Cevallos y Fernández de Cevallos S.C., hereinafter referred to as Cevallos y Fernández de Cevallos, with address at Boulevard Manuel Ávila Camacho #118, 24th floor, interior 08, Lomas de Chapultepec Sección V, C.P. 11000, Miguel Hidalgo Borough, Mexico City, in order to comply with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties, hereinafter referred to as “The Law,” while fully observing and respecting the principles of Legality, Consent, Information, Quality, Purpose, Loyalty, Proportionality, and Responsibility set forth therein, hereby provides the following Privacy Notice.

I. Personal data to be processed:

Cevallos y Fernández de Cevallos may collect personal data directly, personally, or indirectly, through its institutional forms, physical means, and/or electronic media, for the purpose of formalizing any kind of legal and business relationship established or to be established with Cevallos y Fernández de Cevallos in accordance with Article 17 of the Regulations of the Federal Law on Protection of Personal Data Held by Private Parties.

This includes those data that will require your express consent or through the signing of a contract or agreement, as provided for in the assumptions set forth in Articles 8 and 16 of the Federal Law on Protection of Personal Data Held by Private Parties. Therefore, data that fall into any of the following categories may be collected:

• Financial and asset data: credit history, financial information, status with credit bureaus, property deeds, share certificates, corporate books, accounting, bank statements.

• Identification data: name, address, nationality, email address, telephone number, Tax ID Number (RFC), Unique Population Registry Code (CURP).

• Employment data: occupation, profession, work experience.

• Academic data: educational background.

• Data regarding administrative and/or jurisdictional procedures conducted in the form of legal proceedings.

The sensitive personal data that may be collected are as follows:

• Health-related data.

• Personal characteristics.

• Physical characteristics.

• Union affiliation.

II. Purposes of data processing:

Cevallos y Fernández de Cevallos may collect your data for any of the following purposes:

a) Necessary: to fulfill the obligations arising from the existing legal relationship or any future relationship that may be established between Cevallos y Fernández de Cevallos and you as the data subject, as well as to represent you in judicial and extrajudicial proceedings in which you are involved. Without the information mentioned above, Cevallos y Fernández de Cevallos would be unable to fulfill its obligations arising from the act that gave rise to processing your personal data.

b) Additional: for our goods and services marketing, advertising, and promotional activities.

For the purposes stated in this Privacy Notice, we may collect your data in various ways:

1. directly and personally with you

2. when you visit our website

3. through other sources permitted by law

III. Refusal of data processing:

You have the right to object to the processing of your data for the purposes described above, provided that they are not necessary and do not give rise to the legal relationship between CEVALLOS Y FERNÁNDEZ DE CEVALLOS and the data subject, and provided that the absence of such processing does not result in the termination of processing for these purposes. The aforementioned is under Article 42 of the Regulations of the Federal Law on Protection of Personal Data Held by Private Parties, as well as with the provisions of Chapter IV of the Federal Law on Protection of Personal Data Held by Private Parties.

Such objection must be expressed through a written statement indicating the refusal to process personal data, sent to arco@cevallosyfernandezdecevallos.com.

IV. Transfer of personal data:

All data referred to in this notice may be disclosed without your express consent in any of the cases provided for in Article 37 of the Federal Law on Protection of Personal Data Held by Private Parties, whenever competent authorities require such data in response to an information request, as well as to Mexican and/or foreign financial authorities, and any authority or non-authority described in the aforementioned article.

Likewise, when the transfer is necessary by a contract entered into, or to be entered into, in the interest of the data subject, or to any third party that, due to the administration of human resources, payroll, social security, and benefits provided by the company, requires such transfer, it will not be mandatory to obtain your consent for the transfer of your personal data, under the current legislation on the subject.

Cevallos y Fernández de Cevallos will inform the individuals or companies to whom it provides their personal data about this privacy notice.

V. Consent for the transfer of personal data:

If it is necessary to carry out any transfer of your data other than the aforementioned cases where your express consent is required, we will inform you to obtain your consent. Alternatively, you can provide your consent from this moment by emailing arco@cevallosyfernandezdecevallos.com expressing your explicit consent for transferring your personal data for lawful and necessary purposes, which will be processed under the applicable law. In the email you send, please state and attach the following documents:

• passport or voter ID

• proof of address

• CURP (Unique Population Registry Code)

• an email address for contact purposes

If you do not express your objection to the transfer of your personal data, it will be understood that you have given your consent for such transfer.

VI. Exercise of ARCO Rights:

Under Article 33 of the Federal Law on Protection of Personal Data Held by Private Parties, the data subject has the right to: (i) access their personal data held by CEVALLOS Y FERNÁNDEZ DE CEVALLOS and obtain details about their processing; (ii) rectify their personal data if it is inaccurate or incomplete; (iii) cancel their personal data when it is no longer necessary for the purposes stated in this Privacy Notice, when it is being used for non-consented purposes, or when the contractual or service relationship has ended; (iv) object to the processing of their personal data for specific purposes (ARCO Rights).

However, CEVALLOS Y FERNÁNDEZ DE CEVALLOS may deny access to personal data, refuse rectification or cancellation, or deny the opposition to the processing of personal data in cases provided for in Article 34 of the Federal Law on Protection of Personal Data Held by Private Parties.

VII. Mechanism for the Exercise of ARCO Rights:

To defend and recognize your ARCO rights, CEVALLOS Y FERNÁNDEZ DE CEVALLOS provides you with the following mechanism to exercise such rights:

You can submit a written request in a free format, detailing your request and providing your address or email to notify the response. The request must be properly signed and addressed to the administration at the address mentioned at the beginning of this notice or to the email address arco@cevallosyfernandezdecevallos.com.

If you fail to provide an email address and address, the request will be considered abandoned without any liability for Cevallos y Fernández de Cevallos.

You must include a simple copy of a valid official identification document and proof of address along with the request. In addition to your identification information, your request must clearly and specifically include:

1. The right you wish to exercise.

2. In the case of rectification, indicate the data to be corrected and the reason for the correction; you must provide an official document to support the request.

3. If the process is carried out through a representative, their authority must be proven by a power of attorney granted before a notary public.

We will respond to your request within a maximum period of 20 (twenty) business days from the receipt of your request. The response will be sent through the means indicated in your request for the purpose of hearing and receiving notifications.

If your request is deemed valid, Cevallos y Fernández de Cevallos will take the necessary actions within 15 (fifteen) business days following the date we communicate our response to you. You will be able to verify the execution of the necessary actions to fulfill your request at the end of the specified period for responding to it, through electronic means, simple copies, or the medium through which you have provided the data on which you are exercising your ARCO rights.

VIII. Mechanisms for Revoking Consent:

You may revoke your consent to process your personal data at any time, provided that any legal provision does not prevent this. To do so, you should follow the same procedure established for exercising your ARCO rights, as outlined in the preceding section, specifying your request for revocation. The same response times as indicated by Cevallos y Fernández de Cevallos will apply.

IX. Mechanisms for Limiting the Use of Personal Data:

It is important to inform you that you can at any time limit the use or disclosure of your personal data by exercising the rights of access, rectification, cancellation, or opposition provided for in the Federal Law on the Protection of Personal Data Held by Private Parties, as stipulated in Article 29. You can do so by submitting a written request.

X. Use of Cookies, Web Beacons, or Similar Technologies:

Some of our websites may send a “cookie” to your computer, a small text file that the website sends to your computer and is stored on your hard drive. The next time you visit our website, we can use the information stored in the cookie to facilitate your use of our website. For example, we may use your cookie to store a password or form that you previously entered, so you don’t have to enter it again each time you move to a different section of our website. A cookie does not allow us to identify your personal identity unless you choose to provide it explicitly. Most cookies expire after a certain period of time, or you can delete them at any time from your browser. Additionally, you can set your browser to notify you when you receive a cookie, so you can choose to accept or reject it.

For any matters related to this Privacy Notice and the processing of your personal data, you can contact us at the email address provided in this privacy notice.

XI. Changes to the Privacy Notice:

This Privacy Notice, as well as any modifications to it, will be available to you through any of the means established by the applicable legislation, such as notices posted in our offices or communicated through any communication medium we have with you.

If you have any concerns regarding the processing of your personal data, you can consult the Federal Institute for Access to Information and Data Protection (Instituto Federal de Acceso a la Información y Protección de Datos, or “IFAI” in Spanish).