Last updated: July 22, 2026

Pursuant to Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (the “LFPDPPP”), its Regulations, and other applicable provisions of the United Mexican States, Especialidades de Grafito, S.A. de C.V. (“ESGRAF” or the “Controller”) makes this comprehensive Privacy Notice (also referred to as the Privacy Policy) available to data subjects.

1. Identity and address of the Controller

Legal name: Especialidades de Grafito, S.A. de C.V. (ESGRAF)
Address: Triángulos 140, Arco Vial, García, Nuevo León, ZIP 66023, Mexico
Website: https://esgraf.com
Email for privacy and ARCO rights: [email protected]
Phone: +52 81 8381 0381

The department responsible for handling personal-data requests is Customer Service / Administration, through the channels above.

2. Personal data processed

Depending on how the data subject interacts with ESGRAF, the following categories of personal data may be processed:

2.1 Identification and contact data

Full name, email address, phone number, job title or role, and company or organization.

2.2 Commercial and quotation data

Industry, city, state, country, tax ID / RFC (when provided), shipping or billing address, order notes, technical specifications, quantities, units, grades or product references, and technical files (such as drawings) that the data subject chooses to submit.

2.3 Browsing and device data

IP address, browser type, preferred language, pages visited, date and time of access, and technical data generated through cookies or similar technologies. See the Cookie Notice.

2.4 Sensitive personal data

ESGRAF does not intentionally request or process sensitive personal data (for example, ethnic origin, health status, religious beliefs, biometric data, or sexual orientation) through the Site. If such data are received in error, they will be deleted or blocked as soon as reasonably practicable, unless a legal basis requires retention.

3. Purposes of processing

3.1 Primary purposes (necessary for the relationship with the data subject)

These purposes are necessary to handle your request or relationship with ESGRAF and, where applicable, do not require additional consent when processing is indispensable to perform a legal relationship or a request made by the data subject (LFPDPPP Articles 7 and 9):

Responding to and following up on information, contact, technical, or commercial requests.
Preparing, sending, and following up on quotations and commercial proposals.
Managing orders, deliveries, invoicing, and operational communications related to products or services.
Verifying the requester’s identity and the accuracy of information provided, to the extent necessary.
Complying with legal, regulatory, tax, accounting obligations, or competent authority requirements.
Maintaining records of communications and transactions for security, audit, and defense of ESGRAF’s rights.
Operating, maintaining, and improving Site security (including anti-fraud and infrastructure protection measures).

The following purposes require the data subject’s consent; if you do not want your data used for them, you may object or limit use under Section 5:

Sending marketing communications, newsletters, or information about ESGRAF products, services, or events.
Preparing business statistics and indicators from dissociated or aggregated data to improve products, content, and Site experience.
Conducting satisfaction surveys or market research related to ESGRAF services.

Consent for secondary purposes may be obtained expressly (for example, an acceptance checkbox in forms) or tacitly, when this Privacy Notice has been made available and the data subject does not express a contrary will, pursuant to LFPDPPP Article 7. Consent may be revoked at any time without retroactive effect.

4. Transfers of personal data

ESGRAF may disclose personal data to:

Service providers acting as processors (for example, web hosting, transactional email, security, analytics, or IT support), solely for the purposes stated in this notice and under confidentiality obligations.
Competent authorities, where there is a legal basis, court order, or duly grounded requirement.
ESGRAF affiliates, subsidiaries, or related parties, when necessary for commercial or operational handling of your request.

Where a transfer requires consent under the LFPDPPP and no statutory exception applies, ESGRAF will obtain consent in advance. Use of technology providers may involve processing outside Mexico; in such cases, ESGRAF seeks appropriate contractual and security measures.

5. Options to limit use or disclosure

Data subjects may limit use or disclosure of their personal data for secondary purposes by:

Emailing [email protected] with the subject line “Limitation of use of personal data.”
Using the unsubscribe mechanism included in marketing communications, where applicable.
Configuring cookies and browser preferences, as described in the Cookie Notice.

Data subjects, or their legal representatives, may exercise Access, Rectification, Cancellation, and Opposition (ARCO) rights, and revoke consent to processing, pursuant to LFPDPPP Articles 21 to 33.

6.1 How to submit a request

Send your request to [email protected] with the subject “Exercise of ARCO rights,” or in writing to the Controller’s address, including:

Full name of the data subject and a means to receive notifications (email or address).
Documents proving the data subject’s identity or, where applicable, the representative’s authority.
A clear description of the data regarding which the right is sought (except for access).
The ARCO right to be exercised or a precise description of the request.
Any element that facilitates locating the data.
For rectification: the requested changes and supporting documentation.

6.2 Response timelines

ESGRAF will communicate its determination within a maximum of twenty business days from receipt of the request. If granted, it will be implemented within fifteen business days after the response is communicated. Those periods may be extended once for an equal period when circumstances justify it, pursuant to LFPDPPP Article 31.

6.3 Denial

ESGRAF may deny ARCO requests in the cases provided by the LFPDPPP (for example, lack of identity verification, data not in its possession, harm to third-party rights, or legal impediment).

7. Cookies and similar technologies

The Site uses cookies and similar technologies to operate correctly, remember preferences (such as language), and, where applicable, obtain usage metrics. Details are in the Cookie Notice.

8. Security measures

ESGRAF implements reasonable administrative, technical, and physical measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, in accordance with the LFPDPPP. No system is absolutely secure; the data subject acknowledges the inherent risks of transmitting information over the internet.

9. Data retention

Personal data will be retained for as long as necessary to fulfill the stated purposes and applicable legal, accounting, or contractual obligations. Thereafter, data may be blocked during the statute-of-limitations period for legal actions and, in due course, cancelled or securely deleted.

10. Minors’ data

The Site is not directed to minors. If ESGRAF becomes aware that it has collected a minor’s data without consent from the person exercising parental authority or guardianship, it will take reasonable steps to delete them.

11. Changes to this Privacy Notice

ESGRAF may amend this Privacy Notice to reflect legal, operational, or service changes. Updates will be published at https://esgraf.com/en/legal/privacy-policy (or the equivalent URL on the Site) with the last-updated date. Data subjects are encouraged to review this document periodically.

12. Competent authority

If a data subject believes that their right to personal data protection has been violated, they may file the applicable complaint before the competent authority for protection of personal data held by private parties in Mexico, under the rules then in force.

By providing personal data through Site forms, checking the applicable acceptance box, or continuing to interact with ESGRAF after this Privacy Notice has been made available, the data subject acknowledges having read it and accepts processing of their data under the terms described herein, to the extent applicable under the LFPDPPP.