PRIVACY NOTICE

This Privacy Notice (hereinafter the "Privacy Notice") will come into effect from the moment of acceptance by users and will remain valid from October 2024.
ARNUG S.A. DE C.V. (hereinafter referred to as INNVATIA), with an address in Mexico City, is responsible for the processing of your personal data that you provide to us on our website https://www.innvatia.com/ (hereinafter the "Site"), the use of such data, and its protection.

WHAT PURPOSES DO WE COLLECT AND USE YOUR PERSONAL DATA FOR?

Your personal data will be used for the following purposes:

• • Account Creation and Management: To establish and manage the user account for accessing our services.
• • Follow-up and Communication: To locate and communicate with the user to continue the services requested and resolve any questions.
• • Identity Confirmation: To carry out biometric verifications and confirm the user's identity.
• • Verification and Validation: To verify identity with the National Electoral Institute and comply with relevant legal requirements.
• • User Support: To address queries and clarifications related to the site.
• • Legal Compliance: To ensure compliance with the Federal Law for the Prevention and Identification of Operations with Illegally Sourced Funds and other legal requirements.
• • Financial Information: To verify and clarify banking information.
• • Claims Management: To investigate and resolve user complaints or claims.
• • Compliance with Legal Requests: To meet the requirements of competent authorities.
• • Fraud Prevention: To identify and prevent fraud and illegal activities.
• • Communication Channels: To contact the user through calls, emails, messages, and other methods.
• • Location: To determine the user's geographical location in order to offer personalized content and benefits.
• • Quality Control: To monitor and assess the quality of services offered.
• • Security: To ensure the protection of networks and electronic communications to safeguard user information.

You will accept the use of your personal data by clicking the acceptance button on our Site.

WHAT PERSONAL DATA DO WE OBTAIN AND WHERE FROM?

For the purposes set forth in this privacy notice, we may collect your personal data in different ways: when you provide it directly by registering to create an account on INNVATIA; when you visit our Site and register in the Contact form, or use our online services, social media, and when we obtain information from other sources allowed by law.

PERSONAL DATA

The personal data we request are: (i) Full Name; (ii) Email Address; (iii) Official ID; and (iv) Proof of Address.

SENSITIVE PERSONAL DATA

INNVATIA does not request or require sensitive data at any time. If the user provides any sensitive data, it will be treated with the same security measures as any other information requested by the Site. The security and confidentiality of data provided by users when contracting an online service will be protected by a secure server under the Secure Socket Layer (SSL) protocol, ensuring that transmitted data will be encrypted to safeguard their protection. However, it is clear that no data transmission over the internet is completely secure, and INNVATIA cannot guarantee that your personal data will be free from harm, loss, alteration, destruction, or unauthorized use, access, or processing.

HOW CAN YOU LIMIT THE USE OR DISCLOSURE OF YOUR PERSONAL DATA?

You can stop receiving promotional messages by sending an email to the following address: atencion@innvatia.com, stating your request in a free-form letter in Spanish, including your full name and/or corporate name (first name(s) and last name(s)), attaching a digital version of your official ID (scanned), phone number, and physical or electronic address for notification purposes. For any questions or clarifications, please contact atencion@innvatia.com with the ARCO responsible person.

WHAT RIGHTS DO YOU HAVE OVER YOUR PERSONAL DATA?

According to the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), you have the right to exercise your Access, Rectification, Cancellation, and Opposition rights (hereinafter "ARCO Rights") regarding your personal data. Below, we explain each of these rights and how you can exercise them: Right of Access:

You have the right to know what personal data we hold about you, how we use it, and the conditions of its use.
Right of Rectification: You have the right to request the correction of your personal information if it is outdated, inaccurate, or incomplete.
Right of Cancellation: You have the right to request the deletion of your personal data from our records or databases if you believe it is not being used appropriately.
Right of Opposition: You have the right to oppose the use of your personal data for specific purposes.

PROCEDURE TO EXERCISE YOUR ARCO RIGHTS

To exercise your ARCO Rights, you must submit the respective request through our Privacy Officer, providing the following information:

• • Full name and address or other means to communicate the response to your request.
• • Documents that prove your identity or, if applicable, your legal representation.
• • A clear and precise description of the personal data regarding which you wish to exercise one of the ARCO Rights.
• • Any other element or document that helps locate your personal data.

You can send your request to the following email address: atencion@innvatia.com.
We will respond to your request within a maximum of 20 business days from the date we receive your complete request. If your request is valid, it will be implemented within 15 business days following the date we communicate our response to you.

REVOCATION OF CONSENT

You also have the right to revoke your consent for the processing of your personal data at any time. To do so, it is necessary to submit your request in the terms mentioned above. However, it is important to note that in not all cases we will be able to comply with your request or immediately stop processing your data, as we may need to continue processing your personal data due to legal obligations.

DATA TRANSFER

The data provided may be shared and transferred to third parties without your consent, with the exceptions set out in Article 37 of the Federal Law on Protection of Personal Data Held by Private Parties, as well as to make such transfers in accordance with the terms established by this law. Except in cases outlined in Article 37 of the aforementioned law:

• • When the transfer is provided for in a law or treaty to which Mexico is a party.
• • When the transfer is necessary for medical diagnosis, health care, medical treatment, or the management of health services.
• • When the transfer is made to parent, subsidiary, or affiliated companies under common control, or to a parent company or any company within the same corporate group operating under the same processes and internal policies.
• • When the transfer is necessary by virtue of a contract entered into or to be entered into in the interest of the data subject, by the responsible party and a third party.
• • When the transfer is necessary or legally required to safeguard a public interest, or for the administration or enforcement of justice.
• • When the transfer is necessary for the recognition, exercise, or defense of a legal claim.
• • When the transfer is necessary for maintaining or fulfilling a legal relationship between the responsible party and the data subject.

MODIFICATIONS TO THE PRIVACY NOTICE

We reserve the right to make changes or updates to this privacy notice at any time, to address legislative changes, internal policies, or new requirements for the provision or offering of our services or products.
These changes will be available to the public through visible notices on the Site (privacy notice section).
We are not responsible if you do not visit this privacy notice to become aware of the most recent modification(s). For your safety, please review the content of this privacy notice on our Site at any time.

USE OF COOKIES, WEB BEACONS, AND LINKS TO THIRD-PARTY SITES

Cookies are text files that are automatically downloaded and stored on the user's computer hard drive when navigating a specific website. These cookies allow the internet server to remember certain data about the user, including their preferences for viewing pages on that server, username, and password. Web beacons, on the other hand, are images embedded in a web page or email, which may be used to monitor a visitor's behavior, such as storing information about the user's IP address, duration of time spent interacting on the page, and the type of browser used.

You can access our Cookie Policy where we inform you about how we use cookies and web beacons to collect personal information about you.

WHERE CAN YOU FILE COMPLAINTS AND REPORTS FOR IMPROPER HANDLING OF YOUR PERSONAL DATA?

If you believe that your personal data protection rights have been violated by any actions of our employees or by our actions or responses, or if you suspect that there is a violation in the processing of your personal data under the provisions of the Federal Law on Protection of Personal Data Held by Private Parties, you may file a complaint or report with the National Institute for Transparency, Access to Information, and Personal Data Protection ("INAI").

For more information, visit http://inicio.inai.org.mx/SitePages/ifai.aspx

CONTACT

For any questions, doubts, or comments regarding our Privacy Notice and the handling of your personal data, as well as for the exercise of your ARCO rights (Access, Rectification, Cancellation, and Opposition), please contact us via our email: atencion@innvatia.com

We will respond as soon as possible to resolve any concerns you may have. If you need to exercise your ARCO rights, please provide all the necessary information and documentation according to our Privacy Notice so we can process your request efficiently.