In accordance with the Federal Law on the Protection of Personal Information Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) (hereinafter the “Law”), Finanzas Digitales, S.A.P.I. de C.V. corporation (hereinafter “Data Controller”), with address for tax purposes located at Avenida Acueducto 6050, in Lomas del Bosque, Zapopan, Jalisco, Mexico, (hereinafter “Data Controller’s address” ), is responsible for the use and protection of Data Owner’s personal information collected on the occasion of the provision of Data Controller services through and on the occasion of: (i) the website https://app.addika.io (hereinafter the “Website”), as well as (ii) the digital platform called ADDIKA Asset Consolidation Manager™© (hereinafter the “Digital Platform”); under the terms and conditions of this privacy notice (hereinafter the “Notice”) which are detailed below:

For purposes of this Notice, the terms set forth below shall have the meanings ascribed to them in this Notice, and can be found written in the singular or plural forms:

• a. “Personal Information”: any information concerning an identified or identifiable natural person, including but not limited to7ui: full name, marital status, place of birth, date of birth, nationality, address, personal phone number, cell phone number, email, handwritten signature, photograph, proof of residence, Federal Taxpayers Registry ID (RFC), Personal Number (CURP), documents with which Data Owner proves the above.

• b. “Sensitive Personal Information”: Personal Information that affects the intimate sphere of Data Owner, or whose improper use may give rise to any type of discrimination or entail a serious risk for Data Owner. Information that may reveal personal aspects of Data Owner, such as racial and ethnic origin, present future health status, genetic information, religious, philosophical and moral beliefs, trade union membership, opinions, policies, sexual preference or financial, banking and economic position, are considered within this category.

• c. “ARCO Rights”: Right of Data Owner to request from Data Collector the Access, Rectification, Cancellation or Opposition with respect to said information, in accordance with the Law and its Regulations.

• d. Law: Federal Law on the Protection of Personal Information Held by Private Parties.

• e. “Mexico”: the entire territory within the United Mexican States.

• f. Digital Platform: the digital platform known as ADDIKA Asset Consolidation Manager™©.

For the fulfillment of the purposes indicated in item III of this Notice, Data Collector informs Data Owner that it may collect the following categories of Personal Information including but not limited to: (i) Identification data; (ii) Contact details; (iii) Labor Data; (iv) Education or professional data; (v) Migration data; (vi) Economic, banking and/or financial data; (vii) Education or professional data; (viii) Information about Data Owner’s preferences or experiences in the contracting or use of certain goods or services; and/or (ix) Sensitive Personal Data.

The Personal Information referred to in the previous paragraph may be collected by Data Collector, either personally or on the occasion of: (i) the Website, as well as (ii) the Digital Platform.

The Personal Information that Data Collector collects will be used to meet the following purposes:

Como primary purposes:

• a. Corroborate the identity of Data Owner and the veracity of the information provided as your own, regarding the contracted service and in observance of the applicable legal provisions.

• b. Form, develop and achieve the purposes of a business relationship as a result of and from the conclusion of a Technology and Software License Agreement of the Digital Platform.

• c. Hold and execute the analysis of the information provided by Data Owner, in order to determine in accordance with the legal provisions in force the asset consolidation, client profile, level of profitability, and in general, carry out any other assessment required by the regulations or is convenient for the provision of the service.

• d. Formalize a contractual relationship between Data Owner and Data Collector and provide the asset management services contracted in accordance with the agreement between the parties, and where appropriate, require its compliance.

• e. Integrate files and databases, and treat them, either directly by Data Collector or through a third party, so that Data Collector can provide its services.

In addition, Data Collector may use the Personal Information of Data Owner for the following finalidades secundarias:

• a. Offer Data Owner an extension or improvement of the contracted services.

• b. Offer benefits, promotions or discounts to Data Owner that aim to encourage or reward the use of the services marketed by Data Collector.

• c. Generation of statistical information related to the use of the services operated by Data Collector.

Data Owner acknowledges that Data Collector uses the following technical and organizational security measures, to maintain the security of the Personal Information obtained due to the use of the Digital Platform by Data Owner:

• Storage: Data stored on high security servers.

• Encryption: Data encrypted under (AES-256); each object is encrypted with a unique code, and as an additional measure the code itself is encrypted with a master certification key that is rotated periodically. There are server-to-server security channels that comply with the policies and requirements of regulatory bodies.

• Access control: The administrator of the account designated by Data Owner is the only one capable of providing access to resources and information, the control panel provides the ease of defining permissions in detail. Only the administrator has full control of the information.

• 2FA: As a security measure and complementary access to the user and password, the user is allowed to access through a token or device linked to the account.

• 2FA: As a security measure and complementary access to the user and password, the user is allowed to access through a token or device linked to the account.

• Good practices and processes: All new updates are processed indirectly from the Digital Platform database; Data Collector, its partners, directors, collaborators and technical, sales and administrative team, and affiliates, have no contact or access to the information that Data Owner or end user feeds or uploads to the Digital Platform.

• Anonymous Data: All data within the databases is anonymous; Data Collector, its partners, directors, collaborators and technical, sales and administrative team, and affiliates, do not have any access to personally identifiable data (personal information) of Data Owner. Data Collector has an infrastructure for the encryption of the information provided by Data Owner, which does not allow it to identify the same user and their personal information.

Data Collector informs Data Owner that by granting their consent for the processing of their Personal Information, Data Owner does NOT authorize Data Collector to use them for the mailing of advertising information or for the mailing and collection of information through quality surveys; with the exception of the following categories of Personal Information: (i) Identification data, only the name;(ii) Contact data, only address, telephone and email; and (iii) Information about Data Owner preferences or experiences in the contracting or use of certain goods or services; categories that MAY be used to send advertising information by the means that Data Collector has at its disposal, such as email, mobile telephony (SMS, MMS), Website, social networks, or any other similar means of electronic communication that may be developed, as well as the mailing and collection of information through quality surveys.

In the event that Data Owner adheres to any of the promotions of Data Collector or decides to register, enroll or request Data Collector to join as a participant in an event organized by the former, it will be understood Data Owner DOES grant their consent for the processing of Data Owner’s information in accordance with the secondary purposes referred to herein.

Data Owner DOES authorize Data Collector to transfer their Personal Information to third parties when this is necessary or convenient so that Data Collector can comply with the obligations derived from the legal relationship between Data Owner and Data Collector.

Future Personal Information shall have the same treatment referred to in this Notice. Notwithstanding anything to the contrary Data Owner may exercise at any time Data Owner’s right of opposition, as provided in section 7 of this Notice.

Data Owner may request the update, limit the use or disclosure of Data Owner’s Personal Information, and where appropriate, be informed of any aspect related to its treatment, at any time to the phone number 55-1163-8986 or to the email [email protected].

To exercise this right, Data Owner must follow the procedure referred to in section 7 of this Notice. Data Owner can express limitation with respect to the processing of Data Owner’s Personal Information in accordance with the secondary purposes described in section 3 of this Notice within 5 (five) business days starting from Data Owner’s access to this Notice, to Data Collector. If Data Owner does not express within the aforementioned 5 (five) business days their refusal to process their Personal Data in accordance with the secondary purposes informed, it will be understood that Data Owner has given their consent for its treatment.

In accordance with the Law and its Regulations, Data Collector informs Data Owner that the consent of Data Owner will not be necessary for the processing of Personal Information when: (i) it is provided for in a law; (ii) the Personal Information is contained in publicly accessible sources; (iii) the Personal Information is subject to a prior dissociation procedure; (iv) it has the purpose of fulfilling obligations arising from a legal relationship between Data Owner and Data Collector; (v) there is an emergency situation that could potentially harm an individual in their person or property; (vi) a ruling of the competent authority is issued; or (vii) it is intended to ensure that no domestic or foreign legal or governmental provisions are being infringed.

Likewise, Data Owner is informed that with the acceptance of this Notice it is understood that Data Owner grants their authorization for Data Collector to transfer Data Owner’s Personal Data to third parties, whether Mexican or foreign, without it being required to obtain Data Owner’s consent again, when the transfer coincides with any of the following cases: (i) it is provided for in a law; (ii) the transfer is made to subsidiaries or affiliates under the common control of the Data Controller or to a parent company or to any company in the same group as the Data Controller operating under the same internal processes and policies; (iii) it is necessary by reason of a contract concluded or to be concluded in the interest of Data Owner; (iv) it is necessary or legally required for the safeguarding of a public interest, or for the prosecution or administration of justice; (v) it is necessary for the recognition, exercise or defense of a right in judicial proceedings; (vi) it is necessary to ensure that national or foreign legal or governmental provisions are not being infringed and, (vii) it is necessary for the maintenance or fulfillment of a legal relationship between Data Owner and Data Collector.

Without prejudice to the foregoing, Data Collector undertakes to ensure compliance with the principles of protection of Personal Information established by the Law and its Regulations and to adopt the necessary measures for its application, as well as to demand compliance from the natural or legal persons to whom access to Data Owner’s Personal Information is transferred or granted, in order to give Data Owner an adequate service and with the best quality.

Data Collector informs Data Owner that any communication sent by email or through the Web, such as unprotected electronic messaging services, social networks, the Website and the Digital Platform, websites and other digital platforms not identified by Data Collector as their own and official information, may be subject to interception of the information, loss or possible alterations in the message or in the data sent, in which case, Data Owner may not demand from Data Collector to whom they send said communication, compensation for any damage resulting from the interception, subtraction, loss or alteration related to said communication.

In the event that Data Owner makes use of platforms, Website, Digital Platform, applications or requests the services of Data Collector through the use of electronic devices or provides their Personal Information through any of said channels (the “Electronic Media”), Data Owner understands, accepts and acknowledges that:

• a. The Electronic Media may include links to websites of third parties different from Data Collector, with respect to which Data Collector does not assume any ownership, obligation or responsibility whatsoever.

• b. The services provided by Data Collector through the Electronic Media may collect information from Data Owner such as browser type, operating system, visits to other websites or carry out their identification as a User, through cookies in which case they will be informed at that time about the use of that technology. In order for Data Owner to disable these programs, they must access the “Internet options” located in the "Tools" section, or similar functions, of the browser Data Owner uses.

The Website and the Digital Platform of Data Collector and the possible applications that will be developed, use cookies that Data Collector may place on its access device and make use of them. The use of cookies is intended to speed up the logging in; save the user's settings of the site and/or its applications; streamline interaction with content; improve the user experience of the site and/or its applications by storing their preferences on the access device, eliminating the need to repeatedly specify the same information and only show personalized content and advertising according to their preferences in their subsequent visits, as well as facilitate the Analysis of such information in order to improve the performance of the site and/or its applications.

In the same way, Data Collector may make use of cookies to collect information about the preferences of the user of the site and/or applications in the use of content in order to offer special offers, discounts, programs and in general, send the user of the site and/or the user’s applications advertising based on the user’s interests.

With the use of Electronic Media, Data Owner acknowledges and authorize the Data Collector to use cookies; for which a cookie is a text file placed by a Web server on the hard drive of the Internet user who visits it with information about their preferences and browsing patterns. Data Collector may expand the content of the site and/or its applications or create new Electronic Media in which case these will be governed by this Notice.

Data Owner, unrepresented or through a duly assigned legal representative, has recognized and may exercise the ARCO Rights granted by the Law and its Regulations against Data Collector, presenting themselves at Data Collector’s Address with their current official identification, where the staff of Data Collector will process their request.

The Arco Rights are:

• a. Access: to know specific information that Data Collector has in its possession;

• b. Rectification: to request the rectification of Personal Information in case it is not updated, it is inaccurate or incomplete, to exercise this right the documentation that proves the rectification requested according to the Personal Information must be delivered;

• c. Cancellation: blocking and subsequent deletion of Personal Information from Data Controller databases when Data Owner considers that it is not being used properly or for the purposes that gave rise to the legal relationship;

• d. Opposition: to oppose to the use for specific purposes of Data Owner’s Personal Information.

The exercise of any of the ARCO Rights does not prevent the exercise of any other right. For the exercise of any of the ARCO Rights, Data Owner or Data Owner’s legal representative may request an ARCO Rights application form to the following email address [email protected] (hereinafter the “Form”).

This Form must be completed, signed and returned to the same email address accompanied by the documentation indicated below, which must be sent scanned and legible for assessment, so that Data Collector can carry out the authentication of Data Owner who requires to exercise their ARCO Rights:

• a. Valid official identification of Data Owner: Any of the following documents will be valid: Federal Electoral Institute ID (Voter ID Card), Passport issued by the Ministry of Foreign Affairs, Military Service Card or Professional License.

• b. In cases in which Data Owner exercises their ARCO Rights through a legal representative, in addition to proving the identity of both (Data Owner and the legal representative), a document by which Data Owner grants Data Owner’s legal representative powers to carry out this procedure before Data Collector such as: a legible copy of a power of attorney, a letter of attorney signed before two witnesses and ratified before a Civil Law Notary, or an Acknowledgment where Data Owner must be present, must be sent to the aforementioned email address.

Data Collector shall communicate to Data Owner within no more than 20 (twenty) business days from the date on which Data Collector receives Data Owner’s email (sent to [email protected]), its response to Data Owner’s request for access, rectification, cancellation or opposition. If the request submitted to Data Collector is appropriate and Data Collector receives from Data Owner or Data Owner’s legal representative the documentation referred to in this section, the result of the resolution shall be effective within 15 (fifteen) business days from the date on which the response is communicated.

Data Collector may extend this period for up to 20 (twenty) more business days, when the case warrants it, prior notification of said situation to Data Owner. The resolution issued by Data Collector shall be communicated to Data Owner through the email mentioned in the Form.

The delivery of personal information will be free of charge upon proof of Data Owner’s identity to Data Collector, excepting those cases in which derived from the particular request of Data Owner, Data Collector paid shipping costs, and where appropriate costs due to printing or photocopying or other formats to meet the request of Data Owner, the latter must pay, in cases where appropriate, such expenses to Data Collector, situation that will be reported to the Data Owner by Data Collector prior to the delivery of information.

If Data Owner, on their own behalf or through a legal representative, reiterates their request for delivery of Personal Information in a period of less than twelve months from the last delivery of information, Data Collector may request Data Owner or Data Owner’s legal representative, the payment of the costs of reprinting said information, which will not be for any reason more than the equivalent to 10 ten days of General Minimum Wage in force in Mexico City. In the event that there are substantial modifications to this Notice that motivate new consultations, reprinting costs referred to in this paragraph will not be due.

In the event that Data Owner revokes the authorization granted to Data Collector for the processing of Data Owner’s Personal Information under any of the purposes identified as primary in section 3 of this Notice, said revocation will imply the discontinuation and cancellation of any of the services provided by Data Collector as well as the use of the Website and the Digital Platform, in order to comply with the legal provisions in force or the internal policies of Data Collector, without any legal responsibility borne by the latter.

Data Collector reserves its right to make changes to this Notice, which will be made known through its publication on Data Collector’s Website and on the Digital Platform or the one that replaces it.

The modification will be notified in advance: and Data Owner or whoever turns out to be the user or administrator, may express their consent digitally or remotely at the time of authenticating their username and password to log in to the Website or the Digital Platform.

Likewise, Data Owner is informed of the right to oppose the processing of Data Owner’s Personal Information in case of not agreeing with the modifications that this Notice may present, for this, the Owner must send a request to the email address referred to in section 7 of this Notice.

Data Collector informs Data Owner that the competent authority to decide over any dispute arising from the application of the Law and its Regulations is the National Institute of Access to Information and Personal Data (Instituto Nacional de Acceso a la Información y Datos Personales) and you can learn more on its page www.inai.org.mx

This Notice was last amended on October 27, 2020.