PRIVACY NOTICE FOR CUSTOMERS AND USERS OF KUESKI S.A.P.I. DE C.V., SOFOM E.N.R.

Pursuant to the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), its Regulations, the Privacy Notice Guidelines and the other applicable provisions (hereinafter, collectively, the “Law”), this Privacy Notice is issued on the following terms:

1. CONTROLLER OF THE PERSONAL DATA.

For purposes of this Privacy Notice, Kueski, S.A.P.I. de C.V., SOFOM, E.N.R. (hereinafter the “Controller” or “Kueski”, interchangeably), with address at Av. Américas 1297, Floor 03-15, Col. Circunvalación Américas, Guadalajara, Jalisco, Mexico, C.P. 44630, is the party responsible, under the terms of the Law, for the obtaining, disclosure, storage and/or use, including access, handling, exploitation, transfer, disposal, recording, organization, retention, preparation, utilization, communication, dissemination or possession (hereinafter the “Processing”) of your personal data that it collects and, in general, of all the personal data that we collect from our customers and users (hereinafter the “Data Subject(s)”).

2. PERSONAL DATA COLLECTED AND SUBJECT TO PROCESSING.

In accordance with the foregoing, we inform you that Kueski will obtain your personal data, whether directly or indirectly, when you submit a request and provide your personal data for purposes of the provision of the credit services offered by Kueski, through our various websites (“Websites”), Blog and/or native Android and/or iOS applications (“Apps”) (together, the Websites, blog and Apps, the “Platforms”), by telephone, by video recording through a third party or any other personal or electronic means.

Kueski processes the following Personal Data obtained through the means described above, with the following classification:

This data may be used, among other purposes described in section 3 below, to assess the risks inherent in the credit you request, verify your identity, assess and rate your creditworthiness and for statistical purposes.

Kueski does not directly collect personal data of minors through forms, questionnaires or through its website. In addition, we inform you that sensitive personal data will only be used for the purposes described in this privacy notice, which correspond exclusively to the verification of your identity and fraud prevention, and their processing period will be limited to that established in the binding legal relationship corresponding to the adhesion contract, the terms and conditions of use of the platform and/or the applicable legal provisions.

For purposes of providing third-party data, whether information for the acquisition of products or services offered by business partners or for any other reason, it will be your sole responsibility to notify them of the transfer of their personal data to the Controller. In any case, Kueski will process such information on the basis of the provisions of the Law and this Privacy Notice and, likewise, in our capacity as Controller and in compliance with the provisions of the Law, we will make this Privacy Notice available to such third parties at our first contact with them.

You are hereby informed that Kueski does not work with agents, commission agents, or any other similar figure, and therefore any data you provide to any third party posing as such will not be under Kueski’s responsibility and, consequently, you, as the Data Subject, will be solely responsible for the information and personal data you share and for the processing given to them in such cases.

In addition, we inform you that we may process your personal data without the need to obtain your prior consent in any of the cases provided for in Article 9 of the Federal Law on the Protection of Personal Data Held by Private Parties.

3. PURPOSES FOR WHICH PERSONAL DATA WILL BE PROCESSED.

Kueski uses your personal, sensitive and financial data for the following purposes:

a) Primary purposes, necessary for the provision of the service.

1. Identification of the applicant and/or customer, as the case may be, including biometric data pursuant to express consent previously obtained.
2. Compiling the information file of our customer.
3. Management, control, administration and processing of the credit application and, as applicable, the granting thereof.
4. Management, control, administration, performance and fulfillment of the credit agreement entered into with the customer pursuant to the corresponding application.
5. Management, control and administration of administrative collection (through any contact means provided in the application), extrajudicial and, as applicable, judicial collection arising from the services provided by Kueski.
6. Investigation of changes in the customer’s transactional profile.
7. Compliance with legal, tax, commercial or administrative obligations.
8. Handling of the customer’s inquiries, questions, clarifications, claims, complaints or disputes.
9. Statistics and historical record of users and customers.
10. Creation, maintenance and training of Kueski’s predictive risk models.
11. Maintaining the security of information and operations.
12. Protection against identity theft.

b) Secondary purposes.

1. Marketing, advertising and/or commercial prospecting purposes.
2. Granting of incentives or recognitions to customers when they participate in our advertising, marketing or commercial campaigns.
3. Use of images and testimonials of customers and/or users for advertising purposes and commercial offers relating to products and/or services offered or related to products and/or services contracted.
4. Improvements in customer service and customer relations.

If you do not wish your data to be used for these secondary purposes, please complete the following form.

Please remember that you may request the revocation of your consent at any time. Such request applies from the moment you submit the duly completed form. Refusal of the use of your personal data for these purposes will not be grounds for denying the service.

4. OPTIONS AND MEANS THAT KUESKI OFFERS TO DATA SUBJECTS TO LIMIT THE USE OR DISCLOSURE OF THEIR PERSONAL DATA.

You may limit the processing of your personal data in the following ways:

1. Use, by following the instructions indicated in the last paragraph of section 3;
2. Disclosure, by following the instructions indicated in section 7;
3. By addressing the corresponding request to the Legal and Compliance department, to exercise your ARCO rights in accordance with the guidelines set out in section 6; or
4. In the case of personal data collected pursuant to the last paragraph of section 5 below, you may limit their processing as described therein.

5. OTHER MEANS OF COLLECTING PERSONAL DATA.

Kueski uses cookies, web beacons and/or Software Development Kits (“SDKs”) to facilitate browsing on its Platforms.

Cookies are a tool used by web servers to store and retrieve information that is saved in the browser used by users or visitors of the website, which makes it possible to save your personal preferences in order to provide you with a better browsing experience.

Cookies may range from the duration of the session or visit to the website to a specific date after which they cease to be operative.

The cookies used on the Platforms are associated only with an anonymous User and their computer equipment; they do not provide references that make it possible to deduce the User’s first name and surname, cannot read data from their hard drive and cannot include viruses in their texts.

You may configure your browser to automatically accept or reject all cookies or to receive an on-screen notice upon receipt of each cookie and decide at that time whether or not to install it on your hard drive.

We suggest that you consult the help section of your browser to learn how to change the settings on the acceptance or rejection of cookies. Even if you configure your browser to reject all cookies or expressly reject the cookies of the Platforms, you will be able to continue browsing the website, with the sole inconvenience of not being able to enjoy the functionalities of the site that require the installation of any of them. In any case, you may delete the cookies installed on your hard drive at any time by following the procedure set out in the help section of your browser.

We confirm that Kueski does not collect personal data through these means, and therefore they are not subject to processing or transfers.

In addition, we collect information on the basis of the authorizations you grant us when you log in to your user account through our Apps, with the sole purposes of improving your user experience and fulfilling primary purpose j) set out in section 3 of this Privacy Notice, relating to the creation, maintenance and training of Kueski’s predictive risk models. It is of the utmost importance to Kueski to inform you that we will never use the information collected through these means on an individual basis or for any use other than that described. Kueski cannot revoke such authorizations, as this must be changed from the mobile phone from which they were granted; you may therefore revoke them at any time by accessing the settings of your mobile phone.

It is important that you know that you may contact us at any time through the contact means we make available to you on the website https://kueski.com and we will gladly advise you on the procedure to revoke such consents from your device.

6. MEANS FOR EXERCISING THE DATA SUBJECT’S ARCO RIGHTS.

In order to protect personal data and the privacy and trust of our customers and users, we make available the following form and the email address usuarios@kueski.com, through which, as the data subject, you may at any time limit the use or disclosure of your personal data, and refuse or revoke authorization for its processing, by exercising the rights of access, rectification, cancellation or objection provided for by the Law.

You may submit your request through:

1. Submitting the following form to the email address usuarios@kueski.com to request ARCO rights, providing all the information and documents we request from you.
2. The email address usuarios@kueski.com, meeting all the requirements set out in the ARCO Rights request form in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties:

The request must contain, and be accompanied by, the following:

1. The name of the Data Subject and their address or any other means of receiving notifications;
2. The documents proving the identity of the Data Subject or, as applicable, the capacity and identity of their representative;
3. A clear and precise description of the personal data with respect to which any of the ARCO rights is sought to be exercised, unless the right of access is concerned;
4. A description of the ARCO right sought to be exercised, or otherwise what the Data Subject is requesting, and
5. Any other element or document that facilitates locating the personal data.
6. In the case of requests to exercise the right of rectification of personal data, the Data Subject must also state the modifications to be made and provide the documentation supporting the request.

3. By means of a written submission addressed to our Legal and Compliance team, at Av. Américas 1297, Floor 03-15, Col. Circunvalación Américas, Guadalajara, Jalisco, Mexico. C.P. 44630,
3. accompanied by the form available in accordance with point b) above and a copy of your official identification.

Kueski will notify you of the determination adopted within a maximum period of twenty business days, counted from the date on which we receive the corresponding request. If the request is granted, it will be implemented within the fifteen business days following the date on which Kueski communicates its response.

If the information provided in your request is erroneous or insufficient, or is not accompanied by the documents necessary to prove your identity or the corresponding legal representation, or any other document necessary to exercise your rights, within five business days following receipt of your request we will require you to cure the deficiencies so that the request may be processed. In such cases, you will have ten business days to comply with the requirement, counted from the day following the day on which you received it.

The corresponding request shall be deemed not filed if you do not respond within that period.

If you have an active loan (past due or not yet due) with us, Kueski will not be able to make changes to your personal data. To achieve this, you must first pay your loan and, once it is settled, follow the process described above.

Please remember that, in the event of dissatisfaction or non-compliance on our part, you may go before the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) to request the initiation of the rights protection procedure.

As the Data Subject, you shall be responsible for keeping your personal data held by Kueski up to date. Accordingly, you warrant and are liable in all cases for the truthfulness, accuracy, currency and authenticity of the personal data provided to Kueski, and you undertake to keep it duly updated, notifying the Controller of any change.

The exercise of ARCO rights may be restricted for reasons of national security, public order provisions, public safety and health, or to protect the rights of third parties, in the cases and to the extent provided for in applicable law, or by resolution of the competent authority.

In addition, we inform you that Kueski shall not be obliged to cancel your personal data in any of the cases listed in Article 25 of the Federal Law on the Protection of Personal Data Held by Private Parties.

Finally, Kueski may deny a request to exercise any of the ARCO rights in the following cases: (i) when the requester is not the Data Subject of the personal data, or the legal representative is not duly authorized to act; (ii) when the requester’s personal data are not found in Kueski’s database; (iii) when exercising them would infringe the rights of a third party; (iv) when there is a legal impediment, or a resolution of a competent authority restricting it; and/or (v) when the rectification, cancellation or objection has previously been carried out. In any of the foregoing cases, Kueski will inform the requester of the reason for its decision by the same means by which the request was made and within the periods established in the Federal Law on the Protection of Personal Data Held by Private Parties and its Regulations.

Please remember that the exercise of your ARCO rights is completely free of charge and that Kueski will at no time charge any fee for this service.

7. TRANSFER OF PERSONAL DATA.

Kueski may transfer your personal data to the third parties indicated below. Except for the transfer identified with an asterisk (*), all of them fall within one of the cases provided for in Article 36 of the Federal Law on the Protection of Personal Data Held by Private Parties, and therefore do not require your consent; the

possibility of limiting them depends on whether there is an active legal relationship between Kueski and you that makes them necessary:

The third parties and receiving entities of personal data assume the same obligations and/or responsibilities as Kueski, in accordance with the terms of this Privacy Notice.

We inform you that your personal data may be transferred to and processed by persons other than Kueski, in Mexico or abroad, in the case of: a) Any prospect, potential buyer or acquirer of Kueski or of any of its assets, including its loan portfolio, to grant financing, acquire the shares or assets of Kueski or its shareholders or affiliates in Mexico; b) Any internal or external authority or auditor when required to carry out the corresponding audit; c) Any collection, credit risk analysis or other service provider that Kueski considers necessary to engage.

To verify the legitimacy of any collection activity, the Data Subject may consult the official list of authorized firms on our website: https://www.kueski.com section Despachos de Cobranza (Collection Firms).

For the transfer marked with an asterisk (*) we require your express consent, which you grant by electronic means by accepting this Privacy Notice, under the terms of Articles 7 and 35 of the Federal Law on the Protection of Personal Data Held by Private Parties. Where financial and asset data are concerned, this transfer shall in no case be deemed consented to tacitly.

If you do not wish your data to be transferred to commercial affiliates, please complete the following form. Please remember that you may request the revocation of your consent at any time. Refusal of the transfer of your personal data for these purposes will not be grounds for denying you the services provided by Kueski.

In addition, we inform you that we may transfer your data without the need for your prior authorization in any of the cases provided for in Article 36 of the Federal Law on the Protection of Personal Data Held by Private Parties.

8. REVOCATION OF CONSENT.

At any time, you may revoke your consent to the processing of your personal data, provided that such revocation is legitimate and does not make it impossible to comply with obligations arising from a contractual relationship in force between Kueski and you, or is not possible by virtue of a legal or judicial mandate.

You may request the revocation of your consent at any time through the means we make available to you or by contacting our customer service area. Refusal of the processing of your personal data for these purposes and/or transfers will not affect your contractual relationship with Kueski.

9. CHANGES TO THE PRIVACY NOTICE.

Any update, modification or change to this privacy notice, made in response to legislative developments and/or modifications to Kueski’s internal policies, will be published on our website www.kueski.com

However, when the content of this Privacy Notice changes substantially; for example, if the purposes for which the personal data were collected change, you will be informed through the email registered in your user profile and we will require your consent again to continue processing your personal data.

10. SECURITY POLICIES.

Kueski protects your personal data using the industry standard for encryption; in this way we ensure that the data sent from the website reach our servers securely. We store and process your information while always maintaining security measures aimed at protecting your personal data.

At Kueski we have procedures and policies that dictate who may have access to the data and under what conditions, always giving the highest priority to the protection of your privacy. In addition, we adopt physical security measures to prevent unauthorized access to our systems and facilities.

11. DATA SUBJECT’S CONSENT.

By reading and accepting this Privacy Notice each time you log in to your user profile by any of the means available for that purpose, you expressly state that: (i) this Privacy Notice has been made known to you by Kueski and (ii) you have read and fully understood its terms and scope, and therefore you expressly grant your consent to the processing of your personal data under its terms.

Date of last update: October 2026.