Diez de Bonilla

Protection of Personal Data Held by Private Parties (the "Personal Data Law").

All capitalized terms used is not defined herein shall have the meanings ascribed to them in the Personal Data Act.

Identity and Address of the Data Controller. The Data Controller of the Personal Data is Diez de Bonilla, Kuri y Asociados, S.C. ("DBKA"), located at Av. Ejército Nacional #423, Seventh Floor, Colonia Granada, Miguel Hidalgo Delegation, C.P. 11520 Mexico City.

Purposes of Personal Data Processing. There are various purposes for the Processing of Personal Data carried out by DBKA. The main reasons for which DBKA collects Personal Data are as follows:

• Regarding its employees or service providers, to maintain an adequate internal control, as well as to carry out the corresponding payments derived from the employment relationship or service provision, make tax withholdings and payments, and determine the individuals who should be contacted in case of an emergency concerning each employee or service provider.
• Regarding its clients or employees or officials of its clients, for the provision of legal, economic, or any other area related to the consulting services it provides and to collect the fees generated by the provision of DBKA’s services.
• Regarding its potential clients or employees or officials of its potential clients, for the purpose of evaluating the possibility of providing consulting services and providing quotes for the provision of such services.
• Regarding its suppliers, to make requests for products and services, as well as to make payments for the products they provide or for the services they render.

In general, the Personal Data that DBKA collects from the Holders includes names, addresses, phone numbers, email addresses, and, in some cases, resumes, bank account numbers, and tax information.

If, at the time of collecting Personal Data, there is a purpose for its Processing different from those indicated in this section II, DBKA will communicate this to the Holder, with the objective that, if necessary, they may express their Consent to the corresponding purpose.

Likewise, in cases where DBKA collects Sensitive Personal Data, it will notify the relevant Holder to obtain their explicit Consent and clearly inform them of the purpose of the Processing.

Options and Means to Limit Use or Disclosure of Personal Data. Regarding the limitation of the disclosure of Personal Data, all individuals in charge of Processing Personal Data at DBKA have signed an agreement in which they are obligated to maintain confidentiality regarding all information of DBKA or in DBKA's possession that they may access for any reason. The Databases containing Personal Data are safeguarded within DBKA. Databases secured in electronic format that allow remote access can only be consulted by DBKA staff or service providers, using user IDs and passwords that must be changed periodically.

Regarding the limitation of the use of Personal Data, the Holder may stop receiving news or information related to DBKA by submitting a request to DBKA, following the procedure outlined in the next section IV.

Means to Exercise ARCO Rights. To exercise the rights of access, rectification, cancellation, or opposition ("ARCO Rights"), in accordance with the provisions of the Personal Data Law, Holders may submit the corresponding request at the address of DBKA indicated in section I above, by means of a written request addressed to the Personal Data Department of DBKA. The request for access, rectification, cancellation, or opposition ("ARCO Request") must contain and include the following:

• The name of the Holder and the address or another means to communicate the response to their ARCO Request.
• Documents that verify the identity or, where applicable, the legal representation of the Holder.
• A clear and precise description of the Personal Data for which any of the ARCO Rights is being exercised.
• Any other element or document that facilitates the location of the Personal Data.

In the case of ARCO Requests for rectification of Personal Data, the Holder must indicate, in addition to what is stated in this section, the modifications to be made and provide the documentation that supports their request.

DBKA will communicate to the Holder, within a maximum period of twenty days from the date the ARCO Request was received, the determination made, so that if it is appropriate, it can be made effective within the following fifteen days from the date the response is communicated.

The aforementioned deadlines may be extended only once for an equal period, provided that the circumstances of the case justify it.

Transfers of Personal Data. DBKA does not carry out Transfers without having previously obtained the Holder's Consent, when such Consent is required in accordance with the Personal Data Law. If, at the time of collecting Personal Data, there is a need to make a Transfer for which the Personal Data Law requires the Holder's Consent, DBKA will communicate this to the Holder. If the Holder does not oppose, it will be understood that they have granted their Consent to carry out the Transfer. DBKA will communicate to the Third Parties to whom, as applicable, Personal Data is transferred, this Privacy Notice and the purposes to which the Holder subjected their treatment. In such cases, the Treatment of Personal Data by the Third Party must be carried out in accordance with what is agreed upon in this Privacy Notice, and the Third Party must assume the same obligations that correspond to DBKA as the Responsible Party. Notwithstanding the above, DBKA cannot guarantee to the Holder nor is it responsible for the Treatment that the Third Party provides to the Personal Data.

Procedure and Means to Communicate Changes to the Privacy Notice. DBKA reserves the right to make modifications to this Privacy Notice. Any changes to this Privacy Notice will be published on the following website: http://www.diezdebonilla-kuri.com.mx/.

Mechanism to Revoke Consent. If you wish to revoke Consent regarding the Treatment of your Personal Data by DBKA at any time, you must follow the procedure established in the previous section IV. It should be noted that the revocation of Consent will not have retroactive effects, and that Consent cannot be revoked when the Treatment is intended to fulfill obligations arising from a legal relationship between the Holder and the Responsible Party, when such Treatment is established by law, or when any of the exceptions to consent provided in the Personal Data Law apply.

If you are the Holder of Personal Data collected by DBKA and wish to obtain more information about this Privacy Notice and the compliance policies of the Personal Data Law that DBKA has adopted, please send a written request to the address of DBKA indicated in section I above and address it to the Personal Data Department of DBKA.