GLOBAL PRIVACY NOTICE

MERAMA AS A RESPONSIBLE COMPANY AND RESPECTING PERSONAL DATA, WE HEREBY PLACE AT YOUR DISPOSAL THIS PRIVACY NOTICE. 

1. DEFINITIONS. 

With the purpose of facilitating the understanding of this privacy notice, terms with capital letters shall have the meaning described below. This will be applicable both for singular and plural terms.

• Privacy Notice: this document in its entirety. 
• Personal Data: any piece of information of the Data Owner, or of any identified or identifiable individual. 
• Primary Purposes: primary purposes for which the Data Owner’s Personal Data is used. They give rise to the relationship between MERAMA and the Data Owner, and are strictly necessary for its maintenance.
• Secondary Purposes: secondary purposes to process Data Owner’s  Personal Data which are not strictly required to maintain the legal relationship between MERAMA and the Data Owner. 

• Merama: the following companies:
• • Merama Inc.: 67 Lenox Hill Drive, Spring TX 77382, United States of America.
  • Merama Growth S.A. de C.V., SOFOM, E.N.R.: Av. Presidente Masaryk 8, Piso 5, Colonia Bosque de Chapultepec I Sección, Alcaldía Miguel Hidalgo, C.P. 11580, Mexico City.
  • Merca Amaz Inc, S.A. de C.V.: Av. Presidente Masaryk 8, Piso 5, Colonia Bosque de Chapultepec I Sección, Alcaldía Miguel Hidalgo, C.P. 11580, Mexico City.
  • Merama Holding Brazil Ltda.: Avenida Paulista, No. 726, Conj. 1207, 12º andar, sala 41, Bela Vista, CEP 01310-910, São Paulo, SP.
  • Asesoría en Market Places, S. de R.L. de C.V.: Av. Presidente Masaryk 8, Piso 5, Colonia Bosque de Chapultepec I Sección, Alcaldía Miguel Hidalgo, C.P. 11580, Mexico City.
  • Asesorias Montes Urales, S. de R.L. de C.V.: Av. Presidente Masaryk 8, Piso 5, Colonia Bosque de Chapultepec I Sección, Alcaldía Miguel Hidalgo, C.P. 11580, Mexico City. 
  • Merama Logistics, S. de R.L. de C.V.: Av. Presidente Masaryk 8, Piso 5, Colonia Bosque de Chapultepec I Sección, Alcaldía Miguel Hidalgo, C.P. 11580, Mexico City.
  • Merama Chile Spa.: Av. Apoquindo 5950, Of. 1701 Ps. 17, Las Condes.
  • Merama Colombia SAS.: Cl. 81 #11 08 6, Bogotá, Cundinamarca, Colombia.
• Data controller: Natural or legal person that decides on Personal Data Processing. Regarding this , MERAMA is defined as “Data Controller” . 
• Data Owner : natural person owner of the Personal Data.
• Transfer and/or Transmission: all Personal Data communication made by the Data Controller with an individual or legal person defined as “third party”. 
• Processing: retrieval, use, disclosure or storage of Personal Data by any means.

1. DATA CONTROLLER: IDENTITY AND DOMICILE. 

The Data Controller, is the legal person named MERAMA, with domicile in:

• Mexico: Av. Presidente Masaryk 8, Piso 5, Colonia Bosque de Chapultepec I Sección, Alcaldía Miguel Hidalgo, C.P. 11580, Mexico City.
• Brazil: Avenida Paulista, No. 726, Conj. 1207, 12º andar, sala 41, Bela Vista, CEP 01310-910, São Paulo, SP.
• United States: 67 Lenox Hill Drive, Spring TX 77382, United States of America. 
• Chile: Av. Apoquindo 5950, Of. 1701 Ps. 17, Las Condes.
• Colombia: Cl. 81 #11 08 6, Bogotá, Cundinamarca, Colombia. 

MERAMA, is committed to comply with this Privacy Notice, in addition to following the provisions described below: 

• MEXICO: Federal Law on Protection of Personal Data Held by Individuals. (Ley Federal de Protección de Datos Personales en Posesión de los Particulares y su Reglamento.)
• BRAZIL: The General Data Protection Law (Lei Geral de Proteção de Dados – LGPD)
• UNITED STATES OF AMERICA: California Consumer Privacy Act (CCPA) for those s of Personal Data in California. 
• CHILE: Law. No. 19,628 – Law on the Protection of Private Life (Ley sobre Protección de la Vida Privada).
• COLOMBIA: Statutory Law 1581 of 2012.

• PERSONAL DATA PROCESSED. 
  • Identification data.
  • Contact data. 
  • Navigation data.

• PURPOSE OF PERSONAL DATA PROCESSING.

MERAMA will process the Data Owners Personal Data for the following purposes:

• Primary Purposes: 
  • Confirm the identity of the Data Owner. 
  • Contact, when required, the Data Owner according to the information that they provided to MERAMA through the website.
  • Assess and analyze navigation data of the Data Owner.  
  • Enhance the navigation experience of the Data Owner through MERAMA’S website. 
  • Comply with the applicable regulation.
  • To contact the Data Owner to inform any amendments made to the Privacy Notice, when applicable. 
• Secondary Purposes: 
  • Include the Data Owner’s information in surveys, studies, statistics, and reports. 
  • Inform the Data Owner through the contact information provided about MERAMA services. 
• MECHANISMS OFFERED TO THE DATA OWNER TO PRESENT A REFUSAL TO THE USE ITS PERSONAL DATA FOR SECONDARY PURPOSES.  

When the regulation is applicable, the Data Owner that does not want its Personal Data to be used for all or some Secondary Purposes mentioned in the previous paragraph, the Data Owner must send an email to data.privacy@merama.io with the subject “Refusal for Secondary Purposes”. In the body of the email, the Data Owner shall specify the reasons of the refusal, in addition to providing its identification data to comply with the request. 

• TRANSFER OF PERSONAL DATA.

We inform the Data Owner that MERAMA will carry out the following transfers with the personal data:

• MEANS AND PROCEDURE TO EXERCISE RIGHTS OF DATA OWNERS.

MERAMA informs to Data Owners of the possibility to exercise rights on their Personal Data, as stated below:  

• Data Owners in Mexico and Chile: 

• • Access/Information Right: know which Personal Data is in possession of MERAMA and the purpose of processing it. 
  • Right to Amend/Rectification request correction of Personal Data that requires an update, which is inexact, wrong, or incomplete. 
  • Right to erasure: request to erase all registration or copy of Personal Data, in physical or electronic format. 
  • Right to object/blocking: request that the use of Personal Data is ceased.  

• Data Owners in Brazil: 

• • Confirmation and Access Right: obtain confirmation of the Data Controller regarding the processing or not of personal data and, and in affirmative cases, the right to access their personal data.
  • Right to Rectification: request correction of incomplete, inexact, or obsolete personal data.
  • Right to Restrict Data Processing: request suppression of unnecessary and excessive data or data processed in violation with LGPD.
  • Right to Object: to object, at any time, to personal data processing by reasons related to a private situation, based on the circumstance of withdrawal of consent, or due to noncompliance with LGPD provisions.
  • Right to Data Portability: Execute portability of personal data to other services or product providers, with previous express consent, as per authority regulation, according to trade and industrial secrets.
  • Right to not be subject to Automated Decisions-Making: request a revision of decisions only adopted based on automated processes of personal data related to their interests, including decisions intended to define personal, professional, consumption, or credit profile, or aspects of the personality of the Data Owner.

• Data Owners in Colombia: 

• • Know, update, and rectify their personal data when it is inexact, incomplete, fractioned, when it induces an error or when the Processing of it is expressly prohibited or are not authorized. 
  • Request proof of granted authorization to the Data Controller, except when is not expressly required to have this consent to Process the data.
  • Be informed regarding the processing of their personal data. 
  • Revoke the authorization and/or request suppression of personal data, when the Processing of it does not comply with the principles, rights, and constitutional and legal guarantees of Colombia.
  • Access, free of charge, their personal data that has been subject to this Processing.
• Data Owners in the United States of America (Residents of California):
  • Right to know: the Data Owner has the right to be informed by MERAMA about the Personal Data categories collected, the sources from which they are collected, the purposes for which they are collected and shared, and the Personal Data categories that we disclose with commercial purposes 12 months before the “right to know” request.
  • Right to Data Portability: you have the right to receive an electronic copy of your Personal Data in a format that is easy to use.
  • Right to request suppression: You have the right to request suppression of your Personal Data provided to our company. You have to consider that, in some circumstances, we might not be able to process your request, for example, in the following: (i) in the presence of a statutory obligation, (ii) to detect security incidents, to protect ourselves from malicious, deceitful, fraudulent or illegal activities, or to chase s for said activities, or (iii) to complete one transaction for which your personal data was required and therefore collected.
  • Non-discrimination right: You have the right to not be discriminated by MERAMA as a result of exercising your CCPA rights.

We inform the Data Owner that MERAMA does not sell or has knowledge that your Personal Data is sold to a third party. 

We also inform the Data Owner, resident of California, that the Personal Data described in item III of this  constitutes the information that MERAMA collected from you in the past 12 months. Such information is obtained in a personal and direct manner, by the same Data Owner , and the statutory base for its processing is the consent and/or obligations of legal nature, as applicable.

The exercise of rights described above will be made upon request, in writing, sent to the address data.privacy@merama.io with the subject “Exercise of Rights”. The email described corresponds to a department that will answer requests and Data Owners can communicate with the said department at any time.  

The Data Owner shall provide the following information: 

• Full name and address. 
• Clear and exact description of Personal Data that you want to exercise any of the Rights, in addition to other documents that can help to find them. 
• Description of the Right that you want to exercise and the reason to do so. 
• In the event of an Amend/Modification request, you must describe the amendments and provide documentation that grounds your modification request. 

Additionally, the request must have the following documents: 

• Copy of the official identification of the Data Owner or its representative. 
• Document and/or information that supports the personal information is in possession of MERAMA.
• In the event that the Data Owner does not personally submit the request, the person that submits it must confirm the representation upon public deed or power of attorney executed before two witnesses with official identifications of the Data Owner and their representative. 

Once MERAMA receives the request from the Data Owner, MERAMA will send an email confirming the receipt. After this, the company will answer the request through email within a term that must not exceed twenty (20) business days from the receipt date. This term will only be applicable provided that MERAMA has all the required information to answer the request, as per established in the following paragraph.  

The Data Owner shall consider that, in order to have all required elements to answer the request, MERAMA can request additional information within 5 (five) business days after receiving the request. As per the request of MERAMA, the Data Owner will have 10 (ten) business days to answer this request. In such circumstances, the term of 20 (twenty) business days mentioned in the previous paragraph will be valid from the following day after the Data Owner answers the request of MERAMA.

If the said request is considered applicable and the Data Owner confirmed its  personality and ownership of the Right that wants to exercise, the answer will be sent in a maximum term of 15 (fifteen) business days from the requested answer date. 

Regarding Personal Data Access/Information requests, the delivery shall be made upon proof of the identity of the petitioner or its representative, as the case may be.. Such proof shall be delivered in ordinary copies to the address mentioned herein, or in electronic documents to the email address used to send the request.  

In the event of an object/blocking request, Personal Data processing will cease in the following business day after receiving the affirmative answer from the Data Owner. 

• MEANS AND PROCEDURE TO WITHDRAW A CONSENT.

When permitted by applicable regulations, the Data Owner can withdraw the authorization granted to MERAMA to process their Personal Data. MERAMA states that, to comply with certain purposes, withdrawing consent can indicate the impossibility to maintain the relationship of MERAMA with the Data Owner.  

In this circumstance, the withdrawal will be performed according to the following procedure. 

• The Data Owner shall send an email to data.privacy@merama.io, with the subject “Withdrawal of consent”. 
• The body of the message shall mention:

1) The full name of the Data Owner. 

2) The reason for the request. 

3) Arguments that support the request. 

4) Date that the Data Owner wants the withdrawal to be effective. 

5) Copy of an official document that attests Data Owner´s identity, said copy shall be attached in the request. In the event that the Data Owner does not personally submit the request, the person that submits it must prove its representation upon public deed or power of attorney executed before two witnesses with official identification of the Data Owner and its legal representative. 

MERAMA will answer your request through an email within 20 (twenty) business days from the receipt date. This term will only be applicable if MERAMA has all the required information to answer the request, according to the following paragraph.    

The Data Owner shall consider that, in order to have all required elements to answer the request, MERAMA can request additional information within 5 (five) business days after receiving your request. As per the request of MERAMA, the Data Owner will have 10 (ten) business days to answer this request. In this circumstance, the term of 20 (twenty) business days mentioned in the previous paragraph will be valid from the next day after the answer of the Data Owner to MERAMA. 

• MEANS TO LIMIT THE USE OR DISCLOSURE OF PERSONAL DATA / SECURITY OF PERSONAL DATA

MERAMA with the purpose of protecting the Personal Data of Data Owner is committed to executing legal acts, adopting privacy policies, Personal Data Protection Policies and security of information that the company requires, in addition to implementing security measures regarding technological, physical, and administrative matters.

MERAMA stores personal information in databases with restricted access and security mechanisms. MERAMA is committed to treat and consider the information provided by the Data Owner as confidential.

If the Data Owner wants to know more about this subject, he/she must send an email to the address data.privacy@merama.io with the subject “Limitation of Use or Disclosure/Security of Personal Data”, expressing questions, comments, and suggestions regarding this document.

• COOKIES.

Cookies are text files stored in computers used by the Data Owner during a visit to the website. Cookies help MERAMA offer a better experience while the user navigates on the website and provides a better experience for them. 

MERAMA uses cookies on the website, however, each Data Owner is free to accept or decline such usage through the configuration in the device that he/she is using. Nevertheless, it is important to mention that if the Data Owner does not accept cookies, some functionalities of the website might not work properly. 

To deactivate cookies, the Data Owner can access the following links: 

• TERM OF STORAGE OF PERSONAL DATA.

All Personal Data of the Data Owner will be stored for the time that is required to comply with the purposes for which it was collected. Subsequently, it will have a blocking period before its cancellation. 

• AMENDMENTS TO THE PRIVACY NOTICE.

We inform the Data Owner that this Privacy Notice can be amended in a time and format that MERAMA determines, always in compliance with the applicable legislation. Thus, we inform the Data Owner that amendments made in this document will be notified through the provided email. 

XIII. LAST UPDATE DATE: November 14, 2022.