In accordance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties and its current Regulations, Gravity Systems, Sociedad Anónima de Capital Variable (hereinafter referred to as the “Company”), declares that it is a company legally incorporated under Mexican law, with its registered address at Boulevard Palmas Hill, Lots I and II, Block II, 16th Floor, Colonia Hacienda de las Palmas, ZIP Code 52763, Municipality of Huixquilucan, State of Mexico. As the party responsible for the processing of personal data, the Company hereby informs users that such information may be collected directly at the Company’s premises, through its mobile application, or via email. All information will be handled with strict confidentiality.

By providing personal data such as:

• Full name, address, landline and mobile phone number, and email address.

• Information generated during the recruitment and hiring process.

Such data will be used solely and exclusively for the purpose of managing the employment, professional, and commercial relationship between the parties. The user expressly consents to the use of both the email address and mobile phone number provided as communication channels between the parties for the purposes set forth in this Privacy Notice.

Accordingly, the accuracy and truthfulness of the information provided shall be the sole responsibility of the user. Otherwise, the Company disclaims any liability arising from inaccurate or false information.

The user has the right to know what personal data we hold about them, the purposes for which it is used, and the conditions under which it is processed (Access). Likewise, the user has the right to request the correction of personal data if it is outdated, inaccurate, or incomplete (Rectification); to request the deletion of such data from our records or databases when it is deemed to be improperly used (Cancellation); and to object to the processing of personal data for specific purposes (Objection). These rights are known as ARCO Rights.

To exercise any of the ARCO Rights, the user must submit a request via email to: aviso_dp@gravitynow.net, which must include, by way of example but not limitation, the following requirements¹:

• Name of the data subject and email address. Requests that do not include this information will be deemed not received.

• A document proving the identity of the data subject, such as a valid official identification (voter ID, professional license, or passport). Legal representatives or attorneys-in-fact must submit a simple power of attorney signed before two witnesses, or the corresponding notarized document, along with copies of the official identifications of the signatories.

• A clear and precise description of the personal data for which any ARCO Right is to be exercised, except in the case of the right of Access.

• A clear description of the ARCO Right being exercised.

• Any other element or document that facilitates the location of the personal data.

In the case of an access request, the user must specify the preferred format for the data. For rectification requests, the user must indicate the modifications to be made and provide documentation supporting the request. For cancellation requests, the user must state the reasons for requesting the deletion of personal data. For opposition requests, the user must indicate the legitimate grounds or specific circumstances justifying the objection, as well as the harm or prejudice that continued processing would cause, or the specific purposes for which the right of opposition is exercised.

If the request does not meet any of the aforementioned requirements, the Company will request additional information within five (5) business days following receipt of the request. The user will have five (5) business days from the day following notification to remedy the omissions. If the user fails to respond within this period, the request shall be deemed not submitted.

Once a duly completed ARCO Rights request is received, the Company will respond within a period not exceeding twenty (20) business days. The response will be sent via the same email address from which the request was submitted. If applicable, the requested action will be carried out within fifteen (15) business days following notification of the response. If the user disagrees with the response, they will have ten (10) business days to contact the Company via the aforementioned email address to express their concern or objection. Failure to respond within this timeframe will be understood, in good faith, as acceptance of the Company’s response.

The Company may deny access to personal data, or the rectification, cancellation, or objection to its processing, in the following cases:

• When the requester is not the data subject or the legal representative is not duly authorized.

• When the personal data is not found in the Company’s databases.

• When the rights of a third party are affected.

• When there is a legal impediment or an order from a competent authority restricting access, rectification, cancellation, or objection.

• When the requested rectification, cancellation, or objection has already been carried out.

The user should also consider that, for certain purposes, revoking consent may not always be possible or immediately effective, as legal obligations may require the continued processing of personal data. In other cases, revocation may result in the inability to continue providing the requested service or the termination of the relationship with the Company.

The Company has adopted the legally required security measures for the protection of personal data in accordance with the aforementioned Law and its Regulations, under the principles of lawfulness, quality, consent, information, purpose limitation, loyalty, proportionality, and accountability. All data is safeguarded under strict administrative, technical, and physical security measures designed to protect personal data against damage, loss, alteration, destruction, or unauthorized processing.

This Privacy Notice may be amended by the Company at any time. Any changes will be communicated in a timely manner via email, telephone, or any other communication method deemed appropriate by the Company.

Last updated: March 22, 2024.