PRIVACY POLICY

I. IDENTITY AND ADDRESS OF THE CONTROLLER

CREA-THUM, located at Av. Baja California 274, 2nd Floor, Interior 2-B, Col. Hipódromo, Zip Code 06100, Mexico City, is the Controller responsible for processing its clients’ (Data Subjects) personal data, which may be collected through the following means: (i) Directly, when the Data Subject enters Personal Data through our website; (ii) Indirectly, when their Personal Data is transferred to us under the assumptions set forth in Article 37 of the Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”) or with their consent; and (iii) Indirectly, when obtained from publicly accessible sources as permitted by the Law. This Comprehensive Privacy Notice is made available to the Data Subject prior to collecting their Personal Data, in strict accordance with the principles of information, legality, consent, quality, purpose, loyalty, proportionality, and responsibility as provided in the Law.

II. WHAT PERSONAL DATA DO WE COLLECT?

To fulfill the purposes described in this Comprehensive Privacy Notice, CREA-THUM will collect and process the following data:

• Full name
• Address (street, number, neighborhood, borough/municipality, ZIP code, and state)
• Landline telephone number
• Email address
• Tax data (RFC, tax address, and business name)
• Valid official ID (INE or Passport)
• Proof of address (issued within the last 3 months, e.g., telephone, electricity, or water bill)

CREA-THUM does not collect or process sensitive personal data. If you contact us through social media, we may collect data from your public profile to respond to your inquiries or information requests regarding our products.

III. FOR WHAT PURPOSES DO WE USE YOUR PERSONAL DATA?

The personal data collected will be used by CREA-THUM for the following primary purposes that are necessary for providing our service:

• Creating and managing your user account
• Keeping a record of activities related to your user profile
• Identifying and contacting the user to follow up on services offered on the site
• Verifying and confirming the user's identity, including verification through biometric data as per applicable regulations
• Validating and verifying the user's identity, including matching information from the Voter ID and biometric data (such as fingerprints and facial features) against the National Electoral Institute’s records
• Complying with the Federal Law for the Prevention and Identification of Operations with Illicit Funds and other applicable laws
• Resolving banking clarifications
• Complying with legal requests from competent authorities
• Detecting and preventing fraud
• Contacting you via phone calls, emails, SMS, or other physical/electronic means, including instant messaging services
• Determining your geographical location to offer region-specific content, promotions, or benefits
• Monitoring service quality
• Maintaining the security of networks and electronic communication services, identifying errors or technical issues, and ensuring proper service delivery
• Complying with internal policies and procedures
• Complying with applicable regulations, including responding to properly grounded and justified requests from authorities
• Responding to your feedback, complaints, and/or suggestions
• Conducting investigations or inquiries related to complaints or claims
• Handling your ARCO Rights (Access, Rectification, Cancellation, and Opposition) and Consent Withdrawal requests

In addition, your personal information will be used for the following secondary purposes, which are not essential for the requested service, but allow us to provide better service:

• Creating customer and product user profiles for CREA-THUM
• Sending information about offers, promotional messages, marketing, advertising, and commercial prospecting for new or existing products or services
• Conducting surveys, market studies, participating in events, contests, trivia, games, social networks, chats, and other activities that help us evaluate the quality of our products and services
• Evaluating service quality
• For analytical, statistical, and marketing purposes, solely to improve our services

If you do not wish for your data to be processed for secondary purposes, you may send an email to soporte@crea-thum.com, stating your objection and specifying that it applies to the CREA-THUM brand. We will respond within a maximum of 20 business days.
Refusal to allow the use of your data for these secondary purposes will not be a reason for us to stop providing the requested products or services.

IV. WHO DO WE SHARE YOUR INFORMATION WITH AND FOR WHAT PURPOSES?

CREA-THUM may transfer your personal data to third parties without requiring your consent in the cases established in Article 37 of the Federal Law on the Protection of Personal Data Held by Private Parties.

V. HOW CAN YOU EXERCISE YOUR ARCO RIGHTS AND/OR WITHDRAW YOUR CONSENT?

You or your duly accredited legal representative may exercise your rights of Access, Rectification, Cancellation, or Opposition (ARCO Rights), as well as withdraw your consent to process your personal data at any time.

To do so, please send your request to our Privacy Department at soporte@crea-thum.com. In your email, specify whether you are exercising ARCO rights or withdrawing your consent, and indicate that the request is for the CREA-THUM brand. Once we receive your request, we will send you the appropriate form and procedure.
We will respond within 20 business days from the date the request is received. The response will be sent to the email address or physical address you provided. If applicable, CREA-THUM will have 15 business days to fulfill the request.

We may deny access, rectification, cancellation, or opposition of personal data in the following cases:

• The applicant is not the Data Subject or their representation is not duly accredited
• The data does not exist in our database
• Third-party rights are affected
• Legal restrictions or authority resolutions limit access, rectification, cancellation, or opposition
• The requested actions have already been carried out

For further information about the procedures, requirements, and deadlines to exercise your ARCO rights or revoke your consent, contact our Privacy Department.

VI. HOW TO LIMIT THE USE OR DISCLOSURE OF YOUR PERSONAL DATA

If you wish to limit the use or disclosure of your personal data for advertising and/or marketing purposes, send an email to soporte@crea-thum.com indicating your request or unsubscribe automatically through the "Unsubscribe" link included in our emails.
We commit to including your information in an Opt-Out List to suspend all advertising and/or marketing communications.

VII. NATIONAL INSTITUTE FOR TRANSPARENCY, ACCESS TO INFORMATION AND PERSONAL DATA PROTECTION (INAI)

If you believe your personal data protection rights have been violated due to improper handling by CREA-THUM and/or its processors, you may file a complaint with INAI. For more information, visit www.inai.org.mx.

VIII. USE OF TRACKING TECHNOLOGIES ON OUR WEBSITE (COOKIES)

We inform you that our website uses cookies, web beacons, and other technologies that allow us to monitor your online behavior to provide a better experience and offer new products and services based on your preferences.

Personal data collected through these technologies includes:

• Browser used
• Server name
• IP address
• Date, time, and browsing duration on the Internet and our site or app
• Sections visited
• Web pages accessed prior to ours

To disable these technologies, follow these steps:

1. 1. Access our website
2. 2. Click on the “Cookies” section in your browser settings
3. 3. Activate the cookie disabling option

IX. PRIVACY NOTICE UPDATES

This Privacy Notice may be modified, updated, or changed due to: (i) Legal requirements (ii) Our needs regarding products or services (iii) Our privacy practices (iv) Changes in our business model (v) Other reasons We will notify you of any changes via our website. Please check it regularly.

X. ACCEPTANCE OF THE PRIVACY NOTICE

By using our services or purchasing our products, you authorize the processing of your personal data in accordance with this Privacy Notice.

Last update: October 2024