To the Users (as defined later), we inform you that the following Privacy Notice applies simply by using or accessing any of the pages, web and mobile applications, software, and applications in general that make up the endemica.social Portal (hereinafter collectively referred to as the "Portal"). By using the Portal, you are understood to accept this notice and agree to comply with its terms. If you do not agree with the Privacy Notice and/or the Terms and Conditions available, you should refrain from accessing or using the Portal. The User, defined as any person who accesses or uses the Portal via computing equipment and/or any communication device, fully and unreservedly accepts all the provisions included in this Privacy Notice.

RESPONSIBLE FOR THE PROCESSING OF YOUR PERSONAL DATA. For ENDÉMICA CENTER FOR SOCIAL IMPACT (hereinafter referred to as the “Company”), the security of our Users is a priority. Therefore, we protect your personal data through the use, application, and maintenance of high technical, physical, and administrative security measures. As a User, you have the opportunity to choose from a wide range of products and services through our Portal, knowing that your personal data will be protected and treated confidentially. We inform you that the RESPONSIBLE party for collecting, processing, and/or using the personal data that you provide through the Portal is the Company, as well as its subsidiaries, associated companies, controlling entities, and affiliates.

ADDRESS OF THE RESPONSIBLE PARTY. For the purposes of this privacy notice, the Company designates its address individually as located at PRIMERA CERRADA DE CEDROS #441 JURICA CP 76100 QUERÉ

TARO, QRO.

PERSONAL DATA THAT MAY BE COLLECTED. The personal data that the Company may collect from the User when using the Portal and/or contracting our services and products are as follows: I. Name II. Email address III. Name of your company, organization, or project IV. Other sensitive data such as billing level, beneficiary population, current impact metrics V. Name of the person recommending our work

PURPOSES OF PROCESSING YOUR PERSONAL DATA. The personal data collected by the Company will be used for the following purposes: I. To ensure better service to our customers and to follow up on their purchases. II. To integrate files, databases, and systems necessary to carry out the corresponding operations and services; (ii) To claim delivery of prizes and/or promotions; (iii) To conduct internal analyses. III. Additionally, your personal data may be used for the following secondary purposes: (i) Marketing, advertising, and commercial prospecting; (ii) To offer you, where applicable, other products and services from the Company or any of its affiliates, subsidiaries, controlling entities, associates, commissioners, or companies; (iii) To send you promotions of other goods, services, and/or products; (iv) To perform statistical analyses, generate information models and/or current and predictive behavior profiles; (v) To participate in surveys, raffles, and promotions.

OPTIONS AND MEANS TO LIMIT THE USE OR DISCLOSURE OF DATA. The Company has implemented administrative, technical, and physical security measures to protect your personal data, which we also require to be complied with by the service providers we hire. You can limit the use or disclosure of your personal data by sending an email to datos@endemica.social indicating in the email body your full name and which data you do not wish to be disclosed. If your request proceeds, you will be registered on the exclusion list. MEANS TO EXERCISE THE RIGHTS OF ACCESS, RECTIFICATION, CANCELLATION, OR OPPOSITION (ARCO RIGHTS). You can send an email to datos@endemica.social at any time to exercise your Rights of Access, Rectification, Cancellation, or Opposition ("ARCO Rights"). To exercise the ARCO Rights, you (or your legal representative) must submit the request with the following documentation: I. User's or holder's name. II. User's or holder's address or another means to communicate the response to your request. III. Documents proving your identity (IFE/INE or passport) and, if applicable, documents proving the legal representation of the applicant. IV. A description of the information/data you are trying to access, rectify, cancel, or oppose, and the rights you would like to exercise. If one or more of the documents mentioned above are missing, and/or the documents have errors or omissions, the Company will notify you within 3 business days following the receipt of the request and will request the missing documents and/or necessary corrections. You will have 5 business days from that notification to provide the updated information; otherwise, the request will be considered as not submitted.

TRANSFER OF PERSONAL DATA. The Company may disclose your personal data to those third parties who, by virtue of the services and products offered, need to know them to fully comply with them. Furthermore, the Company may disclose your information to competent authorities in terms of applicable legislation; any transfer of your personal data without consent will be carried out in accordance with Article 37 of the ”LEY FEDERAL DE PROTECCIÓN DE DATOS PERSONALES EN POSESIÓN DE LOS PARTICULARES”.

WEB BEACONS. The Company may use tracking technologies such as web beacons, similar to cookies, to collect data about your visits to the Portal. These are small electronic images embedded in web content or email messages, which are normally not visible to Users and allow us to generate nearly personalized content to offer you a better experience when using our Portal. If you do not agree with any of the conditions set forth herein, you may always change your browser settings.

MODIFICATIONS TO THE PRIVACY NOTICE. This privacy notice may undergo modifications, changes, or updates resulting from, among other things, new legal requirements; the Company's own needs regarding the products or services we offer; our privacy practices; changes in our business model, or other causes. Any modification to this privacy notice will be notified through any of the following means: a written communication sent to your address; by the email you provide; a message to your mobile phone; a message made known through the Portal or any electronic means you use to carry out transactions; or in widely circulated newspapers at the corporate domicile of the Company.