Privacy Notice

Scope and commitments

This PRIVACY NOTICE applies to the processing of personal data of clients, prospective clients, suppliers and visitors to the website of Four Sides Group S.A. de C.V. (hereinafter, FSG).

For the processing of personal data of employees and candidates, FSG has a Comprehensive Privacy Notice for Employees and Candidates, which is provided directly to the data subject at the start of the hiring or selection process. You may request it at the email address indicated in this document.

For the purposes of this PRIVACY NOTICE, any terms used that are not defined herein shall have the meaning given to them by Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and the Privacy Notice Guidelines issued by the INAI.

FSG is committed to the right to protection of personal data of any Data Subject, also known as the "right to informational self-determination," which is guaranteed and protected as a human right in the second paragraph of Article 16 of the Political Constitution of the United Mexican States and in the legislation on personal data protection.

FSG specifically undertakes, including but not limited to, to: (i) use or apply your personal data exclusively for the purposes set forth in this PRIVACY NOTICE; (ii) ensure that your personal data is handled in strict accordance with professional secrecy and confidentiality; (iii) observe the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality and accountability, as well as the security and confidentiality duties set forth in applicable law; and (iv) implement and maintain administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction, or unauthorized use, access or processing.

I. Identity and address of the data controller

Four Sides Group S.A. de C.V. is the party responsible for processing your personal data, with its address at Madre Selva No. 15, Colonia La Malinche, Alcaldía Magdalena Contreras, C.P. 10010, Mexico City, Mexico.

For any matter related to the protection of your personal data, you may contact our Personal Data Protection Department:

Email: avisodeprivacidad@4sides.com.mx

Office hours: Monday to Friday, 9:00 a.m. to 5:00 p.m. on business days.

Address for submitting written requests: the address indicated in the preceding paragraph.

II. Personal data collected

Depending on your relationship with FSG and the specific purposes, we may collect the following categories of personal data:

If you are a Client: identification data (full name or company name, RFC tax ID, CURP in the case of individuals, nationality); contact data (tax and delivery address, phone number, email); employment data (job title, department, company); financial or asset data (bank details —account, CLABE— for invoicing and collections, purchase and payment history); demographic data (line of business, economic sector).

If you are a Prospective Client: identification data (name, company you represent); contact data (phone number, email, city); employment data (job title, department, sector); demographic data (line of business and company size).

If you are a Supplier: identification data (name or company name, RFC tax ID, legal representative); contact data (tax address, phone number, email); employment data (job title, department); financial or asset data (bank details for payment of services, tax status certificate); third-party data (commercial references).

If you are a Website Visitor: IP address, browser and device identifier, language, pages visited, browsing time, referring site (see section X).

Not all of the above information is collected in every case. Some data may not be provided by the Data Subject or may not be necessary for the provision of the service.

III. Sensitive personal data

Within the context covered by this notice (clients, prospects, suppliers and site visitors), FSG does not collect or process sensitive personal data as defined in Article 9 of the LFPDPPP (racial or ethnic origin, health status, genetic information, religious, philosophical or moral beliefs, union membership, political opinions, sexual preference).

Should a specific service require the processing of sensitive data, the Data Subject's prior express written consent will be requested through a separate document in accordance with Article 9 of the LFPDPPP.

IV. Purposes of processing

Your personal data will be processed for the following purposes:

A. Primary purposes (necessary for our relationship with you). a) Clients and prospective clients: providing the services and products you have requested; issuing invoices, receipts and payment confirmations; handling inquiries, technical support and after-sales service; commercial prospecting related to the requested service or product; sending mandatory or service communications (welcome letters, payment reminders, technical and commercial matters, and security notices); fulfilling obligations arising from the contract or business relationship; complying with tax, accounting and any other applicable legal obligations.

b) Suppliers: establishing and maintaining the business relationship; confirming services, receiving products and making payments; fulfilling contractual, tax and accounting obligations.

B. Secondary purposes (not necessary for the relationship; you may object). a) Clients and prospective clients: assessing the quality of products and services through satisfaction surveys; displaying personalized content and advertising based on interests and preferences; sending product surveys and promotional emails about other products or services available from FSG, its affiliates and subsidiaries; internal statistics and market research.

Objection to secondary purposes. If you do not want your personal data to be processed for the secondary purposes indicated (surveys, personalized ads, promotional emails, market research), you may state your objection by sending an email to avisodeprivacidad@4sides.com.mx with the subject line "Oposición a finalidades secundarias" (Objection to secondary purposes), stating your full name and the purposes you object to.

Objecting to the use of your personal data for secondary purposes will not be a reason for us to deny the services and products you request or contract.

V. Transfers of personal data

Your personal data may be transferred, within and outside Mexico, to the following recipients and for the purposes indicated:

Affiliates, parent companies or subsidiaries within the FSG group — Purpose: integrated group operations, coordinated provision of services — Requires your consent: No (Art. 37-III LFPDPPP).

Tax authorities (SAT) and competent administrative authorities — Purpose: compliance with legal and tax obligations — Requires your consent: No (Art. 37-I and 37-VI LFPDPPP).

Judicial or administrative authorities with a duly grounded order — Purpose: compliance with a legal mandate — Requires your consent: No (Art. 37-VI LFPDPPP).

Financial and banking institutions — Purpose: payment processing, collections, invoicing — Requires your consent: No (necessary to fulfill the contractual relationship).

Technology service providers (hosting, email, backup, CRM, messaging), including international providers — Purpose: operation of systems, infrastructure and communications — Requires your consent: No (processors, bound by contractual confidentiality and data protection clauses).

External accounting, tax or law firms — Purpose: professional advice and compliance with obligations — Requires your consent: No (processors, bound by confidentiality).

International transfers. Some of the technology service providers listed above (for example, messaging services such as WhatsApp Business, cloud platforms, corporate email) are located outside Mexican territory. Such transfers are carried out under contractual clauses that require the recipient to provide a level of protection equivalent to that established under Mexican law.

In all cases, the recipient of your personal data will process it in accordance with this PRIVACY NOTICE and applicable law. FSG does not carry out transfers involving sensitive personal data outside the cases permitted by law.

If you do not want your personal data to be transferred for purposes not necessary for the contractual relationship, you may state your objection by sending an email to avisodeprivacidad@4sides.com.mx.

VI. Data retention period

Your personal data will be retained only for as long as necessary to fulfill the stated purposes and applicable legal obligations, according to the following periods:

Client and supplier data (operations): for the duration of the contractual relationship and up to 5 years thereafter. Legal basis: Commercial Code Art. 38; Federal Tax Code (CFF) Art. 67.

Tax data (invoicing, receipts): 5 years after issuance. Legal basis: CFF Art. 67.

Data of prospects who did not become clients: up to 2 years from the last contact, unless cancellation is requested earlier. Legal basis: reasonable period under the LFPDPPP.

Marketing and prospecting data: until the Data Subject exercises the right to cancellation. Legal basis: LFPDPPP.

Browsing data and cookies: according to the type of cookie (session or persistent — see section X). Legal basis: LFPDPPP, INAI Guidelines.

Once the legal periods and/or the purposes of processing have concluded, the personal data will be deleted following the secure deletion procedure defined by the Personal Data Protection Department.

VII. ARCO rights and how to exercise them

As a Data Subject, you or your legal representative may exercise your ARCO Rights (Access, Rectification, Cancellation and Objection), as well as revoke the consent given for the processing of your personal data, by submitting a request to the Personal Data Protection Department.

How to submit your request: by email to avisodeprivacidad@4sides.com.mx, or in writing at the address indicated in section I.

Your request must include: the Data Subject's name and address or other means to communicate the response; a copy of a valid official ID of the Data Subject or, where applicable, of the legal representative (together with a notarized power of attorney if applicable); a clear and precise description of the personal data with respect to which any ARCO right is being exercised or consent is being revoked; any other element or document that helps locate the data; in the case of Rectification, the changes to be made and the supporting documentation; signature of the Data Subject or legal representative at the end of the document.

Response times: acknowledgment of receipt immediately upon submission of the request. Request for additional information (if applicable): within 5 business days of receipt; the Data Subject will have 10 business days to respond, otherwise the request will be deemed not submitted. Response to the request: up to 20 business days from receipt (or from when the additional information is completed). Enforcement of the right (when applicable): within 15 business days following the response.

Exercising ARCO rights is free of charge. Only justified shipping or reproduction costs for copies or other formats, if any, must be covered. For repeated requests within periods of less than 12 months, a fee equivalent to that established under applicable law may be charged.

When exercising the right of Access, the requested information will be made available to the Data Subject through simple copies or electronic documents.

VIII. Revocation of consent

You may revoke at any time the consent you have given us for the processing of your personal data by following the same procedure described in section VII, expressly stating your intention to revoke consent.

However, we may not be able to fulfill your request or stop the use immediately in every case, since we may be required by a legal obligation to continue processing your personal data. Likewise, in certain cases the revocation of consent will entail the termination of the contractual relationship.

IX. Limiting the use or disclosure of your personal data

In addition to exercising your ARCO rights, you may limit the use or disclosure of your personal data by requesting to be included in an internal exclusion list for advertising or promotional purposes. To do so, send your request to avisodeprivacidad@4sides.com.mx.

You may also register with the Public Registry to Avoid Advertising (REPEP) of Mexico's Federal Consumer Protection Agency (PROFECO), available at https://repep.profeco.gob.mx.

X. Use of cookies, web beacons and similar technologies

Our website uses cookies, web beacons and other tracking technologies through which it is possible to monitor your behavior as an internet user, as well as to provide you with better service and experience when browsing our site.

Personal data collected through these technologies: the Data Subject's preferred language; type of browser, operating system and device used to access the site; web pages visited within our site; links followed and time spent; the Data Subject's IP address; website visited before ours (referrer).

Types of cookies used: session cookies (automatically deleted when the browser is closed); persistent cookies (stored for a defined period or until the Data Subject deletes them); first-party cookies (managed directly by FSG for the operation of the site); third-party cookies (managed by web traffic analytics and advertising service providers —for example, Google Analytics, advertising pixel tools and social media services— in accordance with their own privacy policies).

How to disable cookies. You can set your browser to reject, selectively accept or delete cookies. See the instructions in your browser's official documentation (Chrome, Firefox, Microsoft Edge, Safari, among others). Disabling cookies may affect the operation or features of some sections of the site.

Links to third-party sites. Our site may include links to third-party websites or social networks. When you access those sites, you leave the FSG site and become subject to the privacy policies and terms of the respective third parties; therefore, FSG assumes no responsibility for the data processing they carry out.

XI. Processing of personal data of minors

FSG does not knowingly collect personal data from individuals under 18 years of age through its services or website. If the processing of minors' data is identified, such data will be deleted immediately, unless the express consent of the person exercising parental authority or guardianship has been obtained, in accordance with Article 8 of the LFPDPPP.

XII. Recourse before the authority

If you believe that your right to personal data protection has been violated by any act or omission by FSG, or if you suspect any violation of the provisions of the LFPDPPP, its Regulations and other applicable laws, you may file a complaint with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI):

Website: https://home.inai.org.mx

Phone: 800 835 4324

Address: Av. Insurgentes Sur 3211, Col. Insurgentes Cuicuilco, Coyoacán, C.P. 04530, Mexico City.

XIII. Changes to this Privacy Notice

Changes and updates to this PRIVACY NOTICE will be published on our main website, https://www.4sides.com.mx, indicating the date of the last update. In the case of substantial changes, FSG may additionally notify clients and suppliers with an active relationship by email.

If you are reading a printed version, please always check the current version on the website indicated.

By providing us with your personal data by any means, you acknowledge and accept this PRIVACY NOTICE, granting your consent for us to process it as set forth in this document and in accordance with applicable law.