PRIVACY NOTICE FOR THIRD PARTIES AND COMMERCIAL ALLIES OF KUESKI SAPI DE CV SOFOM ENR.

Pursuant to the provisions of the Federal Law for the Protection of Personal Data held by Private Parties (LFPDPPP by its Spanish acronym), its Regulations, the Guidelines of the Privacy Notice and the other applicable provisions (hereinafter jointly referred to as the "Law"), this Privacy Notice is issued in accordance to the following terms:

A. CONTROLLER OF THE PERSONAL DATA

For the purposes of this Privacy Notice, Kueski, S.A.P.I. de C.V., SOFOM, E.N.R. (hereinafter the "Controller" or "Kueski", indistinctly), with address at Av. Américas 1297, Piso 03-15, Col. Circunvalación Américas, Guadalajara, Jalisco, México, C.P. 44630 is responsible under the terms of the Law for the collection, disclosure, storage and/or use, including access, management, use, transfer or disposal (hereinafter the "Processing") of your personal data that it collects and, in general, of all the personal data that collected from any third party and/or business partner that is not a customer nor an employee, including without limitation, merchants, suppliers and interested third parties such as shareholders and/or officials of Kueski or any of its related parties, affiliates, subsidiaries or holders (hereinafter the "Data Subject(s)").

B. PERSONAL DATA COLLECTED AND ITS PROCESSING

Kueski will get your personal data throughout the following ways:

• Personally:When you provide your personal data in a physical and personal manner in order to start or to manage a contractual relation with Kueski.
• Directly:When you provide your personal data with the purpose of starting or managing a contractual relation with Kueski, via email or by telephone.

The types of personal data that are collected are the following:

a) Identification data

b) Academic data

c) Employment data and work and / or commercial references

d) Financial information

e) General information of the Data Subject that is required by applicable laws

Kueski does not collect sensitive personal data for its processing.

C. PURPOSES OF THE PROCESSING OF PERSONAL DATA

The processing of the Data Subject’s personal data, unless the Data Subject opposes to it by using the method described in this Privacy Notice, has the purposes of:

• Recruitment
• Identification of risks caused by hiring the services and or appointing it at any role.
• Market studies
• Analysis of the viability of the collaboration that may exist between Kueski and the Data Subject.
• Verification of criminal records
• Notifications of changes in conditions
• Attend legal requirements from competent authorities and / or contained in applicable laws
• Request work and / or commercial references to third parties

The purposes described above, are necessary for the juridical relation with Kueski.

Additionally, Kueski could use your personal data for the secondary purpose described below:

• Provide work references to third parties

If you do not want Kueski to use your personal data for this additional purpose and/or want to update your previous consent, please follow the instructions in section H.

Your personal data will never be used for marketing, publicitary or commercial purposes.

D. OPTIONS AND MEANS THAT KUESKI PROVIDES FOR THE DATA SUBJECTS TO LIMIT THE USAGE OR DISCLOSURE OF THEIR PERSONAL DATA

You can limit the usage of your personal data by following the instructions in section C; the disclosure in section G; or addressing your request to exercise your ARCO rights to the Legal and Compliance department according to the guidelines in section F.

E. AUTOMATIC MEANS TO COLLECT PERSONAL DATA

Kueski only uses cookies and/or web beacons to facilitate the navigation on its websitehttps://kueski.com/.

F. MEANS FOR DATA SUBJECTS TO EXERCISE THEIR ARCO RIGHTS

With the purpose of protecting the personal data, privacy and trust of the Data Subjects, Kueski offers you the emailarco@kueski.comwhere, at any time, you can limit the usage or disclosure of your personal data. Additionally you can deny or withdraw your authorization for the processing of your data by exercising your rights of access, rectification, cancellation and objection (ARCO rights) according to the Law.

For exercising your ARCO rights, you must request the application format via email to the addressarco@kueski.com. Then you should fill the format and send it back to the same account. Our Legal and Compliance department will attend this petition.

The request must contain the following:

a) The Data Subject’s name and his or her personal email, or any other mean for Kueski to communicate the response of the request;

b) Any document that can prove the identity, or in such case, the legal representation of the Data Subject;

c) A clear and precise description of the personal data that the Data Subject is trying to exercise any of the rights described above, and;

d) Any other document or element that makes the localization of the personal data easier.

Kueski will inform you of the decision taken, in a maximum period of twenty business days, starting on the day that Kueski received the petition. If the request proceeds, this one will become effective on a period no longer than fifteen business days after the date in which the Controller informed the answer.

If the information provided in the application was incomplete, inaccurate or out of date, or was not accompanied by the necessary documents to prove your identity or the correspondent legal representation or any other necessary document to exercise your rights, the Controller, within five business days after the reception of your application, will ask you to complete and/or correct the deficiencies in order to continue the process of your request. You will have ten business days to attend this petition starting from the day after you received it. If you fail to rectify the information within this period, your request will be considered as not presented.

G. TRANSFER OF YOUR PERSONAL DATA

Kueski could transfer or send your personal data to:

Third parties and the receiver entities of the personal data, will assume the same obligations and/or responsibilities as Kueski, according to the information described in this Privacy Notice.

For the transfer marked with an asterisk (*), we require your consent, which you are providing us by accepting this Privacy Notice. If you don’t want your personal data to be transferred to such purpose and/or want to update your previously given consent, please follow the instructions in section H.

H. WITHDRAWAL OF CONSENT

At any given time, you can withdraw your consent for the processing of your personal data, as long as the withdrawal is legit and do not suppose the impossibility of not fulfilling your contractual obligations with Kueski.

You can request the withdrawal of your consent, by asking for a new Privacy Notice and selecting the corresponding boxes in the new Privacy Notice. Such a request will be applicable from the moment you sign the new Privacy Notice and after you send it to the emailarco@kueski.com. The denial of the processing of your personal data for this purpose, will not harm your contractual relationship with Kueski.

I. CHANGES TO THE PRIVACY NOTICE

Any change to this Privacy Notice, will be informed to you throughout the email account that you provided to the Controller when you gave your personal data.

Last update date: July 2022.