Full privacy notice

1. Identity and address of the data controller

The controller of your personal data is [CFSM: completar razón social exacta y RFC], referred to in this document as “CFSM”: an independent investment bank specializing in mergers and acquisitions and corporate finance.

• Address for the purposes of this notice: [CFSM: completar domicilio fiscal]
• Offices: Prolongación Paseo de la Reforma 215, suite 1002, Corporativo Infiniti, Col. Paseo de las Lomas, 01330, Mexico City.
• Area responsible for personal data: [CFSM: completar el área o la persona designada para atender solicitudes de datos personales]
• Contact: write to us at malonzo@cfsm.com.mx —you can also open your email client from this link— or visit our offices during business hours. [CFSM: confirmar qué cuenta institucional atenderá las solicitudes de datos personales; si se abre una cuenta dedicada, sustituirla aquí y en el apartado 8]
• Website: cfsm.com.mx

This notice covers the processing of personal data that takes place through cfsm.com.mx and the contact channels offered there. [CFSM: confirmar si este aviso debe cubrir también los datos de clientes y contrapartes en mandatos de M&A, o si existe un aviso separado para la relación contractual]

2. Personal data we collect

We only process the data you provide directly through the site's forms, plus the technical records your visit generates. We do not buy databases and we do not obtain your data from third-party sources.

• Contact form. Name, email address, the services you want to discuss and the message you write.
• Careers form. Name, email address, phone number (optional), the position you are applying for, your message and, if you choose to attach it, your CV in PDF, DOC or DOCX format. The file also carries the career data it contains: education, employment history, certifications and anything else you have included.
• Newsletter subscription. Your email address and, where applicable, the name you register with.
• Technical visit data. IP address, country of connection, browser and device (user agent), and the date and time of your submission. We log these for security, to prevent automated abuse and for aggregate statistics.

The forms on this site do not request financial or asset information. The only tool that handles figures is the valuation simulator, and it collects nothing: the EBITDA, industry and currency you enter are processed entirely in your browser —the calculation multiplies your figure by market multiples the page has already loaded—, are never sent to CFSM or to any third party, are not stored on any server or on your device, and are lost when you reload or close the page. If you then decide to write to us, the result does not travel with you: only what you type into the form reaches us. Confidential transaction information is shared through the channels agreed by contract, never through the site's forms.

3. Sensitive personal data

We do not request sensitive personal data through this site and we ask you not to include any in your messages or your CV. If you voluntarily share data of that nature — health, ethnic origin, union membership, religious beliefs or political opinions — we will treat it with the confidentiality the law requires, solely for the purpose for which you sent it, and you may request its deletion at any time.

[CFSM: confirmar con el abogado si el proceso de reclutamiento requiere una cláusula de consentimiento expreso para datos sensibles]

4. Primary purposes

These purposes are necessary in order to attend to you. If you object to them, we cannot respond to or proceed with your request.

• Answering the enquiries you send through the contact form and following up on the conversation you open with us.
• Assessing whether we can help you, preparing service proposals and, where applicable, formalizing the professional relationship.
• Assessing your application: reviewing your profile and CV, contacting you, scheduling interviews and adding your file to CFSM's selection process.
• Adding your address to the newsletter list and sending you the editorial publications you requested.
• Operating, maintaining and protecting the site: fraud and abuse prevention, control of automated submissions and data backup.
• Complying with applicable legal obligations and responding to requests from the competent authorities.

5. Secondary purposes

These purposes are not necessary in order to attend to your request, but they allow us to maintain the professional relationship. You may refuse them without affecting the attention you receive.

• Sending you editorial publications, market analysis and invitations to CFSM events even if you did not expressly subscribe to the newsletter.
• Keeping your CV in our candidate pool so we can consider you for future openings other than the position you applied for.
• Producing internal statistics and satisfaction surveys to improve our services and the content of the site.

You may refuse at the point you hand your data over: simply say so in the message field of the contact form or the careers form —for instance, that we should not keep your CV for future openings, or that you do not wish to receive editorial communications— and we will record it. You may also do so afterwards, by writing to malonzo@cfsm.com.mx or from your email client, stating which purpose you want excluded. Your refusal is not a condition for obtaining any service and does not affect how your request is handled. For the newsletter, the unsubscribe link at the foot of every send is enough.

6. Transfers to processors and to third parties

To run the site and attend to you we rely on technology providers that process personal data on CFSM's behalf and under CFSM's instructions. Under the LFPDPPP these are transfers to processors, not transfers to third parties: the processor cannot use your data for its own purposes and is contractually bound to confidentiality and to security measures equivalent to ours. The processors involved are:

• Vercel. Site hosting, content delivery, technical logs and aggregate audience and performance metrics.
• Supabase. Database and file storage holding contact form messages, job applications and CV files.
• Constant Contact. Newsletter list management, subscription and delivery, including the delivery metrics of each send.
• Resend. Delivery of the internal notifications that alert the CFSM team when a message or an application arrives, and receipt of the newsletter for the editorial archive.
• Sanity. Content management system used to administer the site's editorial material, including the CFSM team profiles.
• Google. Authentication for the internal area: the CFSM team signs in with a Google account to the panel where messages and applications are reviewed, so Google verifies the identity of whoever gains access. The site also displays a Google map in the contact section, on the terms set out in section 7. [CFSM: confirmar el proveedor del correo institucional y del almacenamiento documental con los que se da seguimiento interno a las solicitudes, para nombrarlo aquí como encargado]
• Website development and support provider. The studio that built cfsm.com.mx and maintains it holds technical access to the platform and, for as long as the support period runs, receives a copy of the internal notifications triggered by every submission —contact, careers and newsletter— to confirm they arrive complete. That copy carries the data you entered in the form and, for applications, the file name of your CV, not the file itself: the CV stays in private storage and is opened only from the internal area by authorized accounts. The provider is contractually bound to confidentiality and does not use your data for its own purposes. Once the support period ends, notifications are delivered to CFSM accounts only. [CFSM: completar la razón social del proveedor de desarrollo y soporte, y la fecha en que termina el periodo con copia de las notificaciones]

Several of these processors are established outside Mexico — mainly in the United States — so your data may be stored and processed abroad under the same confidentiality obligations. Beyond these arrangements, CFSM does not sell, rent or trade personal data. We only transfer data to a third party where the law allows it without your consent — a duly founded request from a competent authority, the exercise or defense of rights in a proceeding, or a transfer necessary to perform a contract entered into with you — or where you expressly authorize it. [CFSM: validar si deben listarse encargados adicionales fuera del sitio, como despachos contables, legales o de nómina]

7. Cookies and tracking technologies

CFSM's public site uses no advertising, profiling or cross-site tracking cookies. What we do use is the following:

• Audience and performance metrics. We measure visits and load speed in aggregate, without cookies and without building an individual profile of the visitor.
• Browser local storage. We keep a technical flag on your device to remember whether you have already seen the site's intro animation. It holds no personal data and you can clear it from your browser settings.
• Embedded map. The contact section displays a Google map; when it loads, Google may receive your IP address and browser data under its own policies.
• Email metrics. Newsletter sends record deliveries, opens and clicks to measure editorial performance. You can avoid this by unsubscribing or by setting your email client not to download images.
• Session cookies. The internal area where the CFSM team reviews incoming messages uses strictly necessary cookies to keep the session open. It is not a public area.

You can block or delete these technologies from your browser settings. Doing so does not prevent you from browsing the site or submitting its forms.

8. ARCO rights and how to exercise them

You have the right to access your personal data, to rectify it where it is inaccurate or incomplete, to cancel it where you consider it is not required for any of the purposes in this notice, and to object to its processing for specific purposes. To exercise these rights, send your request to malonzo@cfsm.com.mx, write to us from your email client or file it in writing at our offices. Your request must include:

• Your name and a means of communicating our reply to you.
• Documents proving your identity or, where applicable, the legal representation of whoever files the request.
• A clear and precise description of the personal data the request concerns and of which of the four rights you wish to exercise.
• Anything that helps us locate your data: the form you used, the approximate date of your submission and the email address you wrote from.

We will communicate our determination through the channel you indicate, within the periods set out in Mexico's Federal Law on the Protection of Personal Data Held by Private Parties and its Regulations, and will give effect to it within the period the law establishes. [CFSM: confirmar con el abogado los plazos de respuesta vigentes] The procedure is free of charge: you would only cover shipping costs or the cost of reproduction where you request copies or other formats.

9. Withdrawal of consent

You may withdraw the consent you gave us to process your personal data at any time. To do so, write to us by email stating that you wish to withdraw it and, where applicable, for which purposes. If you are subscribed to the newsletter, the unsubscribe link at the foot of every send withdraws your consent for that purpose immediately.

In some cases withdrawal cannot be total or immediate: we will retain your data where a legal obligation requires us to, or where it is necessary to perform a contract in force with you. We will tell you if that is the case.

10. How to limit the use or disclosure of your data

In addition to your ARCO rights, you may ask us to limit the use or disclosure of your personal data. The most direct route is to write to us by email so we can add you to our internal exclusion list: you will stop receiving communications from CFSM without affecting a request already under way.

If your concern is advertising in general, you may also register your email address or phone number with the public advertising opt-out registry run by Mexico's federal consumer protection authority. [CFSM: confirmar con el abogado si conviene mantener esta referencia y bajo qué denominación vigente]

11. Data retention

We keep your personal data only for as long as necessary to fulfil the purposes in this notice and any applicable legal periods. Once it is no longer needed we block it and then delete it securely.

• Contact form messages: [CFSM: completar plazo de conservación de los mensajes de contacto]
• Applications and CVs: [CFSM: completar plazo de conservación del banco de candidatos]
• Newsletter subscriptions: until you unsubscribe or ask us to cancel your data.
• Technical and security logs: [CFSM: confirmar el plazo de retención de los registros técnicos con el proveedor de hospedaje]

12. Security measures

We apply reasonable administrative, technical and physical measures to protect your data against damage, loss, alteration, destruction and unauthorized access or processing. These include encryption of the site in transit (HTTPS), access to the internal database restricted by authentication and per-user permissions, private storage of CVs, controls against automated submissions, and confidentiality agreements with our processors.

No measure is infallible. Should a security breach materially affect your financial or moral rights, we will inform you without delay so that you can take the appropriate steps.

13. Changes to this privacy notice

This notice may change as our services, our processors, our privacy practices or the applicable legislation change. Every amendment is published on this same page, and the last-updated date at the foot of the document is the reference for which version is in force.

Where a change is material — a new purpose or a new recipient of your data, for example — we will notify you at the last email address you provided. We recommend reviewing this page periodically.

14. Competent authority and acceptance

If you believe your right to the protection of personal data has been infringed, or that the processing breaches applicable regulations, you may bring the matter before Mexico's competent data protection authority. [CFSM: confirmar con el abogado la denominación vigente de la autoridad y de la ley aplicable]

Using this site and submitting any of its forms means that you have read this notice and accept the processing of your data on the terms described here. This document is complemented by our terms of use.