PRIVACY NOTICE

PRIVACY NOTICE INNVATIA

This Privacy Notice (hereinafter the “Privacy Notice”) will come into effect from the moment users accept it.
INNVATIA, with address in Mexico City, is responsible for the processing of your personal data that you provide to us on our website https://www.innvatia.com/ (hereinafter the “Site”), the use given to it, and its protection.

FOR WHAT PURPOSES DO WE COLLECT AND USE YOUR PERSONAL DATA?
Your personal data will be used for the following purposes:

• • Account creation and management: To establish and manage the user account to access our services.
• • Follow-up and communication: To locate and communicate with the user to continue the requested services and resolve any doubts.
• • Identity confirmation: To carry out biometric verifications and confirm the user’s identity.
• • Verification and validation: To corroborate identity with the National Electoral Institute and comply with applicable legal requirements.
• • OFAC list search.
• • User support: To address inquiries and clarifications related to the Site.
• • Legal compliance: To ensure compliance with the Federal Law for the Prevention and Identification of Operations with Illicit Resources and other legal requirements.
• • Financial information: To verify and clarify banking information.
• • Claims management: To investigate and resolve user complaints or claims.
• • Compliance with legal requests: To satisfy the requirements of competent authorities.
• • Fraud prevention: To identify and prevent fraud and illicit activities.
• • Communication channels: To contact the user via calls, emails, messages, and other methods.
• • Location: To determine the user’s geographic location to offer personalized content and benefits.
• • Quality control: To monitor and evaluate the quality of the services offered.
• • Security: To ensure the protection of networks and electronic communications to safeguard user information.

You agree to the use of your personal data by clicking acceptance within our Site.

WHAT PERSONAL DATA DO WE OBTAIN AND FROM WHERE?
For the purposes stated in this privacy notice, we may collect your personal data in various ways: when you provide it directly by registering to create an account on INNVATIA; when you visit our Site and register through the Contact form or use our online services; and when we obtain information from other sources permitted by law.

PERSONAL DATA
The Personal Data we request are: (i) Full Name; (ii) Email address; (iii) Official identification; (iv) Proof of address; and (v) Source of funds.

SENSITIVE PERSONAL DATA
INNVATIA never requests or requires sensitive data. If the user provides such data at any time, it will receive the same security treatment as any information requested by the Site. The security and confidentiality of data provided when contracting an online service will be protected by a secure server under the Secure Socket Layer (SSL) protocol, so data transmitted will be encrypted to ensure its protection. However, it is clear that no communication of data over the Internet is completely secure, so INNVATIA cannot guarantee that your personal data will be free from damage, loss, alteration, destruction, or unauthorized use, access, or processing.

HOW CAN YOU LIMIT THE USE OR DISCLOSURE OF YOUR PERSONAL DATA?
You can stop receiving promotional messages by sending an email to atencion@innvatia.com with a free-form written request in Spanish, indicating your request and necessary information such as full Name and/or Business Name (first and last names), attaching a digital copy of your official ID (scan), phone number, and physical or electronic address for notifications related to your case. For any questions or clarifications, please contact atencion@innvatia.com with the ARCO Rights responsible.

WHAT RIGHTS DO YOU HAVE REGARDING YOUR PERSONAL DATA?
According to the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), you have the right to exercise your rights of Access, Rectification, Cancellation, and Opposition (hereinafter “ARCO Rights”) regarding your personal data. Below is an explanation of each right and how you can exercise them:

• • Right of Access: You have the right to know what personal data we have about you, how we use it, and under what conditions.
• • Right of Rectification: You have the right to request correction of your personal data if it is outdated, inaccurate, or incomplete.
• • Right of Cancellation: You have the right to request that we delete your personal data from our records or databases when you consider it is not being used properly.
• • Right of Opposition: You have the right to object to the use of your personal data for specific purposes.

PROCEDURE TO EXERCISE YOUR ARCO RIGHTS
To exercise your ARCO Rights, you must submit a request to our Privacy Officer, providing the following information:

• • Full name and address or another means to communicate the response to your request.
• • Documents proving your identity or, if applicable, legal representation.
• • Clear and precise description of the personal data regarding which you seek to exercise one of the ARCO Rights.
• • Any other element or document that facilitates locating your personal data.

You can send your request to the following email address: atencion@innvatia.com.
We will respond to your request within a maximum period of 20 business days from the date we receive your complete request. If your request is granted, it will be fulfilled within the next 15 business days from the date we notify you of the response.

REVOCATION OF CONSENT
You also have the right to revoke the consent you have given us for the processing of your personal data at any time. To do so, you must submit your request as described above. However, please consider that not all requests can be processed or stopped immediately, as we may need to continue processing your data due to legal obligations.

DATA TRANSFER
The data provided may be shared and transferred to third parties without your consent, with the exceptions provided in Article 37 of the Federal Law on Protection of Personal Data Held by Private Parties, and such transfers will be made according to the terms established by this law. Except in cases indicated in Article 37 of said law:

• • When the transfer is foreseen by a law or treaty to which Mexico is a party.
• • When the transfer is necessary for medical prevention or diagnosis, healthcare provision, medical treatment, or management of health services.
• • When the transfer is made to parent companies, subsidiaries, or affiliates under common control of the responsible party, or to a parent company or any company in the same group operating under the same internal processes and policies.
• • When the transfer is necessary due to a contract made or to be made in the interest of the data subject, between the responsible party and a third party.
• • When the transfer is necessary or legally required for the safeguarding of a public interest, or for the prosecution or administration of justice.
• • When the transfer is necessary for the recognition, exercise, or defense of a right in a judicial process.
• • When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the responsible party and the data subject.

CHANGES TO THE PRIVACY NOTICE
We reserve the right to make modifications or updates to this privacy notice at any time to address legislative changes, internal policies, or new requirements for the provision or offering of our services or products.
These changes will be made available to the public through visible announcements on the Site (Privacy Notice section). We will not be responsible if you do not visit this privacy notice to learn about the most recent modification(s). For your security, please review this privacy notice on our Site whenever you wish.

USE OF COOKIES, WEB BEACONS, AND LINKS TO THIRD-PARTY SITES
Cookies are text files automatically downloaded and stored on the user’s computer hard drive when browsing a specific Internet page, which allow the Internet server to remember some data about this user, including preferences for viewing pages on that server, username, and password. Web beacons, on the other hand, are images embedded in a webpage or email that can be used to monitor visitor behavior, such as storing information about the user’s IP address, duration of interaction on that page, and type of browser used. You can access our Cookies Policy where we inform you how we use cookies and web beacons to obtain personal information from you.

WHERE CAN YOU FILE COMPLAINTS OR REPORT MISUSE OF YOUR PERSONAL DATA?
If you believe your data protection rights have been violated by any conduct of our employees, our actions or responses, or suspect that there is a breach of the provisions of the Federal Law on Protection of Personal Data Held by Private Parties in the processing of your personal data, you may file the corresponding complaint or report before the National Institute for Transparency, Access to Information and Personal Data Protection (“INAI”).

For more information, visit http://inicio.inai.org.mx/SitePages/ifai.aspx CONTACT
For any inquiries, questions, or comments related to our Privacy Notice and the handling of your personal data, as well as to exercise your ARCO rights (Access, Rectification, Cancellation, and Opposition), you can contact us at: atencion@innvatia.com We will respond as soon as possible to resolve any concerns you may have. If you need to exercise your ARCO rights, please provide all necessary information and documentation according to our Privacy Notice so that we can process your request efficiently.