COMPREHENSIVE PRIVACY NOTICE – ESCUELA TOMÁS ALVA EDISON

Escuela Tomás Alva Edison (hereinafter the "School" or "We") is the Data Controller responsible for the processing and protection of your Personal Data and, as such, provides you ("You") with this PRIVACY NOTICE in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on March 20, 2025, its Regulations, and the applicable guidelines issued by the Secretariat of Anti-Corruption and Good Governance (hereinafter jointly, the "Data Protection Law"). The terms used in this Privacy Notice shall have the meaning assigned to them by the Data Protection Law, unless expressly defined otherwise in this document.  

 This Privacy Notice (hereinafter the "Notice") applies to the personal data that the School collects from students and prospective students, their parents, guardians and/or legal representatives, in relation to the comprehensive educational services it offers. 

1.-Personal Data We Will Process: 

1.1. The School will process the following personal data directly and/or through Data Processors, including the external service providers described in Section 4 below:   

• 1.1.1. Prospective students of the School: name, image, voice, date and place of birth, official identification or passport, gender, nationality, signature, email, address, school grade in which they are interested in enrolling, previous school, father's name, mother's name, guardian's name (if applicable), legal representative's name (if applicable), landline and mobile telephone numbers.   

• 1.1.2. Students of the School: name, image, voice, date and place of birth, official identification or passport and, if applicable, Federal Taxpayer Registry (RFC), gender, nationality, signature, email, address, grade in which they enroll or re-enroll, father's name, mother's name, guardian's name (if applicable), legal representative's name (if applicable), landline and mobile telephone numbers, names of the people they live with, number of siblings, school grade and school attended by siblings. Information contained in the following documentation: official identification with photograph, photographs, report card of the immediately preceding grade and final report card of the current school year, letter of no debt from the previous school, proof of payment for books and materials (if applicable), school certificates (if applicable), birth certificate, vaccination card (if applicable).  

•  Sensitive personal data of students (provided by their parents, guardians and/or legal representatives): blood type, birth weight, immediate neonatal complications, APGAR score, gestational age, psychomotor development, language disorders, health conditions, past and/or current diseases, surgeries, hospitalizations, accidents, transfusions, vision problems, hearing problems, current treatment, vaccines received, allergies, intolerances, family medical history (diseases that grandparents, father, mother, siblings, uncles, and cousins have suffered and/or currently suffer from), and psychological health status.   

• 1.1.3. Father, mother, guardian and/or legal representative of the students: name, image, voice, photograph, occupation, employer, signature, date of birth, official identification (INE, passport or equivalent identification document), gender, nationality, marital status, number of children, profession, address, whether or not they share the same address as the student, landline and mobile contact numbers, emails, name of alternative contact person, alternative contact telephone number. Billing information: name or business name, official identification or passport, email for sending electronic invoices, tax domicile, whether or not it is the same address as the student, tax and bank account information, if applicable, payment information when necessary to process tuition and other school fees, letters of no debt (for students transferring from other institutions). Information contained in the following documentation: official identification with photograph, bank details, and proof of address.  

•  Sensitive personal data of the father, mother, guardian and/or legal representative: religious affiliation, health status. 

2.-Use of "Cookies" and "Web Beacons":

The School's websites use cookies, web beacons, pixels, and similar technologies to improve website functionality, optimize the user experience, analyze site traffic, measure the effectiveness of communications and marketing campaigns, and maintain website security.  

The School uses a consent management platform ("CMP") to allow users to manage their cookie preferences. Through the cookie banner displayed upon accessing the websites, users can accept, reject, or configure the use of non-essential cookies at any time.

The cookies used on the websites may include, among others:

• Strictly necessary cookies;

• Functional cookies;

• Analytical cookies;

• Marketing cookies.

The School also uses certain third-party technologies, including Google Analytics 4 (GA4), Google Tag Manager (GTM), Google Ads, Meta technologies, and HubSpot, which may collect information about user interactions with the websites for analytics, advertising, communication, and website performance purposes.

Users can modify their cookie preferences at any time through the "Privacy Settings" option available on the School's websites.

For more information regarding the specific cookies used on the School's websites, their purposes, providers, retention periods, and how to manage your preferences, please consult the Cookie Settings available through the cookie banner displayed on the websites.

3.- Purposes of the processing of personal data:  

3.1 The School, either directly or through its Data Processors, will process the Data Subject's personal data, according to the nature of their relationship with the Data Subject, for the following primary purposes:  

3.1.1 Regarding prospective students:

• Contact the Data Subject, parents, guardians, legal representatives, and/or representatives of the previous school via email, telephone, or any other physical or electronic means, in order to answer queries about availability and requirements for enrollment in the School, as well as to request references regarding their performance at the previous educational institution;

• Maintain records in the School's databases with the information of parents, guardians, and/or legal representatives who contact the School by phone or email to make inquiries or request quotes for educational services, for follow-up purposes. These records will be stored electronically for a period of 1 (one) year from the date of collection, in the event that the School has not provided services.

3.1.2 Regarding the student:

• Identify the student and process their initial enrollment or re-enrollment in the School;

• Create the student's file and academic record, both in physical and electronic format. Said file will be kept for the entire duration of the student's relationship with the School, and for up to 10 (ten) years after the termination of said relationship;

• Provide the comprehensive educational services it offers, whether in person or online;

• Creation of a student database for administrative and/or academic purposes, kept for the same period described above, and which, during the educational relationship, will include the student's sensitive personal data relating to their health status, since the preservation of these data is justified by the legitimate purpose of providing medical assistance if necessary during classes and/or activities related to the services provided by the School. Once said relationship is concluded, this database will no longer include the student's sensitive personal data.

• Fulfill requests for information related to the educational or administrative services provided by the School;

• Verify the authenticity of the documentation presented by the Student and/or their parents, guardians, or legal representatives;

• Review applications for scholarships for orphans and educational scholarships submitted by the Students;

• Issue titles, diplomas, certificates, and any other documentation in favor of the students that proves the completion of their studies;

• Contract school accident insurance;

• Transmit the information requested by the Secretariat of Public Education to validate and recognize the students' studies;

• Notify Students about the School's academic, cultural, and institutional activities;

• Comply with the applicable legislation for educational services in Mexico;

• Request socioeconomic studies for the granting of scholarships, and

• Provide them with medical attention in case of emergencies.

3.1.3 Of the father, mother, guardian or legal representative of the student: 

• Contact parents by any means, via telephone or email, to attend to and follow up on their requests for information and the educational services offered by the School;

• Contact the Data Subject by any means to provide clarifications and follow up on payments or any other situation derived from the educational services provided by the School, such as complaints or comments regarding them;

• Contact the Data Subject to manage and collect pending debts;

• Record the information of the father, mother, guardian, and/or legal representative in the School's accounting and enterprise resource planning (ERP) systems (currently NetSuite or any successor platform), or any system that may replace it in the future, to allow authorized personnel access to personal data;

• Fulfill requests for questions, comments, or information related to the educational or administrative services provided by the School;

• Issue electronic invoices and credit notes derived from the educational services offered by the School. These invoices, in physical and electronic format, as well as credit notes, will be kept by the School for the duration of the commercial relationship and for 10 (ten) years after its termination;

• Contact the Data Subject via email to attend to and follow up on their comments or requests submitted through the "Contact" section of the School's website;

• Carry out operations with credit and/or banking institutions derived from the contractual relationships entered into between the Data Subjects and the School;

• Coordinate meetings by phone, email, or any other means, whether in physical or digital format, in relation to the educational services provided by the School;

• Request socioeconomic studies to analyze situations related to students' scholarship requests regarding tuition or re-enrollment;

• Send notifications about the students' academic status to the Data Subject by any means, whether physical or electronic;

• Create a record in the database of parents, guardians, and/or legal representatives of the School's students, which will be kept during the provision of educational services and for one (1) year after their conclusion, and which will not include sensitive personal data; and

• Contact them to notify them of any emergency and/or situation related to the students.

• Process tuition and fee payments, reconcile payment settlements, monitor and prevent fraudulent operations, provide customer support related to payments, and manage chargebacks, in each case directly and/or through the School's Data Processors.

3.2 The School undertakes to observe, regarding the personal data it collects, the principles of lawfulness, purpose, fairness, consent, data quality, proportionality, information, and accountability, as required by the Data Protection Law.

3.3 The School will delete the Data Subject's personal data once the purposes for which they were collected have been fulfilled, except in cases where this Notice establishes a different specific period, or a certain period is required for the exercise of rights or obligations, or as otherwise provided by applicable law.

3.4 The Data Subject's personal data may be used for the following secondary purposes:

• Create a record in the School's "Contacts" database, which will be kept for 10 (ten) years from the date of collection, without including sensitive personal data.

• Create a database of School alumni for the purpose of organizing reunions and other social activities. This database will be kept indefinitely and will not include sensitive personal data;

• Generate internal reports on the use of the School's website;

• Send newsletters on topics related to the School's activities that may be of interest to the educational community;

• Evaluate the quality of the educational services offered;

• Prepare statistical reports using data that has been dissociated from its owners;

• Record audio and video, and take photographs of the various events held by the School both inside and outside its facilities, and use such material for illustrative, promotional, marketing, or advertising purposes, through electronic and/or printed media. The aforementioned material will be kept by the School for the duration of the promotional campaign or until the purposes of this Notice have been fulfilled, whichever occurs first; and

• Send information and promotions to the Data Subjects about new academic offerings provided by the School.

3.5 If the Data Subject does not want the School to use their personal data for the secondary purposes established in section 3.4, the Data Subject may send their request to opt-out of processing for secondary purposes through the department and contact channel identified in Annex A of this Notice.

4.- Data Processors and International Processing: 

4.1 In order to provide certain administrative, financial, technological, and payment-related services, the School has hired specialized external service providers acting as Data Processors, who process personal data solely on behalf of the School, under its instructions, and exclusively for the purposes described in this Notice.

4.2 These Data Processors provide services that include: payment processing, settlement reconciliation, fraud monitoring, payment customer support, chargeback administration, and information technology outsourcing, as well as support in finance and procurement and, where applicable, other administrative business support services. In relation to the information technology outsourcing service, the School's Data Processors may have technical access to the platforms and systems hosting the School's administrative and academic records. Access to personal data is, in all cases, limited to what is strictly necessary for the Data Processor to provide the contracted service, in accordance with the principle of data minimization, and does not authorize the Data Processor to use personal data for any purpose other than those described in this Notice.

4.3 Some of these Data Processors may provide services from Mexico and others from the United Kingdom, the European Economic Area, India, and other countries. In accordance with Article 2, section XX of the Data Protection Law, the forwarding of personal data between the School, as Data Controller, and its Data Processors—whether located in Mexico or abroad—does not constitute a "transfer" for the purposes of the Data Protection Law, and therefore does not require the Data Subject's consent. Notwithstanding the foregoing, and in compliance with the principles of transparency and information, the School informs Data Subjects about this processing through this Notice.

4.4 The School's contract with its Data Processors includes specific data protection and information security annexes that require them, among other obligations, to: (i) process personal data solely for the purposes and in accordance with the instructions given by the School; (ii) implement appropriate administrative, technical, and physical security measures for the personal data processed, including access controls, encryption in transit and at rest, and continuous monitoring; (iii) maintain the confidentiality of personal data, even after the termination of the service contract; (iv) refrain from further transferring or subcontracting the processing of personal data without the School's prior authorization; (v) notify the School immediately of any security incident affecting personal data; and (vi) delete or return personal data upon termination of the applicable service contract, as instructed by the School. Where applicable to personal data originating in the United Kingdom or the European Economic Area, the contract incorporates recognized international transfer safeguards. Likewise, when required by laws governing personal data originating outside Mexico, the School and its Data Processors implement the corresponding international data transfer safeguards. Although such safeguards are not required under the LFPDPPP for forwardings carried out on behalf of the School, they reflect the security standards applicable to the School's processing operations.

4.5 For the avoidance of doubt, the services described in this Section do not include the processing of the School's employees' personal data, which is addressed in the School's separate Employee Privacy Notice.

5.-Person Designated to Process Requests:

5.1 If the Data Subject wishes or needs to revoke their consent, or access, rectify, cancel, or oppose the processing of the personal data they have provided, they must do so through the department designated by the School for this purpose. The department and contact channel designated by Tomás Alva Edison are identified in Annex A of this Notice.

5.2 The School will keep the designation established in Annex A updated. Any change in the designated department or in the contact channel will not require the modification of the substantive provisions of this Notice.

6.- Means to Revoke Consent: 

The Data Subject may revoke the consent granted by accepting this Notice. Said revocation of consent must be carried out according to the following procedure:

6.1 Send an email to the contact designated in section 5.1 of this Notice, through which such requests will be attended to.

6.2. The request must indicate:

• 6.2.1. The Data Subject's full name and address, to receive the response generated in attention to their request;

• 6.2.2 The reason for their request;

• 6.2.3 The grounds supporting their request or petition;

• 6.2.4 An official document proving their identity and verifying that they are who they claim to be; and,

• 6.2.5 The date from which the revocation of their consent becomes effective.

6.3 The School will communicate its determination regarding the request within a maximum period of twenty (20) business days following receipt of the complete request, a period that may be extended once for an equal period when justified by the circumstances of the case, in accordance with the Data Protection Law. If the request is appropriate, the School will make the revocation effective within an additional period of fifteen (15) business days.

7. Means to Exercise the Rights of Access, Rectification, Cancellation, and/or Opposition ("ARCO"): 

7.1 If the Data Subject needs to access, rectify, cancel, or oppose the personal data they have provided to the School, they must follow the procedure below.

7.2 Send an email to the contact designated in section 5.1 of this Notice, including:

• 7.2.1 The Data Subject's full name, address, and email to receive the response;

• 7.2.2 The reason for the request;

• 7.2.3 The grounds supporting the request;

• 7.2.4 An official document proving the applicant's identity;

• 7.2.5 A clear and precise description of the personal data concerning which the Data Subject seeks to exercise any ARCO right; and

• 7.2.6 In the case of rectification requests, the modifications to be made and supporting documentation.

7.3 The School will communicate its determination within a maximum period of twenty business days from the date the complete request was received, a period that may be extended once for an equal period, when justified by the circumstances of the case. If the request is appropriate, the School will make it effective within an additional period of fifteen (15) business days. The exercise of ARCO rights is free of charge, except for the costs of reproduction, copying, or mailing, in accordance with the Data Protection Law. In the case of requests for access to personal data, the data will be provided upon verification of the identity of the applicant or their legal representative, as appropriate.

8. Transfer of Personal Data:

8.1 The School will not transfer or share the personal data referred to in this Notice with third parties, except in the cases described below or when ordered by a competent authority or applicable law.

8.2 In compliance with its legal obligations, and for the Data Subject's knowledge, the School may carry out the following transfers:

• To the Secretariat of Public Education or the corresponding state educational authority, in order to comply with the School's legal obligations in the provision of its educational services.

• To the Tax Administration Service ("SAT"), in order to comply with tax legislation, as well as for the payment of taxes and the management of tax compliance records.

• To banking institutions, in order to collect or pay for the products and/or services required or offered by the School to its students;

• To authorities, private and/or governmental institutions, as well as official bodies within the United Mexican States, to provide the services offered by the School;

• To judicial authorities and external lawyers of the School for the recovery of debts and litigation management;

• In case of pending debts, to private entities responsible for the collection of past-due payments;

• To parent companies, subsidiaries, or affiliates under common control of, or within the same corporate group as, International Schools Partnership, operating under common internal processes and policies; and

• To the new educational institution in which the Data Subject is going to enroll, if requested by the parents or guardians.

8.3 Except in the cases described in Section 8.2 above, regarding which the Data Protection Law does not require them to be conditioned on the Data Subject's consent, to the extent they are necessary to comply with a legal obligation, are carried out between companies of the same corporate group operating under common policies, or are covered by another applicable legal exception, any other transfer of personal data to third parties (other than the Data Processors described in Section 4) will require the Data Subject's prior consent.

9.- Modifications:

9.1 The School reserves the right to modify or update this Privacy Notice at any time, in order to reflect changes in applicable legislation, its personal data processing activities, or its internal privacy practices. Any updated version will be published on the School's official website and will take effect upon publication, unless applicable law requires otherwise.

ANNEX A — School Information and Privacy Contact

This Annex is part of the Comprehensive Privacy Notice of Tomás Alva Edison and identifies the contact details of the department responsible for receiving and processing requests related to the exercise of data protection rights under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), including requests to exercise ARCO rights, revoke consent when applicable, or submit questions regarding the processing of personal data.

School Information and Privacy Contact Details