This document constitutes the Privacy Notice for the purposes of the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (the "LFPDP") and the provisions that emanate from it or are related to it. This Privacy Notice (hereinafter referred to as "Notice") applies to the personal information collected about the Holder by Grupo IBC, Intermediary Business Consulting, IBC in its capacity as Responsible.

In Grupo IBC, Intermediary Business Consulting, with address at Av. Cvln. Jorge Álvarez del Castillo 1471 Piso 3, Lomas Country, 44610 Guadalajara, Jal., We are aware that you have the right to know what information we collect from you and our practices in relation to such information. The conditions contained herein are applicable to all information collected on behalf of Desarrollo Integral de Productos y Servicios SA de CV (Hereinafter "THE RESPONSIBLE").

For the purposes of this Notice, the terms that are used in it and that are not defined in it will have the meaning attributed to them in the LFPDP. The purpose of this Notice is to establish the terms and conditions under which "THE RESPONSIBLE" (or the Manager designated by "THE RESPONSIBLE"):

• You will receive and protect the Owner's Personal Data, in order to protect your privacy and your right to informational self-determination.

• It will use the Personal Data of the Holder.

• It will carry out, where appropriate, the transfers of Personal Data to third parties.

Personal data collected:

The Responsible ”may process Personal Data, that is, information that identifies or makes it identifiable. Some of these personal data are, for example: name, gender, email, postal address, address, document identification number, date of birth, payment data (such as, credit card number, validity), data of billing, date of birth, landline and / or cell phone number, Federal Taxpayers Registry (RFC), number of cards and / or accounts, patrimonial and economic relationship, among others. You provide these personal data voluntarily when you decide to be granted the information and requirements about the products and / or services that "The Responsible" offers.

"The Responsible" may interrelate the information you provide with other information that you have voluntarily provided to third parties. The above in order to adapt our products, services and promotions to your preferences. The collection of personal data may be carried out, for example:

• Through the use of emails and visits to our offices.

• When you communicate by phone with us.

• Through the use of the Responsible's websites.

• Through the voluntary provision of information through the dialogue windows enabled on the sites.

• Through the use of automatic data capture tools.

• Through public access sources and other sources available on the market.

"The Responsible" may also collect Personal Data from publicly accessible sources and from other sources available in the market to which the Holder may have given his consent to share his personal information or that has provided anonymous demographic information associated with a geographic area. determined.

Likewise, within the documentation that can be collected by "THE RESPONSIBLE" for the verification of the identity of the Holder of Personal Data are: the voter's credential, the identity card of the national military service released, the registration card in the RFC, the registration card with the CURP, the proof of address, the special credit report issued by a Credit Information Society, patrimonial relations, marital status, kinship, among others.

In the case of applicants to employees, among others, the birth certificate, proof of studies, the account statement of the Retirement Fund Manager (Afore), the tax withholding sheet, as well as the psychometric, medical and socio-economic study carried out by "The Responsible".

You could also be asked for the Personal Data of your relatives, dependents or beneficiaries and the relevant supporting documentation.

Uses and purposes of your personal data

The Personal Data that you provide to "THE RESPONSIBLE" will be treated, in addition to complying with the obligations derived from the relationship that may be created with you, with the following purposes:

• Provide information on products, services or other activities or proposals of interest of "THE RESPONSIBLE" and its subsidiaries, affiliates and its parent company.

• We use the information we collect to provide you with the products and / or services you request, and inform you about others or products and services offered by "THE RESPONSIBLE" to the user.

• We use the information we collect to provide you with the products and / or services you request, and inform you about others or products and services offered by "THE RESPONSIBLE" to the user. Said third parties are obliged to maintain the confidentiality of the personal data provided and to observe the Privacy Notice.

• The user authorizes their personal data to be transmitted or supplied to other financial institutions, unless they express their disagreement through any available means that the Responsible Party makes available to them.

• To ask you to answer some satisfaction surveys regarding our products and / or services.

• To contact you in relation to the result of the evaluations or analysis of your credit application, this with respect to the products and / or services offered by "THE CONTROLLER" or any other matter related to your request.

• To follow up on any problem that has arisen regarding the products and / or services that have been offered by "THE RESPONSIBLE".

• Where appropriate, verify the credit and / or payment capacity of the Holder, which may be done through credit information companies, in terms of the Law, to regulate Credit Information Companies.

• In general, to send you information from "THE RESPONSIBLE" and its subsidiaries, affiliates and its parent company, for advertising and promotional purposes.

In the event that your personal data is intended to be used for a purpose other than the previous ones, "THE CONTROLLER" will notify you by email or telephone, in order to obtain your consent for the processing of your personal data according to the new purposes. If your consent is not received for the cases in which it is necessary, "THE CONTROLLER" will not use your personal data.

In the case of applicants for employees of "THE RESPONSIBLE" the following activities will be carried out:

• Carry out the recruitment and selection process of personnel.

• Carry out the hiring process. "THE RESPONSIBLE" will safeguard the information obtained by the applicants as well as those of their employees, consisting of their Personal Data, profession, address, among others, for storage, authentication and validation of information. The information provided by the applicants for a vacancy in their case will be protected by "THE RESPONSIBLE". If the applicant states that their information is returned, "THE RESPONSIBLE", through its established processes, will return the respective information.

Collection of data when browsing the sites and web pages of "THE RESPONSIBLE"

Among the automatic data capture tools used by "THE CONTROLLER" on their sites and web pages are cookies, Web beacons, and links in emails.

Use of Cookies.- The correct functioning of the sites of "THE RESPONSIBLE" require the enabling of "cookies" in your Internet browser. "Cookies" are small data files transferred by the website to your computer's hard drive when you browse the site. Cookies can be session or permanent.

Session cookies do not remain on your computer after you log out of your browser, while permanent cookies remain on computers until they are deleted or expire. Cookies are accepted in most browsers.

Automatically, by virtue of your default settings, you can adjust your browser preferences to accept or reject cookies. The deactivation of cookies may disable various functions of the websites of "THE RESPONSIBLE" or that they are not displayed correctly. In case you prefer to delete the information from the cookies sent by "THE RESPONSIBLE", you can delete the file (s) at the end of each browser session. Relevant information can be consulted on the sites of the main Internet browsers.

Links in the emails of "THE RESPONSIBLE" .- The emails that include links that allow "THE RESPONSIBLE" to know if you activated said link and visited the destination web page, and this information may be included in your profile. In case you prefer that "THE RESPONSIBLE" does not collect information about your interaction with said links, you can choose to modify the format of the communications of "THE RESPONSIBLE" (for example, that the message is received in text format and not in HTML format) or you can ignore the link and not access its content. Emails from "THE RESPONSIBLE" may include links designed to direct you to the relevant sections of the Web sites, by redirecting it through the servers of "THE RESPONSIBLE".

"THE RESPONSIBLE" will not share, without your prior consent, your personal data with third parties, nationals or foreigners, outside the group of companies and subsidiaries of "THE RESPONSIBLE", except that:

• The law or a court order requires it.

• To protect the rights or assets of "THE RESPONSIBLE" or its clients.

• That such transfer is provided for in the Federal Law on Protection of Personal Data Held by Private Parties.

Having read, understood and agreed to the terms set out in this Notice, the Holder expresses his consent for "THE CONTROLLER", or any Person in Charge, to carry out transfers of Personal Data to national or foreign third parties, with the understanding that the treatment that said Third parties give the Personal Data of the Holder must comply with the provisions of this Notice.

"THE RESPONSIBLE" may transfer your Personal Data to other third parties that support you to comply with the contracts or legal relationships you have with the Owner.

The Owner acknowledges and accepts that the Responsible Party does not require authorization or confirmation from said Owner to carry out national or international transfers of Personal Data in the cases provided for in Article 37 of the LFPDP or in any other case of exception provided by the same or the other applicable legislation.

Security

"THE RESPONSIBLE" has adopted the security, administrative, technical and physical measures necessary to protect your personal data against damage, loss, alteration, destruction or unauthorized use, access or treatment. However, "THE RESPONSIBLE" cannot and, therefore, does not guarantee that there will not be unauthorized access to your personal data or that communications will be free from any interruption, error or interception by unauthorized third parties.

Access to your personal data held by "THE RESPONSIBLE" will be limited to people who need to have access to such information, in order to carry out the identified purposes.

In the event that at the time of providing your Personal Data to "THE RESPONSIBLE" you are assigned a username and password, you will be responsible for keeping such information confidential. We suggest that you do not share this information with anyone. If you share your computer, always try to log out before leaving a site or service to prevent unauthorized third parties from accessing your information.

The Personal Data of the Holder collected by "THE CONTROLLER" and / or its Managers will be protected by appropriate administrative, technical and physical security measures against damage, loss, alteration, destruction or use, access or unauthorized treatment, in accordance with the provisions of the LFPDP and the administrative regulation derived from it.

Rights that correspond to you as the owner of personal data, you may request access, rectification, cancellation or opposition (ARCO rights) before the Personal Data Protection Department of "THE RESPONSIBLE", regarding your personal data.

ARCO Rights are the following:

• Access.- To be informed which of your personal data is contained in the databases of "THE CONTROLLER" and for what purpose said personal data is used, the origin of said data and the communications that have been made with them.

• Rectification.- That your personal data be corrected or updated in the event that they are inaccurate or incomplete. You must inform "THE RESPONSIBLE" of the changes that must be made to your personal data, when such changes are only known to you.

• Cancellation.- That your personal data be totally or partially removed from the databases of "THE RESPONSIBLE". This request will lead to a blocking period after which the data will be deleted. There are cases in which cancellation will not be possible in terms of the Federal Law on Protection of Personal Data Held by Private Parties and other applicable legal provisions.

• Opposition.- Oppose for legitimate reason the processing of your personal data by "THE CONTROLLER" or limit its use or disclosure. In cases where the opposition can be seen on the receipt of certain communications, in said communications, the option to exit the mailing list and stop receiving them will be included.

You have, at any time, the right to access, rectify and cancel your personal data, as well as to oppose their treatment or revoke the consent that you have provided for this purpose by submitting a request with the following information and documentation:

• Name of the Holder and address or other means to communicate the response to your request.

• The documents that prove your identity (simple copy in printed or electronic format of your voter's credential, passport or FM-3) or, where appropriate, the legal representation of the Holder (simple copy in printed or electronic format of the simple power of attorney with the autograph signature of the Holder, the representative and their corresponding official identifications: voter ID, passport or FM-3);

• The clear and precise description of the Personal Data with respect to which you seek to exercise any of the ARCO Rights.

• Any other element or document that facilitates the location of the Owner's Personal Data.

• In the case of requests for rectification of Personal Data, the respective Holder must also indicate the modifications to be made and provide the documentation that supports their request.

The Responsible Party or its Managers will respond to the respective Holder within a maximum period of ten business days, counted from the date the request was received. The aforementioned terms may be extended only in terms of the LFPDP.

The delivery of the Personal Data will be free, it will only correspond to cover the justified shipping costs or the cost of reproduction in copies or other formats. For the purposes of requests for cancellation of Personal Data, in addition to the provisions of this Notice, the provisions of Article 26 of the LFPDP will be followed, including the cases of exception of cancellation of Personal Data indicated there.

The presentation of a request for opposition to the use of Personal Data by the Owner of the same will give "THE RESPONSIBLE" the power to oppose the use of Personal Data that as Owner has delivered to the opponent.

Consent

For the purposes of the provisions of the LFPDP, and in particular in its Article 17, the Holder states:

That this Notice has been made known to you by "THE RESPONSIBLE".

Having read, understood and agreed to the terms set forth in this Notice, therefore, you grant your consent regarding the processing of your Personal Data for the purposes of the LFPDP and other applicable legislation. In the event that the Personal Data collected includes sensitive or financial Personal Data by signing the corresponding contract, whether in printed format, or using electronic means and their corresponding processes for the formation of consent, for example, by way of example but not limitation, By providing Personal Data through the dialog windows, or viewing and viewing the terms and conditions on the screen, acts will be carried out that constitute the express consent of the owner in terms of the second paragraph of article 8 of the LFPDP and other applicable legislation.

That you grant your consent for "THE RESPONSIBLE" or its Managers to carry out transfers of Personal Data to national or foreign third parties, with the understanding that the treatment that said third parties give to their Personal Data must comply with the provisions of this Notice.

In the event that the Holder does not oppose the terms of the Notice, its content will be considered agreed and consented, in terms of the third paragraph of article 8 of the LFPDP. The Holder's consent may be revoked at any time by the latter, without retroactive effects being attributed to it in accordance with the procedures established later for this purpose in this Notice.

Notwithstanding any provision of this Notice, the Owner acknowledges that their consent will not be required for the processing of Personal Data by the Responsible or third parties in any of the cases indicated in Article 10 of the LFPDP.

By providing any type of information, including your personal data, you expressly:

• Accept the conditions contained in this Privacy Notice.

• You agree that the information provided by you can be stored, used and, in general, processed for the purposes indicated, including for commercial and promotional purposes.

• Grants "THE RESPONSIBLE" authorization to obtain, compile, store, share, communicate, transmit and use such information in any way or form, in accordance with the conditions established herein and the applicable laws.

Limitation of use

"THE RESPONSIBLE" and / or its Managers will keep the Holder's Personal Data for as long as necessary to process their requests for information, products and / or services, as well as to maintain accounting, financial and audit records in terms of the LFPDP and current commercial, fiscal and administrative legislation. In addition to controlling the disclosure of such data or information from business partners.

Contact

Questions, comments, exercise of rights to the Personal Data Protection Department of "THE RESPONSIBLE.

Email: contacto@grupoibc.mx

Address: Av. Cvln. Jorge Álvarez del Castillo 1471 3rd Floor, Lomas Country, 44610 Guadalajara, Jal.

"THE RESPONSIBLE" reserves the right to modify or amend, totally or partially, this Privacy Notice. The modified Privacy Notice will be sent to the email you provided.

The lack of opposition to the new Privacy Notice within 5 business days of receipt will be understood as your acceptance of the terms established therein.