COMPREHENSIVE PRIVACY NOTICE OF FIDELIS TWO S.A. DE C.V.

Identity and Address:

FIDELIS TWO S.A. DE C.V. with address located at Lot 4C, Av. Bonampak SM4A, Manzana 1, 77500 Cancún, Q.R. (hereinafter the "Company"); is constituted as the controller of the personal data you provide us, which will be protected in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), (hereinafter the "Law"), its regulations and other applicable provisions.

PERSONAL DATA TO BE PROCESSED

The personal data that the Company will collect from you through the information and/or documentation provided personally or directly by you, or those obtained indirectly, that is, automatically and/or through electronic means, including but not limited to: emails, applications, website, data messages, etc... and exclusively for the purposes indicated in clause III of this Privacy Notice are: a) name; b) address; c) email; d) telephone number; e) contact information; e) Federal Taxpayer Registry key; f) financial or patrimonial data; g) Data related to your occupation.

PURPOSES OF THE PROCESSING OF PERSONAL DATA

The personal data collected by the Company from you are used for:

1. The preparation of contracts, agreements, payments for your services, quotes, as well as other commercial matters derived from the main contract and/or operation.
2. Documenting internal processes derived from the policies of the companies of the same corporate group to which the Company belongs.
3. Documenting the operations and/or transactions carried out.
4. To contact you and send you relevant information regarding various topics.
5. Requesting products and/or services.
6. Providing payment information.
7. To comply with the obligations derived from the legal relationship created or that may be created with you. In this sense, your personal data are used specifically for the creation and administration of your account according to our information systems and to maintain contact with you.
8. For the preparation and follow-up of purchase or service orders; preparation of contracts; payment processing; sending or receiving invoices or receipts; formation of supplier files, and in the case of internal audits. These purposes are necessary for the correct development of your legal relationship with the Company.

Additionally, we will use your personal data strictly and exclusively for the following purposes that are not necessary for the legal relationship between the Company and you as the data owner:

1. To demonstrate the materiality of the operations carried out by the Company in tax matters.
2. To provide them if required by tax authorities or any other authority.
3. To be provided to judicial, administrative or labor authorities in any claim or conflict as required.
4. Additionally, the Company may process your personal data to form the supplier database, as well as for marketing, advertising or commercial prospecting purposes. Although these purposes are not necessary to originate or maintain your legal relationship with the Company, they allow and facilitate providing you with better service.

The Company will process your personal data only for the time necessary to comply with the purposes described in this Privacy Notice and/or in accordance with the provisions of both the Law and applicable legal and regulatory provisions.

MECHANISM THE COMPANY HAS IMPLEMENTED FOR YOU TO EXPRESS YOUR REFUSAL TO THE PROCESSING OF YOUR PERSONAL DATA IN RELATION TO THE PURPOSES THAT ARE NOT NECESSARY FOR THE LEGAL RELATIONSHIP BETWEEN THE COMPANY AND YOU.

You are informed that the email address avisoprivacidad@fidelismg.com is available for you to express your refusal or non-authorization for the processing of your personal data, particularly with regard to purposes that are not necessary to create, modify, and continue the legal relationship the Company has with you.

Also, for the aforementioned purposes, you may call the following telephone number 9982516801 of Grupo Fidelis, from 9:00 hrs to 18:00 hrs Monday to Friday, on the understanding that your refusal expressed by telephone must be ratified in writing by sending a communication to the aforementioned email address.

TRANSFER OF PERSONAL DATA

You are informed that the Company does not transfer your personal data to third parties, with the exception of its parent company, controlling company, subsidiary or affiliate under the same control, or any company of the same economic or corporate group that operates under the same internal processes and policies[cite: 25].

Additionally, the Company may remit your data to national or foreign third-party service providers necessary for the maintenance and fulfillment of the Company's legal obligations, as well as obligations derived from the legal relationship you have with the Company.

Specifically, the Company will remit all or part of your personal data to providers of internal audit, legal, foreign trade and customs services, or any other service provided by the company's suppliers on a regular basis, such as transportation services, transfers, among others.

The Company will ensure, through the signing of confidentiality agreements and/or the adoption of other binding documents, that such third parties maintain adequate administrative, technical, electronic and/or physical security measures to safeguard your personal data, and that such third parties only use your personal data for the purposes for which they were collected in accordance with this Privacy Notice[cite: 28].

Likewise, in the event of an official requirement, the Company may transfer your personal data to the requesting authority.

By virtue of the foregoing, by ACCEPTING this Privacy Notice, you expressly accept the transfer of your data in the terms referred to above, it being understood that such consent is only required for the purposes of the third paragraph of this clause in accordance with articles 35 and 36 of the Law.

MEANS FOR EXERCISING ARCO RIGHTS

In the cases provided for by the Law, you can at any time exercise your rights of Access, Rectification, Cancellation or Opposition (ARCO rights) regarding the processing that the Company gives to your personal data. To exercise any of your ARCO rights, you must:

1. Submit the respective request by filling out the Unique Form for the Exercise of ARCO Rights. The request must be sent to the email: avisoprivacidad@fidelismg.com, accompanied by the documents established in the form.
2. Accredit your identity through the presentation or sending of a copy of your official identification document, also exhibiting the original for comparison, or the legal representation of your representative through a public instrument, power of attorney signed before two witnesses or their declaration in personal appearance; and
3. In case of a request for rectification of your personal data, present the documentation that supports your request.

You are informed that the Company may deny access to personal data, or carry out the rectification or cancellation or grant opposition to the processing of these, either totally or partially, in the following cases:

• When you are not the owner of the personal data, or your legal representative is not duly accredited for it;
• When your personal data is not found in our database;
• When the rights of a third party are violated;
• When there is a legal impediment, or a resolution from a competent authority, that restricts access to personal data, or does not allow their rectification, cancellation or opposition[cite: 38]; and
• When the rectification, cancellation or opposition has been previously carried out.

The Company will attend to your request and within a period not exceeding 20 days will communicate the corresponding determination in writing to the address indicated above, or to the email address through which you submitted your request, as the case may be. Our response may include simple copies, electronic documents in editable format or PDF, recordings or videos, or any other means of reproduction that the Company deems pertinent to provide a timely response to your request.

In the event of denial of access to personal data, you will be informed of the reason for our decision within the period indicated in the previous paragraph, with the evidence we deem pertinent.

If you have any questions about how to exercise your ARCO rights, you may contact the Company's legal department through the email address avisoprivacidad@fidelismg.com; or at the aforementioned address, during the following hours: Monday to Friday 9:00 hrs to 18:00 hrs.

MECHANISMS AND PROCEDURES FOR THE REVOCATION OF CONSENT

Additionally, when the Law so permits, you may limit or revoke the consent that, if applicable, you have granted to the Company for the processing of your personal data.

To limit or revoke your consent, you must submit the respective request and prove your identity, or if applicable, the legal representation of your representative, in accordance with what is established and complying with the requirements referred to in the previous clause of this Privacy Notice. The Company will attend to your request and within a period not exceeding 20 days will communicate the corresponding determination at the same address where you submitted your request, or to the email address through which you submitted your request, as the case may be.

OPTIONS AND MEANS TO LIMIT THE USE OR DISCLOSURE OF PERSONAL DATA

You are informed that the Company has designed and implemented very strict internal policies and measures for limiting the use and disclosure of your personal data. The Company continuously conducts informative seminars so that the personnel in charge of processing your personal data for the purposes set forth in this Privacy Notice are aware of these limitations and comply with the principle of accountability indicated by the Law and its regulations.

Likewise, in case you decide not to receive or limit the frequency of promotions or communications through our advertising campaigns, you are informed that you may contact the Company's legal department through the email address avisoprivacidad@fidelismg.com, or at the address mentioned in clause V of this Privacy Notice. The Company will attend to your request and within a period not exceeding 20 days will communicate the corresponding determination at the same address where you submitted your request, or to the email address through which you submitted your request, as the case may be.

USE OF COOKIES AND WEB BEACONS

The Company's Internet sites and online services are based on the use of Cookies and Web beacons. For the purposes of this Privacy Notice, Cookies are defined as the data file stored on the hard drive of a computer or electronic communications device of a user when Browse a specific internet site, which allows the exchange of status information between said site and the user's browser. The status information may reveal session identification, authentication or user preferences, as well as any data stored by the browser regarding the internet site[cite: 54].

Additionally, Web beacons are defined as the visible image inserted within a website or email, which is used to monitor user behavior in these media[cite: 55]. Through these, information such as the originating IP address, browser used, operating system, time of access to the internet site, and in the case of email, the association of the aforementioned data with the recipient can be obtained.

By entering and continuing to browse our internet sites, or by receiving and interacting with our emails, you consent to the Company collecting and processing your personal data. The use of this technology is necessary for the proper functioning of our internet site, to fulfill the purposes of processing your personal data, as well as for operational, technical and security reasons.

The Company will process your personal data solely and exclusively in accordance with this Privacy Notice, as well as to comply with the obligations derived from the legal relationship you have with the Company.

However, if you wish to disable such technologies, you are informed that you may contact the Company's legal department through the email address avisoprivacidad@fidelismg.com, or at the address mentioned in clause V of this Privacy Notice. The Company will attend to your request and within a period not exceeding 20 days will communicate the corresponding determination at the same address where you submitted your request, or to the email address through which you submitted your request, as the case may be.

CHANGES TO THE PRIVACY NOTICE

The Company may make changes to this Privacy Notice, in which case, you may learn about the modifications and/or updates on the website https://www.fidelismarketinggroup.com/privacy-policy  or by requesting them directly from the Company's legal department following the route specified in this Privacy Notice.

I state that I have read and agree with the terms and conditions of this Privacy Notice made available to me by the Company, and that I give my express consent for the processing of my personal data in terms of what is established herein.

Last updated May 22, 2025.