Mexico Data Protection Notice

INTRODUCTION

Revised October 2024

This Data Privacy Notice describes the practices of ComPsych Corporation and its affiliates, including ComPsych International, Inc., (collectively “Company”) with respect to the collection, use, storage, and disclosure (“processing”) of Personal Information covered by applicable law in Mexico (collectively referred to as the “Data Protection Regulations” for purposes of this Notice), about users or potential users in Mexico.

“Personal Information,” as used in this Notice, means any information that can be used to identify you, whether directly or indirectly, including by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to your physical, physiological, genetic, mental, economic, cultural or social identity.

The Information We Process About You

We process the information we collect from you directly and indirectly when you inquire about, access, and use the services. This information may include:

  • Your name, contact information, username, and password.
  • Information about your employer.
  • Information you provide on your health and wellbeing. This is considered sensitive personal information and is the only sensitive information we process.
  • Information collected automatically when you access our websites, such as your IP address and internet or other electronic network activity information.

Company collects and processes Personal Information in accordance with applicable law. The Personal Information is used and disclosed as described below.

When using ComPsych’s website, you acquire services directly from ComPsych, who offers them from the United States. By interacting with our website you choose to share your Personal Data to be stored or otherwise processed in servers and databases located in the United States.

When using services provided by Bienestar PAE, in Mexico, your Personal Data will be stored or otherwise processed in servers and databases located in Mexico.

Purposes and Legal Basis for Processing Your Data

The Personal Information held by Company is collected and processed to provide the information and services offered by our employee assistance programs. We also use this data only for the following purposes that are related to the origination, performance and maintenance of our legal relationship with you: (a) to manage and administer employee assistance programs, behavioral health programs, work-life services, and health and wellness programs, including to personalize the services; (b) to communicate with you; (c) to provide customer service or technical support; (d) to assess and improve the quality of our website, products, services and business operations; (e) to satisfy legal, governmental reporting, and tax requirements; (f) to address security, health, and safety concerns; (g) to plan and implement potential acquisitions and mergers; and (h) for other business-related purposes permitted, such as resolving billing disputes with employers, or required under applicable local laws and regulations.

In the case of Sensitive Personal Information (which means Personal Data that discloses a data subject’s medical or health condition, race or ethnicity, political, religious or philosophical affiliations or opinions, sexual orientation or trade union membership), we process information either (i) because we have your consent to do so, (ii) because we are required to process the information to comply with applicable laws, or (iii) because processing is necessary for the provision of services to you.

Company may process Personal Information and/or Sensitive Personal Information where such processing: (a) is based on the consent of the data subject; (b) processing is required by law; (c) data is publicly available; (d) data is anonymized or de-identified; (e) contract performance; (f) emergency situation that may cause injuries to the person or damages to its assets; (g) processing is essential to provide medical assistance, prevent, diagnose, provide sanitary assistance, medical treatment or management of health services as long as the data subject is not able to consent; or (h) there is a government order; or (i) as otherwise required or permitted by law.

When we process your Personal Information or Sensitive Personal Information to meet our legitimate interests, we take steps to ensure that your rights are not infringed. You can contact us using the details in the “Data Subject Rights” section below for more information.

Where required by applicable law, we process Personal Information and Sensitive Information on the basis of your consent, as provided by you by your affirmative action, such as, in the form of clicking a checkbox. Such action will also signify unambiguous consent in countries and circumstances where ComPsych is required to obtain consent to collect certain elements of Personal Information and Sensitive Personal Information from you. When we process your Personal Information and Sensitive Personal Information on the basis of your consent, you may withdraw that consent at any time by contacting our Privacy Official. If you withdraw your consent, we may still be required to process your Personal Information and Sensitive Personal Information to comply with applicable law, but we will explain to you at the time your consent is withdrawn what processing activities will continue for legal compliance purposes.

If you have further queries about to the processing of your information, including Sensitive Personal Information, related to use of ComPsych’s website please contact our Privacy Official at [email protected].

If you have further queries about the processing of your information, including Sensitive Personal Information, related to services provided in Mexico, please contact our the Privacy Official of our Global Partner in Mexico, Bienestar PAE at [email protected].

We may also deidentify or anonymize your information in such a way that you may not reasonably be re-identified by us or another party, and we may use this deidentified data for any purpose. To the extent we deidentify any data originally based on Personal Information or Sensitive Personal Information, we will maintain and use such information in deidentified form and will not attempt to reidentify the data.

Recipients of Your Personal Information

Your Personal Information will be received and processed by Company. We may also disclose the Personal Information described above in order to fulfil our obligations and for the business purposes described above as follows:

  • Business Transfers. If (i) we are or may be acquired by, merged with, or invested in by another company, or (ii) if any of our assets are or may be transferred to another company, whether as part of a divestiture, bankruptcy or insolvency proceeding or otherwise, we may transfer the information we have collected about you to the other company. As part of the business transfer process, we may disclose certain of your information with lenders, auditors, and third party advisors, including attorneys and consultants. We do not need your consent for this transfer.
  • In Response to Legal Process. We may disclose your Personal Information to comply with the law, a judicial or administrative proceeding, court order, or other legal process, such as in response to a court order or a subpoena. We do not need your consent for this transfer.
  • To Protect Us and Others. We disclose your Personal Information where we believe it is appropriate to do so to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of ComPsych policies, or as evidence in litigation in which we are involved. We do not need your consent for this transfer.
  • Aggregate and De-Identified Information. We may disclose aggregate, anonymized, or de-identified information about you for any purpose permitted under applicable local law.
  • Consent. We may also disclose your Personal Information with your consent, where permitted by applicable local law.

Retention

Personal Information will be retained only for as long as it is needed for ComPsych’s purposes as described above or retention is required as a matter of contract or law.

Data Subject Rights

You have the right to the following information regarding Company’s processing of your Personal Information:

  • the purposes of the processing,
  • the categories of Personal Information collected,
  • the recipients or categories of recipients to whom the Personal Information has been or will be disclosed,
  • where possible, the predicted period for which the Personal Information will be stored, or, if not possible, the criteria used to determine that period.

This Notice is intended to provide this information. Any questions about these details may be directed to our Privacy Official.

Depending on the jurisdiction where you are located, you may also have the following additional rights with respect to your Personal Information processed by Company:

  • The right to request access to the Personal Information that Company has collected about you
  • The right to request rectification of any data that is inaccurate or incomplete.
  • The right to request a copy of your Personal Information in electronic format so that you can transmit the data to third parties, or to request that Company directly transfer your Personal Information to one or more third parties.
  • The right to object to the processing of your Personal Information for certain purposes.
  • The right to erasure of your Personal Information when it is no longer needed for the purposes for which you provided it, as well as the right to restriction of processing of your Personal Information to certain limited purposes, where erasure is not possible.
  • The right to lodge a complaint with the supervisory authority for the country where you live or work or where you believe that your rights have been violated.
  • Company does not operate any automated decision-making systems, so the right to opt-out of such is not applicable.

For additional information related to your rights or to make a request related to use of ComPsych’s website please contact our Privacy Official at [email protected].

For additional information related to your rights or to make a request related to related to services provided in Mexico, please contact our the Privacy Official of our Global Partner in Mexico Bienestar PAE at [email protected]

ComPsych Corporation is the Controller of data collected through the use ComPsych’s website. The company’s corporate headquarters are located at:

ComPsych Corporation
455 N. Cityfront Plaza Drive, 13th Floor
Chicago, IL 60611
USA

Bienestar PAE is the Controller of data collected during the provision of EAP services in Mexico. The company’s corporate headquarters are located at:

Bienestar PAE

Avenida Del Libertador 6049

1° piso “B” de la Ciudad Autónoma de Buenos Aires

República Argentina(C1428ARD)

(+52) 800 507 3120

International Transfers

Your Personal Information will be transferred to, stored or otherwise processed in servers and databases located outside of the jurisdiction in which you reside and where the privacy laws may not be as protective as your jurisdiction of residence (such as the United States). Where legally required, we have put in place appropriate safeguards, such as compliance with the Data Privacy Framework, to protect your personal information.

For more information on the appropriate safeguards in place, please contact us through the information provided in the section above.

Right to Withdraw Consent

When we process your Personal Information and Sensitive Personal Information on the basis of your consent, you may withdraw that consent at any time by contacting:

ComPsych’s Privacy Official related to use of ComPsych’s website at [email protected], or Bienestar PAE related to services provided in Mexico, at [email protected].

If you withdraw your consent, we may still be required to process your Personal Information and Sensitive Personal Information to comply with applicable law, but we will explain to you at the time your consent is withdrawn what processing activities will continue for legal compliance purposes.

Right to Limit Use or Disclosure of your Personal Information

You may limit the use and disclosure of the Personal Information by means of a request addressed to:

ComPsych’s Privacy Official related to use of ComPsych’s website at [email protected], or Bienestar PAE related to services provided in Mexico, at [email protected].

Use of Cookies and Other Identifiers

To learn about how we use cookies, please read our Terms of Use[A1] .

Questions or Complaints

Our Company welcomes communication from you related to this Notice, your rights and any comments or complaints you may have related to the privacy of the Personal Information we process about you.

Company reserves the right to revise this Notice to ensure compliance with applicable law and regulatory guidance at any time. Revised notices will be posted on our website.