CANNIZZO, ORTÍZ Y ASOCIADOS, S.C. (hereinafter referred to as “CANNIZZO”) with domicile at Moliere No. 39, 11th Floor, Colonia Polanco, Delegación Miguel Hidalgo, C.P. 11560 with telephone number (+52-55) 55-52-79-59-80 is responsible for obtaining, using, disclosing, storing, accessing, handling, exploiting, transferring and disposing of (hereinafter and collectively referred to as the “Processing”) any information that is provided concerning an identified or identifiable individual (hereinafter referred to as the “Personal Data”). In view of the above and in order to guarantee the privacy and the right to informational self-determination of individuals, Cannizzo makes this privacy notice (hereinafter referred to as the “Privacy Notice”) available to you.

In compliance with the provisions of the Federal Law on the Protection of Personal Data in Possession of Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) (hereinafter referred to as the “Law”), the Regulations thereunder (hereinafter referred to as the “Regulations”) and other applicable legal provisions, Cannizzo shall observe, at all times, the principles of legality, purpose, loyalty, consent, quality, proportionality, information and liability.

1. Consent.

This Privacy Notice must be consulted by the owner of Personal Data (hereinafter referred to as the “Owner“) before providing any type of Personal Data to Cannizzo.

The fact that the Owner provides Personal Data to Cannizzo will imply: (i) the granting of his or her consent for its Processing in the terms provided in this Privacy Notice; (ii) that he or she is aware of the purpose of the Processing of his or her Personal Data; and (iii) that he or she is aware of the procedure for exercising his or her ARCO Rights (as such term is defined below), as well as for limiting the use and disclosure of his or her Personal Data.

In order to revoke your consent, the Data Subject must send your request to the email address: [email protected] or by going directly to the Cannizzo offices located at Moliere No. 39, Floor 11, Colonia Polanco, Alcaldía Miguel Hidalgo, CP 11560, Mexico City, Mexico. The same procedure will apply if the Data Subject wishes to express his or her refusal to the Processing of his or her Personal Data for purposes that are not necessary for the legal relationship with Cannizzo.

2. Personal Data.

a) Purpose of the Personal Data Processing.

Personal Data will be used for the following main purposes, necessary to maintain the legal relationship between Cannizzo and the Data Controller:

• Identification and contact;
• Submission of service proposals;
• Celebration and fulfillment of contracts for the provision of professional services;
• Provision of professional services in legal matters;
• Billing for professional services provided;
• Control access and maintain security at the facility; and
• Compliance with legal obligations to authorities of various kinds.

For secondary purposes, Cannizzo uses Personal Data to:

• Promote the various professional services it provides;
• Share publications about new developments and regulatory changes or those specialized publications to which you contribute; and
• Send invitations to events organized by Cannizzo or in which he participates.

Our informational email campaigns contain tracking pixels that allow us to measure campaign effectiveness and provide you with more relevant emails based on your interests. If you do not wish your Personal Data to be processed in informational campaigns, we provide you with the “Unsubscribe” option via the link at the bottom of any informational email you receive.

If you do not wish your Personal Data to be processed for the other secondary purposes mentioned above, you may express your objection by sending an email to [email protected] . Such objection will not affect the legal relationship established between the Data Subject and Cannizzo, and the exercise of your ARCO Rights will remain unaffected in any case.

Cannizzo informs the Data Subjects that, when the Personal Data is no longer necessary for the fulfillment of the aforementioned purposes or for the fulfillment of the legal obligations under its responsibility, Cannizzo will proceed with its cancellation.

Should Cannizzo wish to modify or expand the aforementioned purposes, it is obliged to modify this Privacy Notice and make it available to the Data Subjects through its website.

b) Personal Data that will be processed by Cannizzo.

Cannizzo processes the following Personal Data: (i) Identification data: name, address, nationality, place and date of birth, marital status, RFC, CURP, autograph and/or digital signature, age, gender, image; (ii  Contact information: address, cell phone number, home phone number, email address ; (iii) Employment data: place of work, position or job held, work address, institutional phone number, institutional email address; (iv) Immigration data: immigration status; (v) Asset and/or financial data: tax information, income or debts arising from a certain legal act; (vi) Legal data: those related to the reason for the provision of legal services and (vii) Digital information: that related to the use you make of our website and access to our content or publications.

Whenever Personal Data is provided directly by the Data Subject, it will be presumed to comply with the quality principle until the Data Subject states and proves otherwise, or until Cannizzo has objective evidence to that effect.

We inform you that our website uses our own and third-party cookies, which allow us to improve the performance and reach of our services. To learn more about this, we provide our “Cookie Policy,” which you can access in the corresponding section on our website.

c) Transfer of Personal Data by Cannizzo.

Cannizzo declares that the Personal Data to which it has access may be forwarded to third-party service providers and suppliers with whom it has a legal relationship, in their capacity as data controllers, in order to fulfill the purposes set forth in this Privacy Notice.

Likewise, Personal Data may be transferred without legally requiring your consent to the authorities for the purpose of complying with applicable regulations, to safeguard a public interest or for the administration of justice, or when required for the recognition, exercise or defense of a right in a judicial proceeding or in the event that any situation provided for in Article 36 of the Law is actualized.

3. ARCO rights, use and disclosure.

The Owner shall have the rights indicated below (hereinafter referred to as the “ARCO Rights”):

• access your personal data held by Cannizzo, as well as know the information related to the conditions and generalities of its processing (Access);
• to request the rectification of your Personal Data when it is found to be inaccurate, incomplete or not up to date (Rectification);
• to request the cancellation of your personal data from Cannizzo’s files, records, files and systems (Cancellation).
• to object, for legitimate reasons, to the processing of your Personal Data (Objection). If such objection is successful, Cannizzo will not be able to process Data Subject’s Personal Data. The right to object will not be exercised in cases where processing is necessary for compliance with a legal obligation on the part of Cannizzo.

To exercise any of the ARCO Rights, the Data Subject or their legal representative must submit the respective request to Cannizzo’s Personal Data Department, which will process the requests for the exercise of these rights and address any questions you may have regarding the processing of your Personal Data.

Additionally, the Data Subject has the right to limit the use and disclosure of his or her Personal Data, as well as revoke consent for the processing thereof by means of a request addressed to the Cannizzo Personal Data Department.

The contact information for Cannizzo’s Personal Data Area is as follows: Moliere No. 39, 11th Floor, Colonia Polanco, Alcaldia Miguel Hidalgo, CP 11560, Mexico City, Mexico with telephone number (+52-55) 55-52-79-59-80, email: [email protected] .

The request to exercise ARCO rights must contain and be accompanied by the following:

• The name of the Owner and his/her address or any other means to receive notifications;
• Documents that prove the identity of the Owner or, where applicable, the personality and identity of his representative;
• A clear and precise description of the Personal Data in respect of which you seek to exercise any of the ARCO Rights, except in the case of the right of access and in the case of exercising the right of rectification, the modifications to be made must be indicated and the documentation supporting the request must be provided;
• The description of the ARCO Right that is intended to be exercised, or what the Owner requests, and
• Any other element or document that facilitates the location of Personal Data.

Cannizzo will notify the Owner, within a maximum period of 20 (twenty) days from the date on which the request for the exercise of ARCO Rights was received, of the decision made, so that, if appropriate, it may be implemented within 15 (fifteen) days following the date on which the response is communicated. These deadlines may be extended once for an equal period, provided that the circumstances of the case justify it.

The cases in which the exercise of ARCO Rights will not be admissible and therefore Cannizzo may deny their exercise are:

• When the Owner or the legal representative are not duly accredited to do so;
• When the Personal Data is not in possession of Cannizzo;
• When the rights of a third party are violated;
• When there is a legal impediment, or the resolution of a competent authority, that restricts access to Personal Data, or does not allow the rectification, cancellation or opposition of the same, and
• When the rectification, cancellation or opposition has been previously made.

If the Data Subject considers that his or her right to the protection of his or her Personal Data has been violated by any conduct or omission on the part of Cannizzo, or suspects any violation of the provisions set forth in the Law, the Regulations and other applicable regulations, he or she may present his or her complaint with the Anti-Corruption and Good Governance Secretariat within 15 (fifteen) days following the date on which Cannizzo provides him or her with a response . If he or she does not receive a response from Cannizzo, the data protection request may be submitted after the response period has expired.

4. Modifications to the Privacy Notice.

This Privacy Notice may be modified, changed or updated due to new legal requirements; Cannizzo’s own needs; its privacy practices; changes in its business models or for other reasons.

Any changes to this Privacy Notice will be communicated to the Data Subjects by making the Privacy Notice available at www.cannizzo.com.mx.

Date this Privacy Notice was last updated on: July, 2025.