# Privacy Policy

Comprehensive privacy notice of Especialidades de Grafito, S.A. de C.V., under Mexico’s LFPDPPP.

Source: https://esgraf.com/en/legal/privacy-policy

**Last updated:** August 31, 2026

Pursuant to Mexico’s **Federal Law on the Protection of Personal Data Held by Private Parties** (the “**LFPDPPP**”), its Regulations, and other applicable provisions of the United Mexican States, **Especialidades de Grafito, S.A. de C.V.** (“**ESGRAF**” or the “**Controller**”) makes this **comprehensive Privacy Notice** (also referred to as the Privacy Policy) available to data subjects.

## 1. Identity and address of the Controller

- **Legal name:** Especialidades de Grafito, S.A. de C.V. (ESGRAF)
- **Address:** Triángulos 140, Arco Vial, García, Nuevo León, ZIP 66023, Mexico
- **Website:** [https://esgraf.com](https://esgraf.com)
- **Email for privacy and ARCO rights:** [info@esgraf.com](mailto:info@esgraf.com)
- **Phone:** +52 81 8381 0381

The department responsible for handling personal-data requests is **Customer Service / Administration**, through the channels above.

## 2. Personal data processed

Depending on how the data subject interacts with ESGRAF, the following categories of personal data may be processed:

### 2.1 Identification and contact data

Full name, email address, phone number, job title or role, and company or organization.

### 2.2 Commercial and quotation data

Industry, city, state, country, tax ID / RFC (when provided), shipping or billing address, order notes, technical specifications, quantities, units, grades or product references, and technical files (such as drawings) that the data subject chooses to submit.

### 2.3 Browsing and device data

IP address, browser type, preferred language, pages visited, date and time of access, Site interaction events (for example, contact form submission or clicks on email, phone, WhatsApp, or map links), and other technical data generated through cookies, pixels, or similar technologies.

When the data subject accepts analytics and advertising cookies, ESGRAF uses **Google Tag Manager** (“**GTM**”) to enable **Google Analytics 4** (“**GA4**”) and **Google Ads** (formerly Google AdWords) to measure Site usage and the effectiveness of ESGRAF’s own campaigns. Details on cookies, providers, and consent are in the [Cookie Notice](https://esgraf.com/en/legal/cookie-notice).

### 2.4 Sensitive personal data

ESGRAF **does not intentionally request or process sensitive personal data** (for example, ethnic origin, health status, religious beliefs, biometric data, or sexual orientation) through the Site. If such data are received in error, they will be deleted or blocked as soon as reasonably practicable, unless a legal basis requires retention.

## 3. Purposes of processing

### 3.1 Primary purposes (necessary for the relationship with the data subject)

These purposes are necessary to handle your request or relationship with ESGRAF and, where applicable, do not require additional consent when processing is indispensable to perform a legal relationship or a request made by the data subject (LFPDPPP Articles 7 and 9):

1. Responding to and following up on information, contact, technical, or commercial requests.
2. Preparing, sending, and following up on quotations and commercial proposals.
3. Managing orders, deliveries, invoicing, and operational communications related to products or services.
4. Verifying the requester’s identity and the accuracy of information provided, to the extent necessary.
5. Complying with legal, regulatory, tax, accounting obligations, or competent authority requirements.
6. Maintaining records of communications and transactions for security, audit, and defense of ESGRAF’s rights.
7. Operating, maintaining, and improving Site security (including anti-fraud and infrastructure protection measures).

### 3.2 Secondary purposes (require consent)

The following purposes require the data subject’s consent; if you do not want your data used for them, you may object or limit use under Section 5:

1. **Site and campaign measurement and improvement.** Measure—in aggregated or pseudonymized form—how the Site is used and evaluate the effectiveness of ESGRAF’s own advertising through GTM, GA4, and Google Ads, **solely to improve our products, content, services, and browsing experience**. These tools are activated only if the data subject accepts analytics and advertising cookies.
2. Sending marketing communications, newsletters, or information about ESGRAF products, services, or events.
3. Preparing business statistics and indicators from dissociated or aggregated data to improve products, content, and Site experience.
4. Conducting satisfaction surveys or market research related to ESGRAF services.

**ESGRAF does not sell personal data to third parties** for commercial purposes, independent advertising, or profiling unrelated to improving its own services.

Consent for secondary purposes may be obtained expressly (for example, an acceptance checkbox in forms or the cookie banner) or tacitly, when this Privacy Notice has been made available and the data subject does not express a contrary will, pursuant to LFPDPPP Article 7. Consent may be revoked at any time without retroactive effect.

## 4. Transfers of personal data

ESGRAF may disclose personal data to:

- Service providers acting as **processors** (for example, web hosting, transactional email, security, IT support, **Google Tag Manager**, **Google Analytics 4**, and **Google Ads**), solely for the purposes stated in this notice and under confidentiality obligations.
- Competent authorities, where there is a legal basis, court order, or duly grounded requirement.
- ESGRAF affiliates, subsidiaries, or related parties, when necessary for commercial or operational handling of your request.

**ESGRAF does not sell, assign, or trade personal data to third parties** for their own purposes unrelated to providing services to ESGRAF. Disclosures to technology providers (including Google LLC and/or its affiliates) are made solely to enable the purposes described in this notice—in particular, operating, measuring, and improving the Site and ESGRAF’s campaigns—and do not constitute a sale of data.

Where a transfer requires consent under the LFPDPPP and no statutory exception applies, ESGRAF will obtain consent in advance. Use of technology providers may involve processing outside Mexico (for example, in the United States or Ireland); in such cases, ESGRAF seeks appropriate contractual and security measures.

## 5. Options to limit use or disclosure

Data subjects may limit use or disclosure of their personal data for secondary purposes by:

- Emailing [info@esgraf.com](mailto:info@esgraf.com) with the subject line “Limitation of use of personal data.”
- Using the unsubscribe mechanism included in marketing communications, where applicable.
- Using the **“Cookie settings”** link in the Site footer to accept or reject analytics and advertising cookies (GTM, GA4, and Google Ads).
- Configuring cookies and browser preferences, as described in the [Cookie Notice](https://esgraf.com/en/legal/cookie-notice).

## 6. ARCO rights and revocation of consent

Data subjects, or their legal representatives, may exercise **Access, Rectification, Cancellation, and Opposition (ARCO)** rights, and revoke consent to processing, pursuant to LFPDPPP Articles 21 to 33.

### 6.1 How to submit a request

Send your request to [info@esgraf.com](mailto:info@esgraf.com) with the subject “Exercise of ARCO rights,” or in writing to the Controller’s address, including:

1. Full name of the data subject and a means to receive notifications (email or address).
2. Documents proving the data subject’s identity or, where applicable, the representative’s authority.
3. A clear description of the data regarding which the right is sought (except for access).
4. The ARCO right to be exercised or a precise description of the request.
5. Any element that facilitates locating the data.
6. For rectification: the requested changes and supporting documentation.

### 6.2 Response timelines

ESGRAF will communicate its determination within a maximum of **twenty business days** from receipt of the request. If granted, it will be implemented within **fifteen business days** after the response is communicated. Those periods may be extended once for an equal period when circumstances justify it, pursuant to LFPDPPP Article 31.

### 6.3 Denial

ESGRAF may deny ARCO requests in the cases provided by the LFPDPPP (for example, lack of identity verification, data not in its possession, harm to third-party rights, or legal impediment).

## 7. Cookies and similar technologies

The Site uses cookies and similar technologies to operate correctly, remember preferences (such as language), and, when the data subject consents, obtain usage metrics and measure ESGRAF’s own advertising campaigns.

ESGRAF implements **Google Tag Manager** to manage **Google Analytics 4** and **Google Ads** tags, together with **Google Consent Mode**: analytics and advertising cookies remain disabled until the data subject accepts them in the Site banner or expressly rejects them. Data obtained through these tools is used **solely to improve our services, content, and campaigns**; **ESGRAF does not sell this data to third parties**.

Details on cookies, providers, measured events, and management options are in the [Cookie Notice](https://esgraf.com/en/legal/cookie-notice).

## 8. Security measures

ESGRAF implements reasonable administrative, technical, and physical measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, in accordance with the LFPDPPP. No system is absolutely secure; the data subject acknowledges the inherent risks of transmitting information over the internet.

## 9. Data retention

Personal data will be retained for as long as necessary to fulfill the stated purposes and applicable legal, accounting, or contractual obligations. Thereafter, data may be blocked during the statute-of-limitations period for legal actions and, in due course, cancelled or securely deleted.

## 10. Minors’ data

The Site is not directed to minors. If ESGRAF becomes aware that it has collected a minor’s data without consent from the person exercising parental authority or guardianship, it will take reasonable steps to delete them.

## 11. Changes to this Privacy Notice

ESGRAF may amend this Privacy Notice to reflect legal, operational, or service changes. Updates will be published at [https://esgraf.com/en/legal/privacy-policy](https://esgraf.com/en/legal/privacy-policy) (or the equivalent URL on the Site) with the last-updated date. Data subjects are encouraged to review this document periodically.

## 12. Competent authority

If a data subject believes that their right to personal data protection has been violated, they may file the applicable complaint before the competent authority for protection of personal data held by private parties in Mexico, under the rules then in force.

## 13. Consent

By providing personal data through Site forms, checking the applicable acceptance box, or continuing to interact with ESGRAF after this Privacy Notice has been made available, the data subject acknowledges having read it and accepts processing of their data under the terms described herein, to the extent applicable under the LFPDPPP.