Privacy Notice

Comprehensive version for the website, e-commerce and B2B digital interactions

1. Identity of the Controller

ETHICSGLOBAL, S.A.P.I. DE C.V., Mexican Federal Taxpayer Registry (RFC) ETH160802QMA, with address at Montecito 38, 42nd floor, office 17, Colonia Nápoles, Benito Juárez, Mexico City, Postal Code 03810, Mexico (“EthicsGlobal”), is the controller of the personal data described in this Notice when it determines the purposes and means of processing.

Privacy contact: privacy@ethicsglobal.com

2. Scope and Allocation of Responsibilities

This Notice applies to EthicsGlobal websites, forms, accounts, B2B online store, appointments, newsletter, commercial chat, recruitment processes and other digital experiences that expressly link to it.

The contents of reports, complaints, ethics inquiries and case files managed in CaseManager for a client organization are not primarily governed by this Notice. For those processing activities, the client organization normally determines the purposes and acts as controller, while EthicsGlobal provides services as processor under the applicable agreement, service order, data processing agreement and privacy notice made available by the organization to its users.

This website is intended exclusively for business customers. An individual may contract only when acting for business or professional purposes and having authority to bind the Business Customer.

3. Personal Data We May Process

1. Identification and contact information: name, email address, telephone number, address and signature or evidence of acceptance.
2. Professional and business information: company, job title, department, website, country, language and relationship with the organization.
3. Account information: username, protected credentials, permissions, sessions and access logs.
4. Contracting and billing information: legal name, RFC or equivalent tax identifier, tax address, plan, service model, covered employees, services, amounts, currency, orders, invoices and subscriptions.
5. Payment information: status, amount, payment-processor reference, card brand and last digits when provided by the payment provider. EthicsGlobal does not intend to receive or store full card numbers or security codes.
6. Technical and usage information: IP address, device, browser, pages visited, events, approximate country, language, cookies, local storage, campaign source and conversions.
7. Communications: messages, requests, support conversations, appointments, commercial notes and telephone metadata.
8. Newsletter: subscription status and date, language, country and engagement metrics when enabled.
9. Recruitment: résumé, experience, LinkedIn profile, cover letter or introduction and contact information provided by the candidate.

4. How We Obtain Personal Data

1. Directly from you when you complete forms, create an account, schedule an appointment, make a purchase, subscribe to the newsletter, contact support or apply for a position.
2. From your organization when it creates or administers your access, appoints you as a contact or provides information required for the business relationship.
3. Automatically through Odoo, security logs, cookies, local storage and measurement technologies, according to your privacy choices.
4. From payment providers, banks, telecommunications operators and other service providers that confirm transactions or communications.

5. Purposes and Legal Bases

Legal bases are interpreted under applicable law. Where we rely on consent, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal.

6. Newsletter and Communications

EthicsGlobal will send news and updates only to individuals who voluntarily subscribe. The checkbox will not be preselected and subscribing will not be a condition of a demonstration, purchase or access to the service. Each message will include an unsubscribe method. We will not use WhatsApp for advertising under this program. Communications necessary for a purchase, security, billing or delivery of the service are not advertising and may be sent while an active relationship or request exists.

7. Cookies and Similar Technologies

We use essential technologies for sessions, security, preferences, the shopping cart and website operation. Subject to your choice, we may use optional analytics and advertising technologies to measure website activity and Google Ads conversions. You may accept or reject optional cookies using Odoo's cookie bar and review their names, categories, purposes and durations at /cookie-policy.

Google Consent Mode v2 communicates consent status to Google tags. Depending on your choice, tags adapt their behavior and may send cookieless signals for measurement and modeling, as described in the Cookie Policy.

8. Service Providers and Recipients

1. Odoo SA and its infrastructure subprocessors, to host and operate the website, online store, CRM, accounts, orders, billing and subscriptions.
2. Amazon Web Services, for EthicsGlobal's CaseManager, Mailcow and Chatwoot infrastructure.
3. Stripe and banking institutions, for payments, reconciliation, fraud prevention and refunds.
4. Google, for Analytics, Tag Manager and Ads, according to your cookie choices and the consent configuration.
5. Alestra, TollFreeForwarding and other operators, for telephone communications depending on the country.
6. Frankfurter or another exchange-rate provider, when the browser requests a currency reference.
7. Professional advisers, auditors, insurers and public authorities, where there is a legal obligation, claim, incident or legitimate and proportionate need.

Service providers receive only the data necessary for their function and, when acting on behalf of EthicsGlobal, are subject to agreements, instructions, confidentiality and security measures.

9. International Hosting and Data Transfers

EthicsGlobal is established in Mexico and uses service providers and infrastructure that may process information in different countries. The website and online store run on Odoo.sh with primary hosting in the United States. Under Odoo's architecture, certain backups and ancillary services may be processed in Canada or Europe, and individual backup locations cannot always be restricted for each customer.

CaseManager is hosted primarily on AWS. Where a service order requires regional data residency, EthicsGlobal will configure the primary database, backups and components that store customer data in the agreed region, subject to the documented architecture. Exceptional remote support access will be authorized, limited, logged and performed in accordance with instructions and least-privilege controls.

Where an international transfer is restricted, we will use the applicable mechanism, such as adequacy decisions, Standard Contractual Clauses, transfer addenda, clauses issued by the Brazilian authority or other recognized safeguards. We will also assess supplementary technical and organizational measures.

10. Retention

At the end of the applicable period, personal data will be deleted, anonymized or blocked, unless retention is required for legal obligations, audits, claims or the defense of rights.

11. Security

We use AWS encryption services and AWS Key Management Service (KMS) for key management; certain implementations may use customer-managed or customer-controlled keys as provided in the contracted architecture.

 No system is completely invulnerable, and we review our safeguards in light of risks and technological developments.

12. Your Privacy Rights

You may write to privacy@ethicsglobal.com to request access, rectification, cancellation or erasure, objection, restriction, portability, withdrawal of consent or any other right recognized in your jurisdiction.

1. Your name and a means by which we may communicate our response.
2. Your relationship with EthicsGlobal and a clear description of the request.
3. Information reasonably necessary to locate the personal data.
4. Documentation necessary to verify identity or authority to act for another person, while avoiding requests for excessive information.

We will respond within the time limits required by applicable law. We may retain minimum evidence of the request and request additional information where necessary to prevent unauthorized access or deletion. Where permitted by law, you may also lodge a complaint with the competent authority in your place of residence.

13. Regional Information

Mexico

You may exercise ARCO rights (access, rectification, cancellation and objection), withdraw consent and request restriction of use or disclosure. Transfers and disclosures to processors will be conducted in accordance with the LFPDPPP and other applicable provisions.

European Economic Area and United Kingdom

Where the GDPR or UK GDPR applies, you may request access, rectification, erasure, restriction and portability, object to processing, withdraw consent and lodge a complaint with a supervisory authority. We do not use the website or checkout to make solely automated decisions that produce legal or similarly significant effects. Before directing material campaigns to these regions, EthicsGlobal will assess and, where required, appoint a representative under Article 27 GDPR or the corresponding UK rules.

Brazil

Where the LGPD applies, you may request confirmation, access, correction, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability where applicable, information about sharing and withdrawal of consent, and you may contact the ANPD.

California and Other U.S. States

Where an applicable state law requires it, you may have rights to know, access, correct or delete personal information, obtain portability and opt out of sale or sharing for cross-context behavioral advertising, without discrimination. EthicsGlobal does not sell personal information for money. Certain advertising technologies may constitute “sharing” under some laws; where required, we will provide applicable choices and honor preference signals, including Global Privacy Control.

14. Minors and Automated Decision-Making

The website and B2B contracting process are not directed to individuals under 18 years of age. If we learn that a minor submitted personal data through these channels without a valid legal basis, we will take reasonable steps to delete it. EthicsGlobal does not use the website or checkout to make solely automated decisions that have legal or similarly significant effects on an individual.

15. Changes to This Notice

We may update this Notice to reflect legal, operational, technological or service-provider changes. We will publish the current version and its effective date and, where a change is material and applicable law requires it, provide additional notice or obtain consent again.

16. Contact

Last updated: August 29, 2026 · Version 1.0