Comprehensive Privacy Notice

This document constitutes the “Privacy Notice” of Cesar Guadarrama Cantu, and of his affiliates and subsidiaries (hereinafter “CRETIA”), which sets forth the manner in which your information will be processed by CRETIA, as well as the purpose for which it was collected, all in accordance with articles 15 and 16 of the Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”).

It also describes what type of data this is and what options you have to limit the use of said data, as well as the procedure for exercising your ARCO rights, in compliance with the principles of Lawfulness, Consent, Quality, Information, Purpose, Loyalty, Proportionality and Accountability that the law establishes.

CRETIA respects your right to privacy and to the protection of personal data and sensitive personal data, including your financial or asset data, which are protected under the Law. The database in which your information is stored is the responsibility of CRETIA, which is located in Mexico City; likewise, your information is duly safeguarded in accordance with the administrative, technical and physical security provisions established in the applicable Law, in order to protect it from possible damage, loss, alteration or unauthorized access.

The Data Owner acknowledges and accepts that, in the event that this “Privacy Notice” is made available through an electronic page (website, Internet page or similar) or any other electronic device, by continuing to browse the site, or by providing their Data through it or through any electronic means (email, etc.), this constitutes an expression of their consent for CRETIA to process their Data, in accordance with this Privacy Notice.

Personal Data

The personal data we will collect will be that which you have included in your profile for each social network with which you sign in and that is enabled in the application, and it will be processed and safeguarded based on the principles established in the Law and its Regulations. In order to fulfill the purposes mentioned in this Notice, we require that you provide us with the following Personal Data:

Organization Employees
Real-time location, photograph, handwritten signature, First Name(s), Maternal Surname, Paternal Surname, CURP, Position in the organization, Phone Number, Email, Social Security Number, last sign-in, username and password.

Organization
Time zone, Name, Legal Name, RFC (tax ID), Health License, Billing Email, Logo, Address (Street, Number, ZIP, Neighborhood, Municipality, City, State, Country), Digital Seal Certificate, documents in any format (pdf, excel, photographs, among others).

Clients
Organization name, Legal Name, RFC (tax ID), Phone, Address (Street, Number, ZIP, Neighborhood, Municipality, City, State), documents in any format (pdf, excel, photographs, among others).

Client Facilities
Organization name, Facility name, Legal Name, RFC (tax ID), Phone, Address (Street, Number, ZIP, Neighborhood, Municipality, City, State), documents in any format (pdf, excel, photographs, among others), facility areas, email and basic contact details of the person in charge.

Suppliers
Organization name, Legal Name, RFC (tax ID), Phone, Address (Street, Number, ZIP, Neighborhood, Municipality, City, State), documents in any format (pdf, excel, photographs, among others).

Employees of Clients and Suppliers
First Name(s), Maternal Surname, Paternal Surname, handwritten signature, department, position, photograph, phone number, email of the person in charge of the organization/facility, username and password.

Sensitive Data

The Data Owner acknowledges and accepts that, due to their relationship with CRETIA, they have not provided, nor will they have to provide, “sensitive personal data”, that is, personal data that is intimate or whose proper or improper use may give rise to discrimination or entail a serious risk for them. In the event that the Data Owner provides data of the so-called sensitive type, they must agree to provide it beforehand and shall release CRETIA from any related complaint or claim.

Requests

The owner may exercise the rights of access, rectification, cancellation or objection with respect to the personal data concerning them, as well as request the revocation of their consent, by sending a request to CRETIA through the website www.cretia.app to the email hello@cretia.app, indicating at least their full name and address or any other data or document that allows their identification, as well as the object of their request and/or the procedure to be carried out. The foregoing must be done based on the Law and its Regulations.

Purpose

Your personal data and history as a client will be used by CRETIA or by any of its subsidiaries and/or affiliates, and will be recorded in our database, as well as any other personal, sensitive or otherwise data, provided that the provisions of the Law and its Regulations are complied with regarding each type of information. This information may be used by CRETIA for any of the following purposes:

a. Commercial purpose
(i) Name of the Data Owner, address, RFC (tax ID), phone, billing account number, date of birth, banking details.

This information may be used, by way of example but not limitation, to: (1) offer you products and services, whether in person, by telephone, electronically or by any other technology or means available to CRETIA; (2) make you aware of new products or services that may be of interest in relation to the contracted service; (3) for your convenience, make billed charges automatically; (4) issue purchase orders or work requests, as applicable; and/or (5) any other action necessary to fulfill CRETIA’s interests regarding the agreement reached with the Data Owner.

b. Employment purpose
(i) In relation to job offers or applications through the submission of a résumé, information may be requested such as name, address, contact phone, email, level of education, personal references, professional experience, RFC (tax ID), social security number, CURP, official identification.

This information may be used, by way of example but not limitation, to: (1) evaluate you as a possible candidate to fill a vacant position; (2) where applicable, prepare the corresponding Service Agreement and/or Individual Employment Contract; (3) provide references in the event that another person or company requests them regarding candidates.

c. Facility Access Security purpose
This information may be used, by way of example but not limitation, to: (1) back up, record and/or control the registry of persons who access or visit CRETIA’s facilities; (2) comply with the security guidelines established in CRETIA’s internal policies. In relation to the information requested for entry into CRETIA’s facilities, information may be requested such as full name, signature, official identification, as well as information about electronic equipment that is to be brought into CRETIA’s facilities.

Transfer

The Data Owner understands and accepts that CRETIA and/or any of its subsidiaries and/or affiliates may transfer their personal data to third parties that have been contracted by CRETIA to carry out, in its name and on its behalf, certain tasks related to the commercial and promotional activities of its products and/or services. These third parties may process the data in compliance with CRETIA’s instructions, or make decisions about it as part of providing their services. In either case, CRETIA will select suppliers that it considers trustworthy and that commit, through a contract or other applicable legal means, to implement the security measures necessary to guarantee an adequate level of protection for your personal data. As a result of the foregoing, CRETIA will require its suppliers to comply with security measures that guarantee the same levels of protection that CRETIA implements during the processing of your data as a client of CRETIA. These selected third parties will have access to your information for the purpose of carrying out the tasks specified in the applicable services contract signed with CRETIA. If CRETIA determines that a supplier is not complying with the agreed obligations, it will immediately take the pertinent actions.

If the owner does not accept the transfer of their personal data in accordance with the provisions of the preceding paragraph, they may contact CRETIA by any of the means established in this Privacy Notice.

Exceptions

Additionally, and in accordance with the provisions of Articles 10, 37 and other related articles of the Law and its Regulations, CRETIA shall be exempt from the obligations regarding consent for the Processing and Transfer of your Data, when:

• It is provided for in a Law;
• The data appears in publicly accessible sources;
• The personal data is subject to a prior dissociation procedure;
• The purpose is to fulfill obligations arising from a legal relationship between the owner and the controller;
• There is an emergency situation that could potentially harm an individual in their person or property;
• It is indispensable for medical care, prevention, diagnosis, the provision of health care, medical treatments or the management of health services;
• A ruling by a competent authority is issued;
• When the transfer is necessary for the recognition, exercise or defense of a right in a judicial proceeding; and
• When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the controller and the owner.

Modifications

In the event that any modification is required to the provisions of this Privacy Notice, CRETIA undertakes to make known the changes that may be required, by any means, including electronic means, upon prior notice given to you so that you may express, for your part, whatever is in your interest, since if no express written refusal is received from you, or no response at all, it will be understood that you accept the changes made.

Owner’s Consent

The Data Owner acknowledges and accepts that, in the event that this “Privacy Notice” is made available through an electronic page (website, Internet page or similar) or any other electronic device, by clicking “accept” or otherwise continuing to browse the site, or by providing their Data through it or through any electronic means (email, etc.), this constitutes an expression of their consent for CRETIA to process their Data, in accordance with this Privacy Notice.

Likewise, they also state that, in the event that this “Privacy Notice” is made available in writing, their signature, initials, name or fingerprint, or the provision of their Data, constitutes an expression of their consent for CRETIA to process their data, in accordance with this “Privacy Notice”.

Data Retention

CRETIA will retain your Personal Data for as long as necessary to fulfill the purposes described in this Privacy Notice and for as long as the legal or service relationship with CRETIA subsists.

When the Data Owner exercises their right of cancellation in accordance with the ARCO Rights procedure described below, CRETIA will block your Personal Data, preventing its processing except for retention purposes as indicated in the following paragraph, and will proceed to its definitive deletion once the applicable legal or regulatory periods have elapsed, or once CRETIA determines that there is no longer a legitimate purpose justifying its retention.

The foregoing does not apply to that information which, by legal provision, CRETIA is obligated to retain for a specified period, as is the case with fiscal and accounting documentation (for example, Digital Tax Receipts via the Internet), which will be retained for the period established by the applicable tax legislation, regardless of whether the right of cancellation has been exercised with respect to other Personal Data.

ARCO Rights

You have the constitutional right to Access and know the personal data we hold and the details of its processing and use, as well as to Rectify and correct it in the event it is inaccurate or incomplete; to Cancel and delete it when you consider that it is not required for any of the purposes indicated in this privacy notice, or that it is being used for purposes not authorized by you, or the legal or service relationship has ended; or to Object to its processing for specific purposes.

The mechanisms implemented for the exercise of your ARCO Rights, as well as the deadlines, information and documentation that your request must contain, will be handled at the email hello@cretia.app.

Notice of change of notice

If CRETIA changes this privacy notice, said changes will appear on the website www.cretia.app

If you have any questions or wish to exercise any right related to this privacy statement, please contact CRETIA and/or its affiliated companies at the following address: hello@cretia.app

This privacy notice has been created based on the rules issued by the Federal Law on the Protection of Personal Data Held by Private Parties, pursuant to articles 16, 17 and 36 of the Law and the corresponding articles of its Regulations.