issuance of official, tax, and billing documents; as well as the full identification of the person(s) exercising parental authority or guardianship over the student.

The personal data provided will be incorporated into electronic and/or physical systems and databases, which will be subject to administrative, technical, and physical security measures to ensure their confidentiality, integrity, and availability, and access will be restricted solely to authorized personnel. Additionally, additional data generated by the company itself may be incorporated, but this will not include information from unauthorized third parties.

Transfers of personal data to the Data Controller’s contractors (for the purposes of accounting, auditing, collection assistance, administrative management, or other similar purposes) will be made on the understanding that such contractors assume the same obligations set forth in this Privacy Notice. The transfer of personal information to third parties other than partners will only take place with the data subject’s express consent, except in the cases provided for by law.

The data subject may at any time restrict or expand the use of their personal data in accordance with the authorizations they grant, under the following terms:

1. A) You fully authorize the use and disclosure of your personal data, except for sensitive data.
2. B) Authorizes the use and disclosure to third parties of only your name and contact information.

1. C) It does not authorize the disclosure of your data to any third party, except to the Data Controller’s partners in accordance with the terms of this Privacy Notice.

IV. Sensitive Data

Sensitive personal data regarding the student and the person(s) exercising parental authority and/or legal guardianship over the student will not, at any time, be used for commercial purposes or disclosed without the data subject’s express consent. Such data will be treated at all times with strict confidentiality and used solely for purposes directly related to the provision of educational and administrative services and authorized dissemination.

Personal information may be provided only in cases of medical emergency or by express order of a competent authority, and always in accordance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties.

By means of this Privacy Notice, authorization is hereby granted for the processing of sensitive data in accordance with the principles of consent, information, quality, purpose, fairness, proportionality, and accountability, and CORPORACIÓN EDUCATIVA ANDURIÑA, S.C. is hereby exempt from liability for any misuse of the information that occurs outside the circumstances provided for herein.

V. ARCO Rights

The rights to access, rectify, delete (as applicable), and object to the processing of personal data may be exercised by requesting an appointment via email at avisodeprivacidad@miraflores.edu.mx. To this end, the data subject and/or their legal representative will be required to appear in person with documentation proving their identity and representation in order to review, modify, and/or express their wishes regarding their personal information and its processing.

If the request is solely to access the personal data stored in the database, the information will be available for that purpose for a maximum period of twenty (20) business days, beginning on the date the appointment is scheduled, at the address indicated in this Notice. If the inquiry is made after that period and the file has been archived, it will be necessary to schedule a new appointment.

Once the student has completed the school year(s), the personal information (except for data authorized for disclosure) pertaining to the student and the person(s) exercising parental authority and/or legal guardianship will be blocked; and in the event of the student’s permanent withdrawal, it may be permanently deleted from the database.

Personal information may only be provided in person or through electronic means made available on the institutional website by filling out the appropriate form. No personal data may be collected through channels other than those established herein.

Any changes to the terms of this Privacy Notice will be posted on the institution’s website, will be available at the Data Controller’s address, and, if a contact email address has been provided, will also be notified via that means.

VI. Means of Exercising ARCO Rights

As long as the student is a minor, the person(s) exercising parental authority and/or legal guardianship over the student may exercise the ARCO rights on the student’s behalf, provided they duly prove their identity with official, verifiable documents. These rights may be exercised by submitting a written request addressed to the Data Controller via email at avisodeprivacidad@miraflores.edu.mx, and such requests will be handled in accordance with applicable legal provisions.

The request must include, at a minimum: (i) the data subject’s full name, (ii) a copy of a valid official identification document or, where applicable, documents proving legal representation, (iii) a clear and precise description of the personal data regarding which the right is being exercised, and (iv) a means of receiving notifications. The Data Controller will respond within a maximum of twenty (20) business days from the date of receipt of the request, in accordance with the provisions of the Law.

As mentioned in the previous section, once the student has completed the school year(s), personal information (except for data authorized for disclosure) will be blocked to ensure its secure storage and, in the event of permanent withdrawal, permanently deleted from the databases, unless there is a legal obligation to retain it for an additional period.

Likewise, the data subject or his or her representative may at any time request the revocation of previously granted consent or the restriction of the use or disclosure of his or her personal data through the same means indicated in this section, without this affecting the lawfulness of any processing carried out prior to such request.

Any changes to the procedures for exercising ARCO rights will be communicated in a timely manner through the Data Controller’s official communication channels.

VII. Notification of Changes to the Privacy Notice

The Data Controller may modify, update, or supplement this Privacy Notice at any time to reflect changes in legislation, regulations, or its internal practices. Any modifications will be communicated to data subjects through: (i) publication on the institutional website avisodeprivacidad@miraflores.edu.mx; (ii) visible notices at the Data Controller’s address; and (iii) notification to the email address provided by the data subject, when available.

The data controller shall manage and, where appropriate, respond to inquiries regarding such updates. When the changes involve new purposes that require consent, such consent shall be obtained in advance, explicitly, and on an informed basis before proceeding with the processing. The date of the last update to this Notice will appear at the end of the document.