OMA Logística, S.A. de C.V. (“OMA” and/or the “Data Controller,” interchangeably) shall be responsible for processing the Personal Data (as defined below) that you provide to it and of which you are the data subject (“Data Subject”).
This privacy notice (hereinafter the “Privacy Notice”) is governed by the principles of lawfulness, purpose, fairness, consent, quality, proportionality, information, and accountability in the processing of Personal Data.
OMA makes this Privacy Notice available to all individuals who use OMA’s car parking services and informs them of the purpose of the processing of their Personal Data, in accordance with Article 14 of the Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”).
“Processing” of your Personal Data shall be understood to mean any operation or set of operations performed through manual or automated procedures applied to Personal Data, related to the collection, use, recording, retention, utilization, disclosure, storage, possession, access, handling, exploitation, or disposal thereof.
The Personal Data that may be collected and, where applicable, processed by OMA is as follows (hereinafter, the “Personal Data”):
Identification Data
-
Name
-
Federal Taxpayer Identification Number
-
Employment-related information
Contact Information
-
Address
-
Phone number
-
Email address
Asset Information
-
Information regarding the Data Subject’s assets (vehicle information that the Data Subject registers to access and use the corresponding car park).
Any Personal Data that OMA may collect will be processed for the purposes specified below in this Privacy Notice.
OMA hereby informs you that, through the car parks it operates, no sensitive Personal Data will be collected—defined as data that may reveal aspects such as racial or ethnic origin, health status, genetic information, religious, philosophical, or moral beliefs, union membership, political opinions, or sexual orientation, in accordance with the provisions of the law.
OMA will process the Data Subject’s Personal Data for the following purposes:
-
To manage and monitor the Data Subject’s stay, as well as the car park spaces and car parking services provided by OMA.
-
To provide the best possible car parking service.
-
To manage and administer “Parking Pass” prepaid cards that allow the Data Subject to enter and exit any OMA car park at any time.
-
To optimize entry and exit times for users passing through OMA car parks.
-
To process online registration and bookings for the car parking services provided by OMA.
-
To offer and provide the Data Subject with promotions, exclusive benefits, or discounts related to the parking services provided by OMA.
-
To send the Data Subject informational and commercial communications related to online bookings for services provided by OMA, including confirmations, updates, pre-trip reminders, notifications during service provision, and follow-up after use.
-
To Issue and process tax receipts.
-
To provide support services to users of OMA car parks (for example: jump starts, tire-changing tools, tire inflation).
-
To prevent, detect, and, where appropriate, alert the competent authorities to any risk situation, emergency, unlawful act, or event that jeopardizes operational security.
-
To respond to requests from any competent authority.
-
To comply with applicable legal provisions.
OMA will retain the Data Subject’s Personal Data for a period of up to 2 years from the expiration of the transaction covering the service that OMA has provided to the Data Subject in connection with the use of car parks, provided that OMA and the Data Subject are not involved in any pending judicial or administrative proceedings, there is no request from any authority, or there is no longer retention period required by applicable law; in such cases, this period may be extended as required.
OMA will only transfer the Data Subject’s Personal Data to:
-
Its domestic and/or foreign affiliates that belong to the same corporate group and operate under the same policies as OMA;
-
External auditors.
OMA will provide third parties with this Privacy Notice, as well as the purposes for which the Data Subject has consented to the processing of their Personal Data; therefore, any third party receiving such a transfer will be obligated to process said data in accordance with this Privacy Notice.
Unless the Data Subject expressly states otherwise, the Data Subject consents to the transfer of their Personal Data to third parties as described above.
OMA collects the Data Subject’s Personal Data solely through the following means:
-
Directly from the Data Subject, either in person or electronically.
-
Through direct transfer from OMA’s domestic and/or foreign affiliates, which belong to the same business group and operate under the same policies as OMA.
-
From publicly available sources.
As part of the security measures designed to protect the Data Subject’s Personal Data, access for the processing of such data is limited and restricted exclusively to OMA.
Furthermore, OMA has administrative, technical, and physical security measures in place to protect the Data Subject’s Personal Data against damage, loss, alteration, destruction, or unauthorized use, access, or processing.
OMA does not use or disclose the Data Subject’s Personal Data for purposes other than those described above; however, if the Data Subject wishes to limit the use or disclosure of their Personal Data, they will be added to an opt-out list. To do so, the Data Subject must send a written request to OMA’s address or to the email address datospersonales@oma.aero, addressed to the Department of Personal Data Protection and Processing, which must include, at a minimum, the Data Subject’s name or business name, along with identification proving their identity, their address, an email address for receiving notifications, and an explicit request that their Personal Data be added to an opt-out list.
The Data Subject always has the right to access, rectify, cancel, or object to the processing of their Personal Data, in accordance with the means and procedures outlined below.
Access: To know what Personal Data OMA holds, for what purposes it will be used, and how it will be processed.
Rectification: Request the correction of your Personal Data if it is outdated, inaccurate, or incomplete.
Cancellation: Request the deletion of your Personal Data from OMA’s databases when you believe it is not being used appropriately. A request to exercise this right will result in a blocking period during which the Personal Data you wish to have deleted will be archived for a maximum of 30 days.
Objection: Object to the use of your Personal Data for a specific purpose.
In this regard, OMA provides the Data Subject with the following mechanisms, means, and procedures to exercise their ARCO rights:
-
Submit a written request addressed to OMA’s Department of Personal Data Protection and Processing, located at Avenida Patriotismo No. 201, 5th Floor, Colonia San Pedro de los Pinos, Benito Juárez Municipality, ZIP Code 03900, Mexico City. The request must contain at least the following information:
-
-
Full name of the Data Subject.
-
-
-
Address for service of process and receipt of notifications (email address or home address)1.
-
-
-
A copy of the identification document with which the Data Subject verifies his or her identity, or, where applicable, of the Data Subject and his or her legal representative.
-
-
-
Indicate which ARCO right or rights you wish to exercise.
-
-
-
A clear and precise description of the Personal Data regarding which you are requesting exercise your ARCO rights.
-
-
Send the request to the email address: datospersonales@oma.aero, addressed to OMA’s Department of Personal Data Protection and Processing, which must meet the same requirements as those set forth in the immediately preceding paragraph.
Once the request is received, OMA will have a period of twenty business days following the date of receipt to determine whether the request is admissible or inadmissible; the decision will be notified to the Data Subject at the address provided for that purpose.
This period may be extended once for an equal duration, provided that the extension is justified and the circumstances of the case warrant it.
If the Data Subject’s request is deemed inadmissible, the corresponding decision shall be accompanied by the relevant evidence.
If the request is deemed admissible, the Data Subject’s exercise of the requested ARCO right(s) shall take effect within fifteen business days following the date on which the decision was communicated.
OMA may deny the exercise of ARCO rights in the following cases:
-
If the applicant is not the Data Subject or their legal representative fails to provide proof of their identity or that of the person they represent.
-
If the applicant’s Personal Data is not found in OMA’s databases.
-
When the rights of a third party are infringed.
-
If there is a legal impediment or a requirement by an authority.
-
When the correction, deletion, or objection has already been carried out, rendering the request moot.
If the Data Subject wishes to revoke their consent to the processing of their Personal Data in accordance with this Privacy Notice, the Data Subject may express such revocation by following the same procedure applicable to the exercise of ARCO Rights, as described above.
The Data Subject’s revocation of consent to the processing of their Personal Data will not have retroactive effect; however, once such consent is revoked, the Data Controller may terminate any relationship between itself and the Data Subject if such data is necessary to fulfill the objectives of the relationship.
Any changes or modifications to this Privacy Notice will be communicated to the Data Subject by making the new Privacy Notice physically available to them, if their Personal Data is collected in person, and electronically if their Personal Data is obtained by any electronic, optical, audio, visual, or other technological means, so that they may remain informed of such changes and, where applicable, exercise their rights. Modifications to the Privacy Notice will take effect as soon as said Notice is made available to the Data Subject.
This Privacy Notice is available to the Data Subject at OMA’s office, in OMA’s car parks, or via the following website: https://aeropuertomonterrey.oma.aero/
By making this Privacy Notice available to the Data Subject, and in the absence of any objection on their part, it is understood that the Data Subject has read this Privacy Notice, understands its scope and purposes, and consents to the processing of their Personal Data in accordance with it.
