Help center

Comprehensive Privacy Notice

Version 1.0 · In force from [EFFECTIVE DATE] · Draft pending legal review

This is a translation for convenience. The Spanish version, Aviso de Privacidad Integral, is the governing version and prevails in case of any difference.

This document is the comprehensive privacy notice required by article 15 of Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette (Diario Oficial de la Federación) on 20 March 2025 (the "Law"). It explains who processes your data, which data, what for, who we share it with, how to limit its use and how to exercise your rights.

1. Identity and address of the controller

• Legal name: [LEGAL NAME], which operates the Bluegreen brand
• Tax ID (RFC): [RFC]
• Address: [FULL REGISTERED ADDRESS]
• Email for privacy and ARCO rights: [EMAIL FOR ARCO RIGHTS]
• Phone: [PHONE]
• Site: https://bluegreenmaterials.com

2. Who this notice applies to

Bluegreen buys steel scrap from companies, coordinates its transport with carriers and sells it to mills and foundries. It is a business-to-business service. This notice applies to the personal data of people who, on their own account or on behalf of a company:

• Contact us through the site or by email.
• Sell or buy scrap with us.
• Move material on our behalf, as logistics partners or drivers.
• Use the portal or the Bluegreen team's internal panel.
• Apply to a position or leave us their CV on the careers page.

3. Personal data we process

3.1 Data you give us

3.2 Data generated when you use the portal

• Sessions: the device, IP address and dates of each open session, so you can see and close your sessions and so we can detect suspicious access.
• Electronic signatures: who signed, and the date, time and IP address from which they signed.
• Location when signing on site: the device location at the moment of signing a handover record, only if you grant the permission in your browser. If you do not, you can still sign.
• Chain of custody: the record of each change of hands of a lot, with who delivered, who received and when.
• Team activity log: which member of the Bluegreen team made which change and when, for audit purposes.

3.3 Sensitive personal data

For some signatures to carry greater evidentiary weight, we may ask you to verify your identity: a photo of your official ID and a photo of your face (selfie), compared biometrically.

Biometric data is sensitive personal data. We only process it with your express consent, which we ask for separately, before starting the verification and with no pre-ticked boxes. Verification is carried out by [IDENTITY VERIFICATION PROVIDER] on our behalf. This feature is not active yet; once it is, you will see it in the portal before you are asked.

If you do not give your consent, we will not be able to complete the verification that some signatures require. Write to us and we will look at another way to document the transaction with you.

3.4 If you apply to a position

When you apply or leave us your CV we process your name, email, phone, city, LinkedIn profile if you give it, your CV, what you write about your experience and your answers to the position's questions. We use them only to assess your application, write to you about it and, if you leave your CV on file, consider you for future positions. Your CV is kept in private storage and only the Bluegreen staff in charge of hiring see it. We do not share it with third parties or use it for anything else.

3.5 Data about other people that you give us

If you give us data about other people (for example, the on-site contact, your drivers or whoever signs for your company), it is up to you to have informed them and to have their authorisation to share it with us.

4. What we use your data for

4.1 Purposes necessary for the relationship

These purposes are necessary to buy from you, sell to you or move material, and to run the portal:

• Answer your request, grade your material and make you an offer.
• Give you portal access, keep your account secure and tell you what happens with your lots.
• Schedule pickups and deliveries, and document the chain of custody.
• Issue and receive CFDI invoices, apply withholdings and meet tax and transport obligations, including the Carta Porte.
• Verify the identity of signers, so signatures have evidentiary value.
• Issue environmental impact certificates and allow their public verification, which shows no personal data.
• Prevent fraud, material theft and misuse of the platform.
• Meet the legal obligations that apply to us and respond to requests from authorities.

4.2 Purposes that are not necessary

• Send you Bluegreen news, reference prices and announcements.

You can refuse this purpose at any time (see §6). Refusing does not affect your relationship with us. Service notices about your account, your lots, your payments and your account security always reach you, because they are part of the relationship.

4.3 What we do not do

• We do not sell personal data.
• We do not share it for advertising.
• We do not use analytics or advertising tools on the site or in the portal.

5. Who we share your data with

5.1 Counterparties in each transaction

We share what is essential with those involved in the transaction. For example, the carrier collecting your lot receives the address and the on-site contact, and the mill receiving it sees the transport documents and handover records that concern it.

5.2 Providers that process data on our behalf

We use providers that process data only to provide their service to us, on our behalf and under our instructions:

Some of these providers store data outside Mexico. We only use providers that commit to process data on our behalf and to protect it with security measures.

5.3 Authorities

We share data with authorities when a law or an order requires it, for example the SAT (tax authority) for tax and Carta Porte matters, or an authority investigating material theft.

5.4 Change of control

If [LEGAL NAME] merges, is acquired or transfers its business, the data may pass to the new entity, which will be bound by this notice.

6. How to limit the use or disclosure of your data

• News and announcements: use the link at the foot of each announcement, change your notice preferences in the portal or write to [EMAIL FOR ARCO RIGHTS].
• Location when signing: do not grant the location permission in your browser, or withdraw it from its settings.
• Identity verification: do not give your consent, or revoke it by writing to us (see §3.3).
• Other uses: write to [EMAIL FOR ARCO RIGHTS] and tell us which use you want to limit.

7. Your rights and how to exercise them

7.1 ARCO rights and revocation

You have the right to:

• Access your personal data and know how we process it.
• Rectify it if it is inaccurate or incomplete.
• Cancel it when you consider it is not needed for the purposes of this notice.
• Object to its processing for specific purposes.
• Revoke the consent you gave us, unless the law or a transaction in progress requires us to keep processing it.

7.2 How to submit your request

Send your request to [EMAIL FOR ARCO RIGHTS] with:

1. Your full name and a way to reply to you.
2. A current official ID or, if you act for someone else, the document proving your representation.
3. A clear description of the right you want to exercise and the data it refers to.
4. Anything that helps us find your information, such as your account email or a lot number.

We will answer within the periods set by the Law and, where it applies, make the change. The answer is free; we could only charge shipping or reproduction costs if you ask for copies in a special medium.

7.3 If you are not satisfied

If you believe we did not handle your request or that we process your data contrary to the Law, you can go to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Government), the authority for personal data held by private parties.

8. Security

We apply technical and administrative measures to protect your data, including:

• Encrypted connection (HTTPS) across the site and the portal.
• Passwords stored with a slow, salted key derivation algorithm, never in plain text.
• Session cookies that page code cannot read.
• Limits on sign in attempts and re-authentication of the team for sensitive actions.
• Role-based permissions: each member of the Bluegreen team sees only what their work requires, and every change is logged.

No system is infallible. If we detect a breach that significantly affects your rights, we will let you know.

9. How long we keep data

When the period ends, we delete or anonymise the data. See also the data deletion policy.

10. Cookies and local storage

We use only two cookies, both strictly necessary to keep the portal and team panel sessions open, and we store a few preferences such as language in your browser. We do not use analytics or advertising cookies. Details are in the cookie policy.

11. Minors

Bluegreen is a business-to-business service and is not aimed at people under 18. We do not knowingly collect data from minors; if we find that we did, we delete it.

12. Third-party links

The site may link to third-party sites. We are not responsible for their privacy practices; we recommend reading their notices.

13. Changes to this notice

If we change this notice, we will publish the new version on this page with its version number and effective date. If the change is significant (for example, a new purpose or a new type of data), we will also let you know by email or in the portal before it takes effect.

14. Governing law

This notice is governed by the Federal Law on the Protection of Personal Data Held by Private Parties published in the Official Gazette on 20 March 2025 and other applicable provisions.

15. Contact

• Privacy and ARCO rights: [EMAIL FOR ARCO RIGHTS]
• General email: bluegreen@pietrini.ai
• Phone: [PHONE]
• Address: [FULL REGISTERED ADDRESS]