NOTICE OF PRIVACY

IDENTITY AND ADDRESS OF THE RESPONSIBLE

In accordance with the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter, “LFPDPPPP”), and other applicable secondary regulations in force, as well as national and international standards on the protection of personal data, PROGELA, SA DE CV , with address for privacy and personal data protection issues located at Calle Scotia #44, Colonia Parque San Andrés, Delegación Coyoacán, CP 04040, Mexico City, (hereinafter the “Controller”) recognizes that privacy and The security of your personal data constitutes rights of utmost importance to you, which is why the Controller is obliged to protect them under the highest levels of legal, technological and administrative security.

The Controller makes this comprehensive privacy notice (the "Privacy Notice") available to the Owner - prior to obtaining the Personal Data - in strict accordance with the -principles of information, legality, consent, quality, purpose, loyalty , proportionality and responsibility - contemplated in the LFPDPPP.

The Controller may collect the personal data mentioned in this Notice, through the following means: (i) personally, when the Owner provides it physically in our facilities, (ii) directly, when The Owner enters them through the website, provides them via email or telephone, and (iii) indirectly, when other companies transfer them to us or they are obtained through public access sources permitted by the LFPDPPP.

PERSONAL DATA COLLECTED

For the purposes established in this Privacy Notice, we may obtain the personal data referred to below:

· Identification data: information that allows you to be differentiated from other individuals. These data include: name, date of birth, electronic signature, federal taxpayer registry (RFC); copy of the document with which you prove your identity (Voter Credential with Photo or other type of document).

· Contact details: information that allows us to keep in touch with you. These data include: address for the purposes of making deliveries, email, home telephone number or other contact telephone number.

· Asset and/or financial data: information related to your assets or rights. These data include: bank details, including credit or debit card information to make purchases on the Website.

· Electronic records: this information includes purchase information, IP address with which you access the Website, user preferences, browser type; activity on the site, cookies.

The Controller undertakes and is obliged to observe and comply with the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility in accordance with the LFPDPPP.

The Controller does not collect or process sensitive personal data.

The Controller does not collect personal information from minors, so by providing your data you acknowledge that you are of legal age and have read the content of this privacy notice.

PURPOSES OF THE PROCESSING OF PERSONAL DATA

The personal data collected will be used to carry out the following purposes:

Primary Purposes. Necessary to provide you with the services that you request from us, which consist of:

a) Verify your identity and information;

b) Creation of your account and/or user on our Website and/or Applications to allow you to request services and/or products;

c) Update our processing systems and database;

d) Process orders, purchases and/or requests for information;

e) Provide services and carry out the purchase and sale of products requested by you remotely;

f) Physical delivery to the store and/or home of your products and/or providing the purchased services;

g) Inform you and/or contact you by any optical, sound, technological or physical means (WhatsApp, SMS, telephone, email, messaging, among others), regarding the status of your purchases and/or delivery of your products or services;

h) Manage and/or process bank payments for the products and/or services requested;

i) Keep a history of your purchases;

j) Manage the return and/or exchange of products;

k) The issuance of invoices;

l) Keep your information for compliance with the applicable legal provisions and requirements of the authorities based on Law for compliance with the legal provisions and requirements of various authorities; and

m) Address your doubts, complaints, suggestions, clarifications and/or follow up on them.

Secondary Purposes. Additionally, we will use your personal information for the following purposes that are not necessary, but that allow and facilitate us to provide you with better attention and service:

a) Send you, through various means, information of an advertising, promotional and/or informative nature;

b) Carry out statistics, surveys or studies on consumer and market habits that aim to evaluate the quality of services, goods, products and/or purchasing experience;

c) Invite you, in accordance with the participation rules, to our events, contests, raffles, promotions and activities and contact you through different physical and/or electronic means of communication; and

d) Offer you any of our services and products;

You, as the owner of the personal data, have the right to object to your personal data being used for the Secondary Purposes indicated above. The above means that you can oppose any of them at any time, or revoke your consent.

If you want the Controller not to process your personal data for Secondary Purposes, you may express your refusal by sending an email to the account privacy@progela.com.mx, so that the Controller does not process your data for said purposes. purposes. Otherwise, it will be understood that the owner consents to the processing of his or her data for all the purposes listed above.

Refusal to use your personal data for Secondary Purposes will not be a reason for us to deny you our services.

Additionally, we inform you that you may request registration in the Public Registry to Avoid Advertising (REPEP), through the Internet page of the Federal Consumer Prosecutor's Office (PROFECO), https://repep.profeco.gob.mx/ with so that your personal data is not used to receive advertising or promotions from companies of goods or services. For more information about this registry, you can consult the PROFECO Internet portal, or contact it directly.

MEANS AND PROCEDURE TO EXERCISE THE RIGHT OF ACCESS, RECTIFICATION, CANCELLATION AND OPPOSITION (“ARCO RIGHTS”) AND REVOCATION OF CONSENT

In accordance with the LFPDPPP, you have the right to know the personal data we have about you, what we use it for and the conditions of use we give it (Access). Likewise, you have the right to request the correction of your personal data if it is outdated, inaccurate or incomplete (Rectification); Likewise, you can request that we delete your data from our records or databases when you consider that it is not being used in accordance with the principles, duties and obligations provided for in the regulations (Cancellation); as well as oppose the use of your personal data for specific purposes (Opposition). These rights are known as ARCO rights.

To exercise your ARCO Rights or your right of revocation, you can do so in writing to privacy@progela.com.mx, where you will be informed of the procedure to follow.

The Controller may deny access to personal data, or to make rectification or cancellation or grant opposition to the processing thereof, in the cases established in article 34 of the Law.

The Controller will not be obliged to cancel the personal data of the owner, under the assumptions established in article 26 of the Law.

TRANSFER OF PERSONAL DATA THAT IS CARRIED OUT

You, as the owner of the personal data, accept and acknowledge that the Controller does not require your consent to carry out national or international transfers of Personal Data, in terms of what is established by article 37 of the LFPDPPP, or in any other case of exception. provided for by applicable legislation, with the understanding that the treatment that these third parties grant to Personal Data must comply with the provisions of the Privacy Notice.

Third Party Service Providers: We hire other companies and individuals to perform certain functions on our behalf. They will have access to the personal information necessary to perform their functions, but will not be able to use it for other purposes. Under no circumstances will we grant rights to use your data to these third party service providers that are broader than those to which you have consented under this Privacy Notice.

PERSONAL DATA SECURITY

The personal data collected and processed by the Controller and/or its managers will be protected by appropriate administrative, technical and physical security measures against damage, loss, alteration, destruction or unauthorized use, access or treatment, in accordance with the provisions in the LFPDPPPP, the administrative regulation derived from it, the banking legislation and secondary regulations issued by the competent authorities.

Henna

In the event that the Owner considers that his right to protection of personal data has been harmed by the improper processing thereof, he may file a corresponding complaint or complaint with the INAI, for which he may consult the website www.inai.org .mx for more information.

MODIFICATIONS TO THE PRIVACY NOTICE

The Controller reserves the right to periodically update or modify the Privacy Notice in accordance with changes in information practices, in response to new legislation, internal policies or new requirements for the provision of services.

CONSENT FOR THE PROCESSING OF PERSONAL DATA

You, as the owner of the personal data, declare that you have read, understood and accepted the terms set forth in the Privacy Notice, which constitutes -free, specific, unequivocal and informed consent-, including with respect to the changes established in the updates. made to it, with respect to the processing of Personal Data in compliance with the provisions of the LFPDPPP and the Guidelines.

Last update date: June 27, 2024