PRIVACY NOTICE FOR THIRD PARTIES AND COMMERCIAL ALLIES OF KUESKI, S.A.P.I. DE C.V. SOFOM ENR.

Pursuant to the provisions of the Federal Law on the Protection of Personal Data Held by Private Individuals (Ley Federal de Protección de Datos Personales en Posesión de Particulares) (“LFPDPPP” by its Spanish acronym), its Regulation, the Privacy Notice Guidelines, and any other applicable legal dispositions (hereinafter jointly referred to as the “Law”), this Privacy Notice is issued in the following terms:

A. PERSONAL DATA CONTROLLER

For the purposes of this Privacy Notice, Kueski, S.A.P.I. de C.V., SOFOM, E.N.R. (hereinafter the “Controller” or “Kueski”), with registered address at Av. Américas 1297, Floor 03-15, Col. Circunvalación Américas, Guadalajara, Jalisco, Mexico, C.P. 44630, is the legal entity responsible, in accordance with the Law, for the processing of your personal data, which includes the collection, use, registration, organization, preservation, preparation, utilization, communication, dissemination, storage, possession, access, handling, exploitation, disclosure, transfer, or disposal of such data.

Kueski will be responsible for the personal data it collects from individuals as well as from third parties who are neither clients nor employees, including but not limited to affiliated merchants, suppliers, and interested third parties such as shareholders or officers of Kueski, as well as their related, affiliated, subsidiary, or parent companies (hereinafter, the “Data Subjects”).

B. PERSONAL DATA COLLECTED AND SUBJECT TO PROCESSING

We inform you that Kueski will obtain your personal data in the following manner:

• In person: When you provide your data physically and personally to initiate or manage a contractual relationship with Kueski.
   
• Directly: When you provide your personal data for purposes of the contractual relationship with the Controller, whether by email and/or by telephone.

The categories of personal data to be collected and subject to processing are:

a) Identification data;

b) Academic data;

c) Employment and/or commercial data and references;

d) Financial data;

e) General information about the Data Subject as required by applicable laws;

g) Corporate business identification data;

Kueski does not collect sensitive personal data for processing.

C. PURPOSES FOR WHICH PERSONAL DATA WILL BE PROCESSED

The processing of the Data Subject’s personal data is intended to be used for:

• Hiring.
• Risk identification in hiring and/or appointment to any role.
• Market research.
• Analysis of the feasibility of any collaboration that may exist between Kueski and the Data Subject.
• Criminal background information.
• Notifications about changes in conditions.
• Compliance with legal requirements from competent authorities and/or as provided by applicable laws.
• Requesting employment and/or commercial references from third parties.

The purposes described above gave rise to and are necessary for the legal relationship with Kueski.

Additionally, Kueski may use your personal data for the following secondary purposes:

• Providing any type of reference to third parties.
• Marketing and/or commercial prospecting purposes.

If you do not wish for your data to be used for these additional purposes and/or you want to update your previous consent, please follow the instructions in Section H.

Your personal data will never be used for marketing, advertising, or commercial purposes.

D. OPTIONS AND MEANS THAT KUESKI OFFERS TO DATA SUBJECTS TO LIMIT THE USE OR DISCLOSURE OF THEIR PERSONAL DATA

You may limit the use of your personal data by sending your ARCO rights request with the elements described in Section F of this Notice to the email address dataprotection@kueski.com 

E. AUTOMATED MEANS OF COLLECTING PERSONAL DATA

Kueski only uses cookies and/or web beacons to facilitate navigation on the website https://kueski.com 

F. MEANS FOR EXERCISING THE DATA SUBJECT’S ARCO RIGHTS
In order to protect the personal data, privacy, and trust of our candidates, we make the following email address available to you: dataprotection@kueski.com, where the Data Subject may, at any time, limit the use or disclosure of their personal data, as well as refuse or revoke authorization for its processing, by exercising the rights of access, rectification, cancellation, or opposition (ARCO) provided for in the Law.

You may submit your request by fulfilling all the requirements set forth in the ARCO Rights request form, in accordance with the LFPDPPP:

The request must contain and be accompanied by the following:

I. The Data Subject’s name and address or any other means to receive notifications;

II. Documents proving the identity of the Data Subject or, if applicable, the identity and authority of their representative;

III. A clear and precise description of the personal data for which any of the ARCO rights is to be exercised, except in the case of the right of access;

IV. A description of the ARCO right to be exercised, or the specific request of the Data Subject; and

V. Any other element or document that facilitates the location of the personal data.

VI. In the case of requests to exercise the right of rectification of personal data, the Data Subject must also indicate the changes to be made and provide documentation supporting their request.

Such requests will be handled by the Legal and Compliance Department.

Kueski will inform you, within a maximum period of twenty (20) business days from the date on which the corresponding request is received, of the determination made. If the request is deemed appropriate, it will be carried out within fifteen (15) business days following the date on which the Controller communicates its response.

If the information provided in your request is incorrect or insufficient, or if the necessary documents to prove your identity or legal representation are not attached, or any other that may be necessary to exercise your rights, the Controller will, within five (5) business days from receipt of your request, request that the deficiencies be corrected in order to proceed with it. In such cases, you will have ten (10) business days to comply with the correction request, counted from the day after you receive it. If you do not respond within this period, the corresponding request will be considered as not submitted.

Remember that, in the event of dissatisfaction or non-compliance on our part, you may turn to the Secretaría de Anticorrupción y Buen Gobierno (Anti-Corruption and Good Governance Secretariat) to request the initiation of the rights-protection procedure.

As the data subject, you are responsible for keeping your personal data held by Kueski up to date. Accordingly, you warrant and are liable, in all cases, for the truthfulness, accuracy, currency, and authenticity of the personal data provided to Kueski, and you undertake to keep it duly updated by notifying the Controller of any changes.

The exercise of ARCO rights may be restricted for reasons of national security, public order provisions, public safety and health, or to protect the rights of third parties, in the cases and to the extent provided for in applicable legislation, or by resolution of the competent authority.

Furthermore, please note that Kueski will not be obliged to cancel your personal data in any of the circumstances listed in Article 25 of the LFPDPPP.

Finally, Kueski may deny a request to exercise any of the ARCO rights in the following cases: (i) When the applicant is not the owner of the personal data, or their legal representative is not duly authorized to act on their behalf; (ii) When the personal data is not found in Kueski’s database; (iii) When exercising such rights would infringe the rights of a third party; (iv) When there is a legal impediment or a resolution from a competent authority that restricts it; and/or (v)When rectification, cancellation, or opposition has already been carried out previously. In any of the above cases, Kueski will inform the applicant of the reason for its decision by the same means in which the request was made and within the deadlines established in the LFPDPPP and its Regulations.

Please remember that the exercise of your ARCO rights is completely free of charge, and Kueski will never charge any fee for this service.

G. TRANSFER OF PERSONAL DATA

Kueski may carry out the transfer and/or referral of data to:

The third parties and entities receiving personal data assume the same obligations and/or responsibilities as Kueski, in accordance with this Privacy Notice.

For the transfer indicated with an asterisk (*), we require your consent, which you grant by accepting this Privacy Notice. If you do not wish your data to be transferred for this purpose or if you wish to update your prior consent, please follow the instructions in Section H.

H. WITHDRAWAL OF CONSENT

At any time, you may withdraw your consent for the processing of your personal data, provided that such revocation is legitimate and does not make it impossible to fulfill obligations arising from an active contractual relationship between Kueski and yourself.

You may withdraw your consent at any time by submitting your request to the email address dataprotection@kueski.com , complying with the requirements established in Section F.

Refusal regarding the processing of your personal data for these purposes will not affect your contractual relationship with Kueski.

I. CHANGES TO THE PRIVACY NOTICE

Any changes to this Privacy Notice will be communicated to you through the email address you provided to the Controller when you supplied your personal data.

Date of last update: October 2025.