PRIVACY POLICY

Identity and Address of the Data Controller
Instituto Educativo del Noroeste, A.C. (hereinafter “IENAC”), the association that sponsors CETYS Universidad, with address at Calzada CETYS s/n, Col. Rivera, C.P. 21259, Mexicali, Baja California, is the Data Controller for the processing of personal data, in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (“LFPDPPP”), in English, Federal Law on the Protection of Personal Data Held by Private Parties.

Personal Data That May Be Processed
IENAC informs all individuals (hereinafter, “Data Subject”) that, as part of its registration of prospective students, enrolled students, and others with whom it establishes a legal and/or any other type of relationship in order to provide its services, it will collect and use the Data Subject’s personal data (hereinafter, “Data”), which may include, but is not limited to, depending on the type of Data Subject: name, date of birth, address, previous educational degrees, information about parents or guardians, phone number, email address, RFC, CURP, physical characteristics and condition, academic data, and other data that facilitate identification and contact, for the purposes described below, related to IENAC’s objectives, which include: providing educational services aimed at the integral development of individuals in specific knowledge areas and at educational levels defined by IENAC; promoting cultural, sports, technological, and scientific research activities; and identifying prospective candidates for financial aid.

Furthermore, IENAC may collect and process personal data of family members and/or third parties with whom the Data Subject has a legal relationship of custody or parental authority, or who provide financial support; consequently, by providing such data of family members and/or third parties, the Data Subject confirms that they have obtained consent for IENAC to process such data for the stated purposes.

Sensitive Personal Data That May Be Processed
IENAC informs that, in order to better identify Data Subjects, provide educational services, and for statistical purposes, it may collect and process the following Sensitive Personal Data: financial and patrimonial information, racial or ethnic origin, and physical and emotional health status.

Purposes of Data Processing

Necessary Purposes. IENAC informs the Data Subject that their data will be processed for the following necessary purposes, depending on and in compliance with the legal relationship between the Data Subject and IENAC:

a. Provide educational services within or outside any IENAC campus, focused on the integral development of individuals, at Upper Secondary, Higher Education, and Continuing Education levels.

b. Carry out any activities related and/or necessary for the optimal provision of educational services, cultural promotion, sports, research, and language instruction, including recognition and accreditation of previous studies, social service, and professional internships.

c. Identify the Data Subject through the creation of a profile in IENAC’s database, assign an alphanumeric code, and issue an identity document within the CETYS community.

d. Conduct evaluations and inform the Data Subject of their academic and extracurricular performance.

e. If applicable, inform the Data Subject’s parents, guardians, or those exercising parental authority, or third parties with an interest due to financial support, about the Data Subject’s academic performance.

f. Provide the Data Subject with physical access to IENAC facilities.

g. Provide the Data Subject access to IENAC-owned or affiliated technological infrastructure and systems.

h. Manage payments based on the relationship between IENAC and the Data Subject, either directly by IENAC or through a contracted third party.

i. Implement programs promoting physical and emotional health and well-being.

j. Implement programs promoting values, attitudes, skills, and positive behaviors in all CETYS community members.

k. If applicable, contract insurance for the benefit of the Data Subject.

l. If the Data Subject is receiving educational services from IENAC, contract tuition insurance for their benefit.

m. If the Data Subject is an IENAC employee, for the sale of CETYS Raffle tickets.

n. If requested by the Data Subject, conduct socioeconomic studies and related procedures aimed at granting financial aid and/or educational loans.

o. If applicable, carry out procedures for financial support with the United States government.

p. If the Data Subject has any financial support, to facilitate scholarship service.

q. If requested by the Data Subject, enroll and participate in internationalization and/or linkage programs with educational and non-educational institutions outside IENAC’s premises.

r. Record and reproduce surveillance videos on the respective campuses for security purposes.

s. Prepare fiscal receipts.

Voluntary Purposes. IENAC also informs the Data Subject that it will use their data for the following purposes, which are not necessary or essential (“Voluntary Purposes”) for the relationship between IENAC and the Data Subject:

a. Provide information about courses, diplomas, symposia, academic workshops, sports, cultural and social events, among others, organized by IENAC.

b. Conduct market research.

c. Conduct surveys to improve IENAC services.

d. If the Data Subject does not have any of the financial aid mentioned under Necessary Purposes, for the sale of CETYS Raffle tickets.

e.  Contract medical insurance, even if the Data Subject already has coverage.

f. Create an alumni profile.

g. Issue an alumni identity document.

h. Invite the Data Subject, if an alumnus, to events, forums, and associations under the CETYS Alumni program.

i. Use and disclose the Data Subject’s image (photo, video, or any other format) in IENAC’s informational and promotional materials.

The Data Subject has the right to object to the processing of their personal data for the aforementioned Voluntary Purposes by following the procedure for exercising ARCO Rights and data Revocation described below.

Transfers
In all cases, IENAC will provide any third party receiving the Data (hereinafter “Recipient”) with this Privacy Notice, which must accept and process the received Data in accordance with the terms set forth herein. IENAC may make the following transfers:

In specific cases, depending on the activities of the Data Subject, IENAC will request prior consent to transfer Data to a Recipient not listed above.

Acceptance of the Privacy Notice

The Data Subject expressly states that they have read and understood all terms under which IENAC will process their Data and, consequently, authorizes IENAC to carry out such processing, including the transfers provided herein, prior to providing the Data and without objecting to the terms of this Privacy Notice.

If the Data Subject is a minor, they confirm that they have obtained the consent of their parents, guardians, or those exercising parental authority regarding this Privacy Notice.

ARCO Rights and Revocation, and Limitation of Use and/or Disclosure of Data
The Data Subject may limit the use or disclosure of their Data and exercise any of their rights of Access, Rectification, Cancellation, and Opposition (“ARCO Rights”) and/or Revocation regarding Data processed by IENAC by sending an email to: aviso.privacidad@cetys.mx.

In that email, the Data Subject must indicate the right they wish to exercise, the reason for exercising it, including the campus, enrollment number, program, a clear and precise description of the personal data concerned, and attach one of the following official identifications to verify identity:

• Voting card
• Passport
• Professional license
• Immigration document proving legal stay in Mexico, if a foreigner
• IENAC, within twenty (20) business days of receiving the email request, will inform the Data Subject of its validity and, if applicable, implement it within no more than fifteen (15) business days from the date of such communication.

Use of Technologies

IENAC informs the Data Subject that some of its websites use data files stored on the user’s hard drive or electronic device while browsing a specific site, called cookies, which allow exchanging status information between the site and the Data Subject’s browser. These technologies may be used to monitor the Data Subject’s behavior as an internet user, which may include obtaining Data. Cookies may be disabled following the procedure of the browser used by the Data Subject.

Policies and Regulations
IENAC informs the Data Subject that it has Policies and regulations that support the care and protection of Personal Data applicable to the CETYS community.

Notification of Changes to the Privacy Notice
IENAC will inform the Data Subject of any changes to this Privacy Notice via announcements on www.cetys.mx

Notice Updated September 29th, 2025