Cacheaux, Cavazos & Newton, LLP, together with its affiliates (collectively, “CCN,” the “Firm,” “we,” or “us”), is committed to protecting your privacy. This Privacy Policy outlines how we handle your personal data in connection with the websites that link to it (collectively, the “Site”), as well as in the course of providing our legal services and fulfilling our contractual obligations, and sets forth the terms and principles under which we will process your personal data to ensure the protection of your privacy and your right to informational self-determination in compliance with applicable laws.

CCN is the data controller in relation to any personal information that the Firm processes about you and is responsible for ensuring that such processing complies with applicable data protection laws.

Carefully read this Privacy Notice in its entirety.

By visiting, accessing, registering with, subscribing to, or using the Site or any services provided by CCN, you are deemed to have accepted and agreed to the most recent versions of CCN’s Cookies Policy. Continued use of the Site or any related services constitutes your ongoing acceptance of, and agreement to, these terms.

As used herein, the term “personal information” means any information that relates to an identified or identifiable individual (e.g., name, physical address, telephone number, email address). In contrast, “non-personal information” refers to any information that does not qualify as personal information under applicable laws, including anonymized data.

1. Information Collected

In order to carry out the purposes described in this Privacy Notice, we may collect and process the following categories of personal and non-personal information from you in the course of business, including through your use of the Site, when you contact or request information from us, when we provide services to you or receive services from you. The specific categories of information collected may vary depending on how you interact with us, with the Site and its features:

• Personal identification data, including full name, gender, title, job title and address.

• Contact information, including your phone number(s), email address and social media account.

• Financial data, including bank account information, invoicing details and billing history.

• Information related to event registration, webinars and mailing lists, including preferences, interests, subscriptions, downloads, and login credentials.

• Job applicant data, including identification and contact information, curriculum vitae and other data provided by you or third parties (g., recruiters) via our website, recruitment portals, or offline methods, which may be subject to additional local rules depending on the job location.

• Data required for legal and regulatory compliance, including data and information required for “know your client”, anti-money laundering, and beneficiary ownership regulations, or as part of our client onboarding process, which may include passport or other identification data, date of birth, home address, and other due diligence information.

• Service related data, including personal information related to the provision or receipt of services, involving any of your employees, customers or vendors, and client feedback.

• Cookies and device data, including information about your device and browser such as IP address, device ID, operating system, browser type, cookie data, and hardware/software characteristics; interactions with third-party platforms like LinkedIn, Microsoft Teams, Zoom, YouTube, Spotify, and X (formerly Twitter); as well as data regarding the Site and videoconference platforms usage, such as number of viewers, time spent, viewing preferences and history, language and title choices, favorites, streams, downloads, demographics, and closed captioning selections. This information is used to ensure the Site security, support proper functionality of the Site and videoconference platforms, and analyze usage patterns.

We do not knowingly request or collect sensitive personal information, such as information relating to racial or ethnic origin, religious beliefs, sexual orientation or preferences, political opinions, genetic or biometric data, precise geolocation data or other similar information that may be defined as sensitive personal information under applicable laws and we request that you do not send us any such information.

2. How Personal Information Is Collected

Generally, you are not required to provide personal information to browse or access our Site. However, if you choose to contact us through the “Contact Us” page, we will ask for your name, email address, and your inquiry. You may also reach out to us voluntarily via phone or email. In all such cases, the personal data collected is used solely to fulfill the purpose for which it was provided.

During the course of an engagement, or while considering one, we may collect and process personal or financial data related to clients, prospective clients, their affiliates, or relevant personnel. We also may maintain information generated as a result of the legal services provided or received from third parties.

Furthermore, we may obtain information from publicly available sources (such as government databases) and from third parties, including clients, other law firms, service providers, and marketing partners.

Cookies 

Our Site uses certain tracking technologies—including tags, log files, and similar tools provided by third parties (collectively, “Cookies”)—to enhance user experience. These technologies may store your preferences, track your activity, and help the Site recognize your browser or device on subsequent visits.

For more information about the specific Cookies we use and how you can manage or delete them, please refer to our Cookies Policy.

 

3. Use of Information

We may process your personal information for the purposes outlined below, based on the following legal grounds:

• Provision of Legal Services.- We use personal information you provide voluntarily through our Site or during our engagement to deliver our legal services and perform our contractual obligations. This may involve sharing information with third parties including accountants, notary publics and other professional advisors to effectively represent your interests, as well as utilizing cloud-based software and tools from third-party providers. The processing of this information is necessary for us to fulfill our contractual obligations to you.

• Administration of Client and Vendor Relationships.- We process identification data, contact details, financial information, and other service data to manage invoices, update client records, and maintain vendor relationships. The processing of this information is necessary for us to fulfill our contractual obligations to you.

• Responding to Inquiries.- We use identification, contact and service related data to address your questions and requests. The processing of this information is necessary for us to fulfill our contractual obligations to you and supports our legitimate interest in maintaining effective communication and relationships with our clients.

• Marketing and Event.- We utilize Cookies, as well as identification, contact, device and mailing list data to send you marketing communications, newsletters, reports, articles, and invitations to events that may be of interest to you. The processing of this information is based on our legitimate interest in promoting our services, providing relevant information and maintaining client engagement.

• Website Improvement.- We collect Cookies and device data to enhance the functionality and user experience of our Site and/or its content. The processing of this information is based on our legitimate interest in continuously monitoring and improving our online presence and services.

• IT Systems and Security.- We process identification, contact, financial, device, and service data to protect the security and confidentiality of your information, as well as to prevent unlawful activities such as fraud. The processing of this information is necessary for us to fulfill our contractual obligations to you, and ensure the security and confidentiality of your data.

• Recruitment.- We may collect and process personal data of job applicants to screen, evaluate, and identify suitable candidates, maintain recruitment records, analyze hiring outcomes, and conduct background checks where permitted by law. If hired, your information will be transferred to employee records for employment purposes. The processing of this information is necessary for us to assess your application and, if appropriate, extend a job offer.

• Protect Rights and Properties.- We may collect and process personal data to protect or enforce CCN’s respective rights and properties, and/or protect or enforce the rights and properties of others (which may include you).

• Compliance with Legal and Regulatory Requirements.- We use identification, contact, financial, device, regulatory compliance data and other applicable personal data to meet legal and regulatory obligations applicable to our firm.

 

4. Information Sharing

We will not sell any of your personal information to any outside organization. We only disclose your personal information to third parties as is reasonably necessary to carry out the permitted uses described in this Privacy Policy.

We may share your personal information with the following categories of recipients:

• Other entities within CCN, including CC&N Abogados, S.C., to provide legal services and administer any related services provided to you.

CCN is an international law firm with offices and affiliated entities located in the United States and Mexico. A complete list of our offices and affiliates can be found at https://ccn-law.com/en/offices. Your personal information may be transferred to, or accessed by, one or more of CCN’s offices or affiliated entities through our shared computer networks, including those located in jurisdictions that may not offer data protection standards equivalent to those in your own country. Nonetheless, all of our offices adhere to the same procedures with respect to your personal information, including this Privacy Policy and our Cookies Policy.

• Professional advisors and other third parties engaged in the course of services we provide to our clients, including local counsel, accountants and notary publics, who support the delivery of our services and help manage our relationship with you.

• Third-party vendors and service providers that act as data processors, handling your personal information on our behalf and in accordance with our written instructions. These may include IT service providers, financial institutions, customer relationship management platforms, cloud-based tools, companies providing business analytics and marketing support, and third-party venues used for events. All such vendors are contractually required to process your data securely and only as instructed.

• We may disclose your personal information to law enforcement, regulatory, or other governmental authorities when required to comply with applicable laws, legal processes, or official requests, such as subpoenas, court orders, or investigations, whether civil or criminal. Such disclosures may also be made to safeguard the public interest, support the administration of justice, or to recognize, exercise, or defend legal rights in judicial or administrative proceedings.

• Additionally, we may share personal information with law enforcement, regulatory, and other governmental authorities, as well as with relevant third parties, when we reasonably believe that not doing so could expose the Firm to legal liability, or to protect the rights, property, or safety of the Firm, our clients, or others, in accordance with applicable laws and regulations.

• We may also share personal information with our successors in the event of a sale, merger acquisition or similar transaction affecting the relevant portion of our business.

We reserve the unrestricted right, but not the obligation, to use or share non-personal information in any manner, as such information does not identify you and is not subject to the same privacy limitations as personal data.

Also, please note we are not responsible for the privacy practices, policies, or content of any external websites linked on our Site. We recommend reviewing the privacy and security policies of each site you visit.

5. Data Retention

Your personal information is only stored and retained for as long as necessary to fulfill the purposes outlined in this Privacy Policy. In determining the appropriate retention period, we take into account the nature and duration of our relationship with you, the type of services provided, and any potential impact on our services if the information were to be deleted. In certain cases, we may retain personal information for a longer period as required by applicable law, to establish, exercise, or defend legal claims, or for other legitimate business purposes, including archiving or historical record-keeping.

We reserve the right to dispose of or delete personal or non-personal information at any time, unless otherwise required by law or specified in a separate agreement executed between you and CCN.

6. Security

CCN has implemented appropriate technical, physical and organizational security measures designed to protect your personal information against unlawful destruction or accidental loss, damage, alteration, unauthorized disclosure or access, as well as other forms of unlawful processing.

While we take all reasonable precautions to safeguard your data, we cannot guarantee the security of information transmitted over the internet. Please be aware that email is not a secure communication channel and should not be used to transmit confidential or sensitive information.

7. Your Privacy Rights

Subject to applicable law, you may have several rights regarding the processing of your personal information, including the following:

• Access: You have the right to confirm whether we are processing your personal information and to request a copy of the personal data we hold about you.

• Correction: You may request the correction of any inaccurate or incomplete personal information we maintain.

• Deletion: You can request the deletion of your personal information in certain circumstances, for example, if it is no longer necessary for the purposes for which it was collected, or if you withdraw your consent (where applicable).

• Objection: You have the right to object to, limit or restrict the use and processing of your personal information where the legal ground of such processing is not necessary for legitimate interests pursued by us or by a third party.

We will comply with such requests unless we can demonstrate legal grounds to continue the processing.

• Withdrawal of Consent: If our processing is based on your consent, you may withdraw it at any time, except in cases where such processing is necessary to provide our legal services and/or where we are required or authorized to do so by applicable law.

• Marketing Opt-Out: You may withdraw your consent to receive marketing communications at any time.

 

California Privacy Rights

In addition to the rights described above, if you are a California resident, you may have additional rights under the California Consumer Privacy Act (“CCPA”), subject to certain exceptions. These rights may include:

• Right to Know: You have the right to request and receive the following information covering the 12 months prior to your request: (i) the categories of personal information we have collected about you; (ii) the sources from which we collected this information; (iii) the business or commercial purposes for which your information was collected, shared, or sold; (iv) the categories of third parties with whom we have disclosed your personal information; and (v) the specific pieces of personal information we have collected about you.

• Right to Data Portability: Upon receiving a verifiable and valid request, we will provide your personal information free of charge, either by mail or electronically. If provided electronically, the information will be delivered in a portable and, to the extent technically feasible, readily usable format that allows you to easily transfer it to another entity.

• Right to Non-Discrimination: You have the right to be free from discrimination or retaliation by us for exercising any of your privacy rights under the CCPA.

We do not use or disclose sensitive personal information for purposes other than those specified in Section 7027(m) of the implementing regulations of the CCPA.

How to Exercise Your Rights

You may exercise your privacy rights at any time, either directly or through an authorized agent, by submitting a written request to: privacy@ccn-law.com, or to the following physical address: Convent Plaza, 333 Convent Street, San Antonio, Texas 78205.

To verify your identity, we may ask for supporting documents such as a government-issued ID and a recent utility bill. If you authorize someone else to act on your behalf, we may require you to: (i) provide a signed authorization for that person, (ii) verify your own identity directly with the Firm, and (iii) confirm directly with the Firm that you gave the authorized person permission to submit the request.

Mexico Privacy Rights

As a data owner, you may have specific legal rights under Mexican data privacy laws. For more information, please refer to the “Mexico Addendum” section below.

8. Marketing Choices

We may send you direct marketing messages, including email alerts and postal mail, only when we have a lawful basis to do so. If you no longer wish to receive these communications, you can opt out at any time by clicking the unsubscribe link in the message or by contacting us at: privacy@ccn-law.com.

9. No Selling or Sharing of Personal Information with Third Parties

CCN will not sell your personal information to any external organization. We only share your information with third parties when necessary to perform the uses described in this Privacy Policy.

10. No Automated Decision-Making

We do not use automated decision-making or profiling tools to process your personal information.

11. Minors

Except as otherwise specified in this Privacy Policy, we do not knowingly collect or process sensitive personal information or information from children under the age of 16 without the consent of a parent or legal guardian, unless we are required or authorized to do so by applicable law.

We encourage parents and/or guardians to take an active role in the online activities of their children. If we become aware that any personal information constitutes sensitive personal information or has been provided by a children under the age of 16 contrary to the provisions of this Privacy Policy, we will promptly delete such personal information. If a child under 16 has provided personal information without parental or guardian consent, the parent or guardian may contact us at the addresses provided in Section 14 below. Upon verification, we will remove the information and unsubscribe the child from any electronic marketing lists.

12. Changes to the Privacy Policy

We regularly review and update our Privacy Policy, especially if there are changes in our operations or applicable laws. Any updates will be posted on our Site, with the most recent update date indicated below. We encourage you to review this Privacy Policy periodically to stay informed about how we handle and process your personal information.

If we make significant changes to how we process your data, we will notify you via a notice on our Site homepage, or through other permitted communication methods.

13. Severability

The provisions of this Privacy Policy are severable and in the event that any provision of this policy is held to be invalid, the validity and enforceability of the remaining provisions shall not be adversely affected; in the understanding that if such provision is modified so that it becomes valid and enforceable under the law, such provision shall be deemed to be modified to make it valid and enforceable to the maximum extent permitted by the applicable laws.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us at privacy@ccn-law.com, using “Privacy Policy” as the subject line. Please note that this contact information may be updated periodically through amendments or modifications to this Privacy Policy.

Last Updated: August 27, 2025

MEXICO ADDENDUM

1. Mexico Privacy Rights

As data owner you may have specific legal rights granted by the Mexican Personal Data Protection Federal Law (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and its Regulations (Reglamento de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares) (jointly, the “LFPDPPP”) relating to the personal information we obtain and process about you.

2. ARCO Rights

In accordance with the LFPDPPP, you have the following data protection rights (“ARCO Rights”):

• Access Right (Derecho de Acceso): You have the right to know what personal information we hold on you and for what purpose it is being used, and to access such personal information. It will be deemed that access to your personal information has been granted when it is made available to you, regardless of the medium or format used.

• Rectification Right (Derecho de Rectificación): You have the right to rectify your personal information when it is inaccurate or incomplete, provided that it is not impossible or requires disproportionate efforts.

• Cancellation Right (Derecho de Cancelación): You have the right to request that we eliminate from our records and databases your personal information when not used in accordance with the principles, requirements and obligations set by the LFPDPPP. The cancellation entails the cessation of processing by the data controller, starting with the blocking of the relevant personal information and the subsequent deletion thereof.

• Opposition Right (Derecho de Oposición): You have the right to oppose to the processing of your personal information for legitimate reasons and specific purposes, except when such personal information is necessary to comply with our legal obligations or provide our services.

• Right to Withdraw Consent (Derecho a Revocar tu Consentimiento): Where you have given consent for the processing of your personal information, you may withdraw or revoke your consent at any moment with effect for the future. However, please note that this will only proceed in certain cases in accordance with the provisions of applicable laws and this Privacy Policy, and that in some cases your consent is not required and we may not immediately stop using the personal information, as we may require such to comply with legal obligations or are otherwise allowed to process such personal information under applicable law. The revocation of consent will not have retroactive effects and cannot prevent us from fulfilling our obligations. Also, you should consider that withdrawing your consent may result in the impossibility of continuing to provide the services you required or even the termination of our legal relationship.

3. ARCO Request

You may exercise these ARCO Rights either directly or through your legal representative, by submitting a written request (“ARCO Request”) to: privacy@ccn-law.com, or to the following physical address: Av. Tecamachalco #14, Floor 5, Col. Lomas de Chapultepec, Mexico City, Mexico 11000.

CCN will process and respond to your ARCO Requests in accordance with the terms, procedures, and timeframes established under the LFPDPPP. To be processed, your request must include and be accompanied by the following: (i) the full name of the data owner, and their email or other contact information to communicate the response to their ARCO Request; (ii) documents that prove the data owner’s identity and that of their legal representative, if applicable (simple copy in printed or electronic format of their voter identification card or passport, and if applicable, a simple copy in printed or electronic format of the public deed or corresponding power of attorney of their legal representative, along with a copy of their respective voter identification card or passport); (iii) a clear and precise description of the ARCO Rights you wish to exercise, and the personal information to which these rights apply; (iv) any other element or document that may facilitate locating the relevant personal information; and (v) in the case of a ‘rectification’ request, such request must specify the modifications or amendments to be made and provide the documentation justifying such modifications or amendments (where applicable).

4. Consent

The processing of your personal information will be carried out in accordance with this Privacy Policy. From the moment you: (i) use the Site and/or any of its subsites; or (ii) directly provide us with your personal information, including through our printed or digital formats, via email or telephone, through the use of the Site or any of our subsites, and/or through the use of professional platforms or social networks (e.g., LinkedIn), it is understood and assumed that you are aware of this Privacy Policy and grant your consent for the processing and transfer of your personal information in accordance with it, without prejudice to the fact that such authorization or consent may be granted or evidenced through any other forms or means.

If you have any questions about this Privacy Policy and/or its Mexico Addendum, or if you wish to limit the use and/or disclosure of your personal information, please contact us at privacy@ccn-law.com, using “Privacy Policy” as the subject line. Please note that this contact information may be updated periodically through amendments or modifications to this Privacy Policy.

Last Updated: August 27, 2025