Privacy Policy
Identity and Address of the Data Controller
Tuzumma Asesor en Inversiones Independiente, S.A.P.I. de C.V., with a conventional address for hearing and receiving notices solely regarding privacy and personal data protection matters at Bosque de Reforma 1416, Bosque de las Lomas, Cuajimalpa de Morelos, C.P. 05120, Mexico City, (the “Data Controller” or “ZUMMA”), is responsible for the legitimate, controlled, and informed processing of personal data (the “Personal Data”) of its prospects, clients, and users (the “Data Subject”), in compliance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”), its regulations, as well as the Privacy Notice Guidelines (the “Guidelines”), applicable secondary regulations in force, and applicable national and international standards regarding personal data protection currently in force, and therefore makes available this Privacy Notice (the “Notice”), prior to obtaining Personal Data, in strict adherence to the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality, and accountability set forth in the Law and its regulations.
ZUMMA is a variable capital investment promotion corporation (sociedad anónima promotora de inversión de capital variable) incorporated in accordance with Mexican law, registered as an “Independent Investment Advisor” in the Public Registry of Investment Advisors of the National Banking and Securities Commission (Comisión Nacional Bancaria y de Valores) under registration number 30184-001-(16375)-18/08/2023.
Personal Data Subject to Processing
In order to guarantee privacy, the appropriate processing of your Personal Data, the right to informational self-determination of individuals, and so that ZUMMA is able to provide its services, ZUMMA may collect Personal Data through any of the following means: (i) directly and personally from the Data Subject; (ii) directly when the Data Subject enters their Personal Data through the website <https://www.zummafinancial.com/es> (the “Website”) or through any link, microsite, or accessory directly related to it, the mobile application called “Zumma Financial” (the “App”), or when the Data Subject provides such data by telephone; (iii) through the social media accounts managed by ZUMMA; and (iv) when information is obtained through publicly available sources permitted by the Law.
The Data Subject’s Data that ZUMMA will process is the following:
a. Identification data: full name, complete address, date of birth and/or age, country and place of birth, sex or gender, marital status, nationality, Unique Population Registry Code (“CURP”), Federal Taxpayer Registry (“RFC”). If a foreign national, address in country of origin.
b. Electronic and IT data: telephone number (home, office, and/or mobile), email address, handwritten and/or simple or reliable electronic signature (whether affixed on paper or digitally associated with a data message, fingerprint and/or through other authentication methods and optical electronic means or any other technology recognized by applicable laws and provisions that the Data Controller makes available).
c. Employment and academic data: occupation or profession, work seniority, employer or place of work, level of education (degrees completed).
d. Financial and/or asset-related data: credit history, income, expenses (any type of expense), card and bank account numbers, standardized bank code (CLABE), economic activity, financial planning (short, medium, and long-term goals and objectives), financial habits.
ZUMMA will at no time collect data from the Data Subject that may be considered sensitive under the Law.
Purposes of Personal Data Processing
The Personal Data processed by ZUMMA will be used to carry out the following purposes:
I. Primary Purposes. These are the purposes necessary for the existence and fulfillment of the legal obligation arising from the products and/or services that the Data Subject contracts with the Data Controller, which consist of the following:
1. Verify and confirm the identity of the Data Subject as a client, user, or prospective client or user of the services offered by ZUMMA through the Website and the App. 2. Provide the products and/or services that the Data Subject has requested from ZUMMA through the Website and/or the App. 3. Provide the information necessary to open the investment account(s) required for ZUMMA to be able to provide the Data Subject with the services and/or products contracted through the Website and/or the App, as well as to comply with the “know your customer” (KYC) policies or requirements of financial service entities. 4. Transfer the Data Subject’s Personal Data collected by ZUMMA to domestic or foreign third parties (mainly commercial partners, sponsors, financial service entities, credit service entities), in order to facilitate fulfillment of the primary and secondary purposes mentioned in this Notice, provided that such third parties agree to comply with the provisions of this Notice and with applicable law, whether domestic or international. 5. Sending messages and information related to the functionality, operation, and promotion of the products and services offered on the Website and the App. 6. Notifying about new services or products related to those already contracted or acquired with ZUMMA. 7. Communicating changes to services or products already contracted or acquired with ZUMMA. 8. Fulfilling obligations and exercising rights arising from the legal relationship established between the Data Controller and the Data Subject. 9. Conducting periodic evaluations of services and products that the Data Subject has requested. 10. Creating and/or updating databases, statistics, reports, or studies related to the services and products that the Data Subject has requested.
II. Secondary Purposes. These are purposes that are not necessary for the existence and fulfillment of the legal obligation arising from the products and/or services that the Data Subject contracts with the Data Controller; however, they are complementary and important for providing better service to the Data Subject, and consist of the following:
1. Preparing profiles related to the consumption, spending, or investment habits of clients and users of the services and/or products offered by the Data Controller. 2. Sending communications related to offers, promotional messages, communications for marketing, advertising, and commercial prospecting purposes regarding new or existing products and/or services and products and/or services of third-party commercial partners that may be of interest to you.
The Data Subject may express their refusal to the processing of their Personal Data for secondary purposes by calling +52 (55) 4808 1624 or by sending an email to that effect to hola@zummafinancial.com, which must include their contact information and any other information that allows a response to be given to such request, refraining from providing additional information of which they are not the owner or which they are not authorized to transfer, as well as exercising any of the rights of access, rectification, cancellation, and objection under the terms set forth in this Notice.
Consent of the Data Subject
The Data Subject states that:
1. This Notice has been made known to them by ZUMMA. 2. They have read, understood, and agreed to the terms set forth in this Notice, and expressly grant their consent in writing regarding the processing of their Personal Data. 3. The Data Subject expressly grants their consent in writing for ZUMMA to process their Personal Data for the purposes referred to in the preceding section, specifically with respect to the purpose set forth in section I, item 4, related to the transfer of their Personal Data.
Quality Principle
ZUMMA assumes that the information provided by the Data Subject belongs to the Data Subject. If this is not the case, the Data Subject must immediately inform ZUMMA at +52 (55) 4808 1624 or by sending an email to that effect to hola@zummafinancial.com, which must include their contact information and any other information that allows a response to be given to such notice, refraining from providing additional information of which they are not the owner or which they are not authorized to transfer.
Options and Means to Limit the Use or Disclosure of Personal Data
If the Data Subject wishes to limit the use or disclosure of any of their Personal Data, they may at any time contact +52 (55) 4808 1624 or send an email to hola@zummafinancial.com addressed to Daniela Maria Lascurain Sarabia, including the Personal Data whose processing they wish to limit, the reasons why they wish to limit it, and the information that allows ZUMMA to follow up on such request. If the Data Subject’s request is appropriate, ZUMMA will register the Data Subject on the exclusion list prepared for this purpose with the relevant notes derived from the Data Subject’s request.
The Data Subject may revoke the aforementioned consent at any time. To revoke the consent given, the Data Subject must communicate such circumstance to ZUMMA at +52 (55) 4808 1624 or by sending an email to hola@zummafinancial.com addressed to Daniela Maria Lascurain Sarabia, indicating the reasons that motivate the revocation, as well as the information that allows ZUMMA to respond to and follow up on such revocation.
Rights of Access, Rectification, Cancellation, and Objection (“ARCO”)
Data Subjects or their legal representatives have the right to (i) know what Personal Data is processed by ZUMMA and the purposes of its processing (right of access); (ii) request the correction of their Personal Data if it is outdated, inaccurate, or incomplete (right of rectification); (iii) have their Personal Data removed from ZUMMA’s records or databases when they consider that it is not being used appropriately (right of cancellation); and (iv) object to the use of their Personal Data for specific purposes (right of objection) (collectively, the “ARCO” rights).
ARCO rights may be exercised at any time by calling +52 (55) 4808 1624 or sending an email to hola@tuzumma.com addressed to Daniela Maria Lascurain Sarabia. The request for any of the ARCO rights must be accompanied by the following:
1. The Data Subject’s name, address, and email, or any other means through which ZUMMA can communicate the response to their request. 2. Documents proving the identity or, where applicable, the legal representation of the Data Subject. 3. A clear and precise description of the Personal Data with respect to which the exercise of any of the ARCO rights is sought. 4. The reasons underlying or justifying the exercise of the corresponding ARCO right. 5. The format or means by which they wish ZUMMA to respond to their request, where applicable. 6. Any other element or document that facilitates follow-up on the Data Subject’s request.
ZUMMA will notify the Data Subject or legal representative, within a maximum period of 20 days from the date the request to exercise any of the ARCO rights was received, whether it is appropriate, taking into account any legal provision that Zumma must comply with. If the request is accepted, it will be carried out within 15 days following the date on which the response is communicated.
In the case of requests for ACCESS to Personal Data, delivery will proceed upon prior verification of the identity of the Data Subject or their legal representative. This request must necessarily be made in person at the offices designated by ZUMMA.
Retention and Security of Personal Data
The Data Controller and/or its processors (as applicable) safeguard and guarantee the security and confidentiality of the Data Subject’s information and documentation, as well as any reported acts, transactions, and services, for at least 10 years after the legal relationship between the Data Subject and the Data Controller ends, without prejudice to complying with the duties of confidentiality and security set forth in the Law and its regulations.
Use of Cookies, Web Beacons, or Other Technologies
The Website and the App use remote or local electronic, optical, or other technology communication mechanisms that allow them to automatically collect Personal Data simultaneously as the Data Subject interacts with them, including Cookies and Web Beacons, to simplify navigation.
Cookies are text files that are automatically downloaded and stored on the user’s mobile device when browsing a specific web page, which allow the Internet server to remember certain data about this user, including their purchasing preferences for viewing pages on that server, name, and password.
For their part, Web Beacons are images inserted into a web page or email, which can be used to monitor a visitor’s behavior, such as storing information about the user’s IP address, the duration of interaction time on that page, and the type of browser used, among others.
We inform you that we use Cookies and Web Beacons to obtain personal information from you, such as the following: (i) the type of browser and operating system you use; (ii) the web pages you visit before and after entering the Website; (iii) the links you follow and time spent on the Website; (iv) your IP address; (v) the place from which you visit the Website and browsing statistics. These Cookies and other technologies can be disabled. You can look for information about well-known browsers and find out how to adjust Cookie preferences on the website of each browser used.
Disclaimer of Liability
The Website and the App may contain links, hyperlinks, or hypertext (“links”), banners, buttons, and/or internet search tools that, when used by Data Subjects, take them to other portals or websites that may be owned by third parties. Therefore, ZUMMA does not control such sites and is not responsible for the privacy notices they display, or lack thereof; the Personal Data that Data Subjects may provide through such portals or websites other than the Website and the App is their own responsibility, so they should check the privacy notice of each website they access. Some links, banners, and/or buttons requesting Personal Data within the Website and the App are the responsibility of third parties unrelated to the Data Controller, who are sometimes service providers, and are therefore governed by their own terms and privacy policies.
Modifications to the Privacy Notice
The Data Controller reserves the right to periodically update or modify the Privacy Notice in accordance with changes in information practices, in response to legislative developments, as well as internal policies. Such modifications will be made available to the public through the Website and the App, in the Privacy Notice section. The Data Subject is advised or required to review the Privacy Notice at least every six months to stay up to date with its conditions and terms.
Last updated: October 2023