I. Information of the Data Controller

• Data Controller: [Name of the Express Company], with its registered address at [Specific Address]. [cite: 3]
• Contact Information of the Data Protection Officer: [Email] [cite: 4]
• Effective Date: [Specific Date] [cite: 5]
• Applicable Object: Franchise couriers [cite: 6]

II. Scope of Data Collection (Necessary Data)

1. Identity Information: Including name, date of birth, and Mexican identity card number. [cite: 8]
2. Work-related Data: Delivery vehicle information (such as license plate number, vehicle model), and bank account information (for remuneration settlement). [cite: 9]
3. System Operation Records: Login time, login device information (such as mobile phone model, device identification code). [cite: 10]

III. Purposes of Data Use

1. For the allocation and management of express orders during the delivery process: To ensure the efficient operation of services, which is data use based on legitimate interests. [cite: 12]
2. For remuneration settlement and relevant tax declarations: To fulfill contractual obligations with you. [cite: 13]
3. To meet the compliance audit requirements of local customs, tax and other regulatory authorities: This is an obligation stipulated by law. [cite: 14]

IV. Data Sharing and Cross-border Transmission

(1) Sharing Objects [cite: 16]
Payment Institutions: Only share your bank account information with cooperative banks or legal payment platforms to complete the payment of remuneration. [cite: 17]
Customs and Relevant Regulatory Authorities: Provide express-related data when necessary as required by law. [cite: 18]

(II) Cross-border Transmission [cite: 19]
If it involves transmitting your data outside of Mexico, the company will ensure that the recipient has an equivalent level of data protection and complies with relevant Mexican laws and regulations on cross-border data transmission, such as signing standard contract clauses that meet legal requirements. [cite: 20]

V. Data Protection Measures

(1) Technical Aspects [cite: 22]

• Use SSL encryption technology to ensure the security of data during transmission. [cite: 23]
• • Encrypt stored data using AES to prevent illegal access and theft of data. [cite: 24]
• • Implement an account dual-authentication mechanism, such as combining SMS verification codes with fingerprint recognition, to ensure the security of account login. [cite: 25, 26, 27]

(II) Management Aspects [cite: 28]

• • Strictly limit employees' access to your data, and only authorize specific-position personnel to access within the necessary scope. [cite: 29, 30]
• • Regularly organize employees to participate in data protection training to enhance their awareness of data protection. [cite: 31]
• • Develop a complete data breach emergency response plan. In the event of a data breach incident, you and relevant regulatory authorities will be notified within 72 hours, and necessary measures will be taken to reduce losses. [cite: 32]

VI. Your Rights

1. Right of Access: You have the right to obtain a copy of your personal data through the system designated by the company or by applying to the Data Protection Officer. [cite: 34]
2. Right of Correction: If you find that your personal data is incorrect or inaccurate, you can submit a correction request to the company at any time, and the company will complete verification and correction within 10 working days. [cite: 35]
3. Right of Deletion: When the cooperative relationship terminates and there is no legal requirement for retention, you have the right to request the company to delete your personal data. [cite: 36] However, tax-related data will be retained in accordance with the retention period stipulated by local laws, which is generally 7 years. [cite: 37, 38]
4. Right of Objection: For data processing activities carried out by the company based on legitimate interests, if you have reasonable grounds to object, you can raise it to the company, and the company will re-evaluate the data processing activities. [cite: 39]

VII. Statement Update

The company will regularly review and update the privacy statement to adapt to changes in Mexican laws and regulations and the development of the company's business. [cite: 41]
If there are significant changes to the privacy statement, the company will notify you 30 days in advance through methods such as emails and system notifications. [cite: 42]
Your continued use of the service is deemed as consent to the terms of the new privacy statement. [cite: 43]