CP&A PRIVACY NOTICE

In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, the “LFPDPPP”) and its Regulations, STUDIO QUATTORDICI, S.C. (hereinafter, “CP&A” or the “Data Controller”), with its address at Prol. Paseo de la Reforma 627, Santa Fe, Paseo de las Lomas, Cuajimalpa de Morelos, 01330 Mexico City, Mexico, makes this privacy notice (the “Privacy Notice”) available to you in order to safeguard your personal data and to inform you of how they are collected, used, stored, and processed.

As a firm that provides legal services in administrative and corporate law, we are committed to ensuring the protection and proper use of your personal data in accordance with applicable law. We make sure that your data are processed lawfully, in a controlled and informed manner, and with administrative, technical, and physical security measures that protect them against damage, loss, alteration, destruction, and unauthorized use, access, or disclosure.

1. Personal Data We Collect

The Data Controller may collect and process the following personal data from data subjects, directly or indirectly, through electronic, physical, or any other means:

Identification data: Full name, date of birth, nationality, marital status, signature, and official identification (voter ID card (INE), passport, or professional license).

Contact data: Home address, landline and/or mobile phone number, email address, and image.
Employment data: Occupation, profession, position or title, name of employer or institution, professional degree, professional license, work address, and employment references.

Billing data: Identity of the person to whom invoices will be issued, including their tax status certificate.
Basic financial information: Bank account information, including account holder, account number, CLABE interbank code, SPEI, and SWIFT details.
Immigration data: Legal residency status in Mexico, visa, passport, immigration documents, and work or study permits.
Legal data: Information relating to lawsuits, claims, judgments, contracts, powers of attorney, notarial deeds, wills, civil registry certificates (birth, marriage, death, divorce), and criminal records (where strictly necessary and in accordance with the law).
Personal data of minors and/or legally incapacitated persons: We do not knowingly collect or process the personal data of minors or legally incapacitated persons without the express consent of (i) the persons who exercise parental authority over them, (ii) their guardians, or (iii) their legal representatives. If you exercise parental authority over, or are the guardian or legal representative of, a minor or legally incapacitated person and become aware that their personal data have been provided to us without your consent, you may request that such data be deleted by writing to info@cpya.mx.

Some of the data listed above, such as criminal records and immigration status, may be considered sensitive personal data. The Data Controller will obtain the data subject’s express written consent before processing such data and will collect them only when strictly necessary to provide the legal services engaged.

2. Purposes of Processing

Your personal data will be processed for the following purposes:

If you visit our offices, to control access to and maintain the security of our premises.
If you send us your résumé, to evaluate and consider your profile as part of a recruitment and selection process.
If you contact us with questions or comments, to request legal advice on a particular matter, or to stay in touch with CP&A, to establish a legal relationship with you.
If you engage our legal services, to issue invoices, process payments, and resolve any billing questions related to the legal services engaged.

3. Transfers of Personal Data

The Data Controller may transfer your personal data to the following parties, in the cases permitted by the LFPDPPP:

Administrative and regulatory authorities at the local, state, or federal level, where necessary to comply with legal obligations, file applications, or respond to official requests.
Notaries public, to formalize legal documents such as minutes, powers of attorney, deeds, or contracts relating to corporate or administrative acts.
Professional service providers, such as accountants, auditors, tax advisors, or specialized consultants, where their involvement is necessary for the proper provision of legal services.
Banking and financial institutions, solely for purposes related to payments, collections, and billing for the services engaged.
Third-party technology or administrative service providers that support the firm’s operations, subject to confidentiality and personal data protection agreements.

In all cases, the Data Controller will ensure that transfers are carried out under strict security and confidentiality standards.

The data subject expressly authorizes the transfer of their personal data to third parties on the terms described in this Privacy Notice. If you do not consent to such transfer, you may object by sending an email to info@cpya.mx stating your decision.

4. ARCO Rights

How to exercise your rights of Access, Rectification, Cancellation, or Opposition (“ARCO”):

Under the LFPDPPP and its Regulations, you or your duly authorized legal representative may exercise your ARCO rights with respect to your personal data by submitting a written request to the Data Controller, either by email to info@cpya.mx or in person at the Data Controller’s address. The request must:

a. State the data subject’s name and the ARCO right being exercised, and clearly and precisely describe the personal data to which the request relates.

b. Provide an email address or physical address for notices.

c. Include documents evidencing the data subject’s identity, such as an official photo ID, and, where applicable, documents evidencing the authority of the data subject’s legal representative under applicable law.

d. Include any other information that may help locate the personal data.

For rectification requests, you must specify the changes to be made and attach supporting documentation.

The Data Controller will respond to your request within a maximum of 20 (twenty) business days from the date of receipt. The response will be sent to the email address provided by the data subject. If the request is granted, it will be carried out within 15 (fifteen) business days after notice of that decision is given.

You also have the right to file a request for the protection of your rights (Procedimiento de Protección de Derechos) with the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) (https://www.plataformadetransparencia.org.mx/Inicio) within 15 (fifteen) business days after you receive the Data Controller’s response or, if no response is given, once the 20 (twenty) business-day period from the acknowledgment of receipt of your request has elapsed.

5. Security Measures

The Data Controller implements administrative, technical, and physical security measures to protect your personal data against loss, alteration, unauthorized access, or theft. These measures are reviewed and updated periodically to ensure an adequate level of protection.

If you do not want your data to be processed for the purposes described above, you may revoke your consent or limit the use or disclosure of your data by sending an email to info@cpya.mx.

6. Changes to this Privacy Notice

This Privacy Notice may be amended or updated at any time to reflect changes in applicable law or in the Data Controller’s operations or business.

Any changes to this Privacy Notice will be made available to data subjects at the Data Controller’s offices, through direct notice, or through physical, electronic, or other formats that allow data subjects to learn of such changes in a timely manner.

7. Consent

By providing your personal data, you consent to their processing on the terms set out in this Privacy Notice. For financial or asset-related data and sensitive personal data, the Data Controller will obtain the data subject’s express written consent by handwritten signature, electronic signature, or any other authentication mechanism.

Last updated: 11 de november 2026.