Privacy Notice and IMS Policy

Comprehensive Privacy Notice

This privacy notice is issued in compliance with Articles 15 and 16 of the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and Article 26 of the Regulations of the LFPDPPP.

Soluciones Integrales Saynet S.A. de C.V. (hereinafter “Saynet”), with address at Fuente Pirámides No. 1, Interior 201 to 206, Colonia Lomas de Tecamachalco, Municipality of Naucalpan de Juárez, State of Mexico, C.P. 53950, Mexico, and website www.saynet.com.mx, informs all Data Subjects, including employees, suppliers, shareholders, clients and others that form part of the company’s databases, of this notice, making it known that it is mandatory for all persons, whether individuals or legal entities, who directly or indirectly participate in the processing of personal data managed by the organization in the course of its activities. Its purpose is to ensure compliance with applicable Mexican and organizational legislation and to provide you with a clear and sufficient explanation regarding the purposes for which your personal data are used.

The information we collect consists of the following personal identification data:

• Identification data

• Contact data

• Data related to physical characteristics

• Employment data

• Academic data

• Migration data

• Asset and/or financial data

• Images recorded by surveillance cameras owned by SayNet are kept for a period of up to 30 days.

• Personal data is considered sensitive, which requires special protection:

  • Data relating to ideology; religious, philosophical or moral beliefs, political opinions and/or trade union membership

  • Health data

  • Biometric data (The request is managed according to the following: All personnel who provide a service within Saynet’s facilities must access via the Biometric Access Control System.

  • Likewise, the retention period of the data will remain in force until the end of the service between Saynet and the registered personnel.)

In relation to the processing of the data referred to in the last point, the undersigned grants express written consent in accordance with Article 9 of the LFPDPPP and Articles 15 and 19 of its Regulations.

The organization’s collaborators and users of our services, including cloud services, voluntarily provide us with their data through official means, such as email, and authorize their use in accordance with this Privacy Notice, accepting and acknowledging that their Personal Data may be used, individually or together with other data, to identify, contact or locate a person, or to recognize an individual within a specific context of the organization’s operations, or transferred from their current location to Saynet’s offices and servers, as well as to third parties that may be located in other countries.

For what purposes will we use your personal data?

The processing of your personal data will be carried out and used by Saynet for the following:

• Create supplier files and keep their documentation up to date

• Create employee files, keep their documentation up to date and process it for personnel administration purposes, fulfillment of employer and social security obligations in accordance with the LFT, IMSS, INFONAVIT and SAT

• Draft contractual agreements arising from the provision of a service or the acquisition of a good

• Manage and operate the services contracted by us

• Deliver services according to Saynet’s service portfolio, in current or future projects

Additionally, we will use your personal information for the following secondary purposes, which are not necessary for the requested service but allow us to provide better service and attention:

• Establish contact when necessary or when you request it

• Request quality assessments regarding the services provided

• Respond to requests for information related to the provision of our services

• Carry out billing activities, clarifications and collection follow-up

• Send you notifications about changes to this privacy notice

• Marketing or advertising

• Commercial prospecting

If you do not want your personal data to be processed for these secondary purposes, you may inform us of this from this moment in the following paragraph at the signature of this notice:

I do not authorize the use of my following personal data: _____________________.

Or by sending an email to privacidad@saynet.com.mx, addressed to the Controllership Department (“Dirección de Contraloría”), indicating your full name, a clear description of the data you do not want to be processed and, where applicable, documents proving your identity or legal representation.

Additionally, we may use your personal information for commercial prospecting and/or advertising campaigns. If you do not wish to receive such information, you may notify your refusal by sending an email indicating your full name, a description of the data you do not want to be used and, where applicable, documents proving your identity or legal representation to: privacidad@saynet.com.mx

Please note that your refusal to allow the use of your personal data for these purposes cannot be a reason for us to deny you the services and products you request or contract with us.

With whom do we share your personal information and for what purposes?

Your personal data are transferred within and outside the following countries in which we operate: Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, the United States, Singapore and Mexico, for the provision and management of services (including those hosted in the cloud) and/or products related to the solutions contracted or offered by Saynet for our employees, suppliers, shareholders and clients, among others that form part of the company’s databases, for the following purposes.

These transfers are formalized through contractual clauses or other legal instruments that ensure that the recipients assume the same obligations as the data controller, in accordance with Articles 74 and 75 of the Regulations of the LFPDPPP.

Likewise, please be informed that Saynet does not trade, sell or rent the personal information it collects. It may only be shared with other entities that form part of Saynet or with third parties that collaborate in the provision of our services, for the purposes mentioned above. In certain cases, this information may be transferred internationally, which implies that it may be moved to one of the aforementioned countries or from the jurisdiction of origin to other territories where Saynet has operations or providers.

Saynet will only collect those personal data that are strictly necessary, relevant and provided by suppliers, employees and candidates, in order to carry out selection, evaluation and execution processes of the corresponding contracts. If data from supplier employees are collected, they will only be used to verify their identity or job competencies. Once this purpose has been fulfilled, Saynet will return such information to the supplier, unless there is express authorization to retain it.

You are also informed that, regarding any legal request for the disclosure of personal data, Saynet will only consider those requests that are correctly and fully documented, that indicate the sources of disclosure, the authority’s legal basis to request the disclosure, and that will proceed with the disclosure of such data only once approved by the data owner.

In any case, personal information will not be processed for a period longer than the duration of the contractual relationship with the supplier, contractor and/or collaborator, except when it must be retained for legal or contractual reasons that justify it. In all cases, retention periods must not exceed what is strictly necessary to fulfill the stated purposes, in accordance with Article 37 of the Regulations of the LFPDPPP, applying procedures for blocking and deletion of personal data.

If you wish to express your refusal to the processing or transfer of your data, you may do so at the time of signing this notice, in the paragraphs above, or by sending an email to privacidad@saynet.com.mx, addressed to the Controllership Department, indicating your full name, a description of the data you do not wish to be processed or transferred and, where applicable, information or documents proving your identity or legal representation.

In the event of a security breach that significantly affects the patrimonial or moral rights of data subjects, Saynet will promptly inform those affected about the nature of the incident, the data compromised, the corrective measures taken and the means available to obtain further information, in accordance with Articles 63 to 65 of the Regulations.

How do we protect your personal information?

Saynet undertakes to implement reasonable and appropriate measures to ensure the secure exchange, use, storage, replication, backup and destruction of personal data and information, including the transfer of information on physical media. Saynet or its authorized third parties may perform security inspections to protect the personal information of employees, suppliers, shareholders, clients and others that form part of the company’s databases, using firewalls and other security measures aligned with industry standards.

In addition, where appropriate, the organization uses encrypted means of communication by setting passwords on compressed files or any other format with an encryption algorithm equal to or greater than 256 bits. The tool used to encrypt information is 7-ZIP.

Likewise, the company is able to establish secure tunnels for the exchange of information, such as IPSEC-based VPNs, SSH tunnels, and access through HTTPS sites.

The information you share with Saynet will be classified as confidential or restricted, as applicable, and access will be limited to authorized and trained personnel who will handle it with strict confidentiality.

Training and awareness on personal data protection at Saynet

In compliance with the principle of accountability in the processing of personal data, and to ensure that both internal staff and contractors respect the established policies, Saynet periodically conducts training and awareness activities related to personal data protection and information security.

These training sessions are regularly updated to maintain their validity and alignment with applicable regulations, and may be delivered by external consultants specialized in the field.

Who can you contact to exercise your rights or make inquiries?

The contact details of those responsible for handling requests related to ARCO rights, and for information regarding which providers or Saynet itself transfer, use or collect your data, are as follows:

• Recipient: To whom it may concern(Thus, we inform you that, by contacting us through any of the means mentioned, your request will be handled by a director or responsible party, depending on the nature of the information requested.)

• The request must include your full name, a clear description of the rights or requests you wish to exercise and, where applicable, documents proving your identity or legal representation.

• Address: Calle Fuente Pirámides No. 1, Interior 201 to 206, Colonia Tecamachalco, Municipality of Naucalpan de Juárez, C.P. 53950, State of Mexico, Mexico

• Email: privacidad@saynet.com.mx

• Telephone number: 5558716090

In accordance with Article 32 of the LFPDPPP and Articles 95 to 97 of its Regulations, the data controller will respond to your request within a maximum period of 20 business days from its receipt and, if it is deemed valid, will enforce it within an additional 15 business days.

How can you access, rectify or cancel your personal data, or object to its use?

You have the right to know what personal data we have about you, what we use them for and the conditions of use (Access). Likewise, it is your right to request the correction of your personal information if it is outdated, inaccurate or incomplete (Rectification); to have it deleted from our records or databases when you consider that it is not being used properly (Cancellation); as well as to object to the use of your personal data for specific purposes (Opposition). These rights are known as ARCO rights.

If you need to exercise any of your ARCO rights, you must submit a request that includes your full name, a clear description of the ARCO rights you wish to exercise and, where applicable, documents proving your identity or legal representation by sending an email to privacidad@saynet.com.mx.

In accordance with Article 32 of the LFPDPPP and Articles 95 to 97 of the Regulations, the data controller will respond to your request within a maximum of 20 business days from its receipt and, if it is deemed valid, it will be enforced within an additional 15 business days.

You may revoke the consent you have granted us for the processing of your personal data. However, it is important that you understand that we may not always be able to comply with your request or immediately stop using your data, as it is possible that we may need to continue processing them due to a legal obligation. Likewise, you should consider that, for certain purposes, revoking your consent may mean that we will no longer be able to provide the service you requested or that your relationship with us must come to an end.

To revoke your consent, you must submit your request through the following means:

Email: privacidad@saynet.com.mx or Telephone: 5558716090, addressed to the Controllership Department, indicating your full name, a clear description of the revocation of consent you wish to exercise regarding the use of your personal data and, where applicable, documents proving your identity or legal representation.

To learn about the process and requirements for consent revocation, we provide the following contact channels:

Email: privacidad@saynet.com.mx

Telephone: 5558716090, addressed to the Controllership Department.

How can you limit the use or disclosure of your personal information?

You have the right to limit the use or disclosure of your personal information for purposes other than those necessary for the legal or contractual relationship with our company.

At Saynet, we are committed to protecting your privacy and ensuring that your data are processed in accordance with the principles of confidentiality, legality and accountability.

If you wish to limit the use or disclosure of your information, you may send an express request through any of the following means, including your full name, a clear description of the limitation you wish to establish and, where applicable, documents proving your identity or legal representation:

• Email: privacidad@saynet.com.mx

• Telephone: 5558716090

Once your request has been received, we will respond within the timeframe established by applicable regulations and inform you whether your request is accepted or rejected through the contact method you have provided.

Simplified notice: In addition to this comprehensive notice, Saynet will make simplified or short privacy notices available to data subjects, as required by the data collection method (physical forms with limited space, electronic platforms or quick access points), in compliance with Articles 27 to 29 of the Regulations.

How can you learn about changes to this privacy notice?

This Privacy Notice may be modified, updated or adjusted in response to new legal requirements, changes related to the products or services we offer, adjustments to our internal privacy practices, changes in our business model or any other reason that may justify it.

Saynet undertakes to keep data subjects informed about any changes to the content of this notice. Modifications will be communicated through our official website https://saynet.com.mx and by emails sent directly to data subjects.

☐ I voluntarily give my consent for Saynet to collect, use and transfer my personal data in accordance with this Privacy Notice.

Full name:

Date:

Signature:

Last update of this notice: October 20, 2025