PRIVACY POLICY

1.- Controller of Personal Data Processing: In compliance with the Mexican law known as the “Ley Federal de Protección de Datos Personales en Posesión de Particulares” (Federal Law on the Protection of Personal Data Held by Private Parties), We want to inform you that Grupo Esole Creando Soluciones S.C., hereinafter referred to as “FGV&A” Mexican Law Firm, with its principal offices located at Av. Tulum, Sm. 15-A, Mza. 3, Edificio Equinox, Oficina 4, Cancún, Q. Roo, and website www.realestatelawyersmexico.com will collect and process your personal data in compliance with the Mexican provisions exclusively for the purposes specified below.

2.- Collection of Personal Data: The personal data that FGV&A will collect and process includes personal information of the data subject, such as their full name, email address, address, telephone numbers, place and date of birth, marital status, number of children, education, work experience, personal and professional references, socio-economic situation, financial and asset data, bank account information, social security number, tax ID number, CURP, and any other strictly necessary data for the purposes mentioned below. FGV&A only collect and process personal data that is necessary to fulfill the specific purposes for which it was obtained, including sensitive personal data. To ensure the security and confidentiality of the personal data collected, FGV&A Mexican Law Firm will implement appropriate technical and organizational measures in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties and its regulations. For the collection of personal data, FGV&A Mexican Law Firm follows all the principles established by law, such as lawfulness, quality, consent, information, purpose, loyalty, proportionality, and responsibility. Personal data will be collected directly from the data subject personally, or through other optical, sound, visual, or any other legally permitted technology, through applications, forms, resumes, interviews, socioeconomic studies, medical and psychometric evaluations, on our website or online services, among others. In addition, we may obtain information from the data subject from other sources permitted by law, such as telephone or employment directories, job boards, references from other companies or individuals, public databases of any public or private entity or agency, among others.

3.- Purposes of Personal Data Processing: FGV&A Mexican Law Firm will collect your personal data without disclosure or commercial use, and solely for the following purposes: i) Verify an individual's identity; ii) Provide products and services you request; iii) Process and collect payments; iv) Contact you; v) Perform all necessary internal and external procedures related to the provision of our services; vi) Comply with legal, tax, labor, social security, and other obligations arising from the contractual relationship and in accordance with applicable laws; vii) handle potential administrative or judicial proceedings involving the data subject's personal data; viii) To ensure the safety of our facilities and those within them; and ix) others permitted by law. FGV&A maintains strict control through our prevention, detection, and video surveillance systems. These measures not only verify compliance with internal policies and laws, but also promote the safety and normalcy of FGV&A and all individuals on our premises. Personal data will be kept under strict confidentiality and will not be used for any other purpose than those mentioned above unless there is a change in this Privacy Notice. Once the purpose of the personal data processing is fulfilled, they will be blocked solely for the purpose of determining possible liabilities related to their processing, until the legal or contractual prescription period expires. During this period, personal data may not be processed, and after this period, they will be deleted from the corresponding database.

4.- Options and Means to Limit the Use or Disclosure of Data: FGV&A Mexican Law Firm has and have implemented the necessary and sufficient security, administrative, technical, and physical measures to protect your personal data against damage, loss, alteration, destruction, unauthorized use, access, or processing. Personal data is safeguarded in databases and computer equipment that have the necessary security to prevent information leaks. Physical and logical access controls, environmental controls, 2 of 3 anti-intrusion protection systems (IPS, Firewall), antivirus protection tools, and web filtering are some of the tools used to maintain data security in the information systems of FGV&A. The computer security tools mentioned in the previous paragraph are supported by an internal information security policy that explains to employees the security considerations they must consider when using a computer system and is constantly reinforced. Therefore, we inform you of the options you have to exercise you right to request the limitation of the use or disclosure of your personal data, subject to this Notice: i) In writing sent to the Personal Data Processing Manager in our offices ii) by email addressed to privacy@grupoesole.org ii) By telephone or via WhatsApp at +52 998 291 88 36

5.- ARCO Rights: Means to exercise the right to Access, Rectification, Cancellation, or Opposition of your personal data pursuant to data privacy regulations. Data subject may exercise its ARCO rights (access, rectification, cancellation, and/or opposition) by directly contacting the Personal Data Processing Manager accordingly to section 4 of this privacy notice. The request must meet requirements set by Article 29 of the “Ley Federal de Protección de Datos Personales en Posesión de Particulares”, which sets providing: i) Name and address of data subject or another means to communicate the response to your request; ii) Documents that prove your identity or, where appropriate, the legal representation of data subject iii) A clear and precise description of the personal data regarding which data subject seeks to exercise any of the rights; iv) Any other element or document that facilitates the location of personal data, as well as any other document required by current legislation at the time of submitting the request. FGV&A Mexican Law Firm is not obliged to cancel personal data when it falls under any of the situations established by law, among others, the following: when it pertains to the parties of a private, social, or administrative contract and are necessary for its development and compliance; when they must be processed by legal disposition; when it obstructs judicial or administrative actions related to tax obligations, investigation and prosecution of crimes, or updating of administrative sanctions; when they are necessary to protect the legally protected interests of the data subject; when they are necessary to carry out an action in the public interest; when they are necessary to fulfill a legal obligation acquired by the data subject and are essential to treatment for prevention or medical diagnosis or health service management, provided that said treatment is carried out by a healthcare professional subject to a duty of secrecy.

6.- Data transfers to third parties: Personal data will never be disclosed or shared with third parties, understanding that companies that are part of the same group and require personal data for the aforementioned purposes are not considered as third parties. The only transfer of data to third parties will be for compliance with judicial or administrative actions related to tax obligations, investigation, and prosecution of crimes, or updating of administrative sanctions, lawsuits that arise from contractual relationship with the data subject. Therefore, by giving consent to this Privacy Notice, or by not manifesting opposition within 15 (fifteen) days from the date of knowledge, the data subject accepts that their personal data will be processed for the aforementioned purposes.

7.- Revocation: The data subject may revoke their consent for the processing of personal data at any time, by sending a written request to the Personal Data Processing Manager, as mentioned in section 4 and 5 of this Privacy Notice. We will have a maximum period of 20 business days to inform the data subject about the validity of their request. If the request is deemed valid, it will be effective within fifteen business days from the date of notification of the response to the email provided for this purpose.

9.- Consent: By using this website or providing personal data through any of the means indicated in section 2 of this privacy notice, data subject (you, user, client, applicant) consent to the processing of your personal data in accordance with the terms and conditions of this Privacy Notice.

10.- Changes to Privacy Notice: FGV&A Mexican Law Firm reserves the right to change this Privacy Notice at any time. The modifications will be available through any of the following means: i) Visible announcements in our establishments (notice board) or Service Modules; ii) on our website; or iii) we will send them to the last email address you provided us. FGV&A Mexican Law Firm will not be responsible if you do not receive the notification of change in the Privacy Notice if there is any problem with your email account or internet data transmission.

Last update to this Privacy Notice: March 3, 2022.