Privacy Notice (Aviso de Privacidad — Integral / Simplificado) — LFPDPPP

PRIVACY NOTICE (AVISO DE PRIVACIDAD) — LEY FEDERAL DE PROTECCIÓN DE DATOS PERSONALES EN POSESIÓN DE LOS PARTICULARES (LFPDPPP)

Data controller (responsable): Data controller (responsable) name Address (domicilio): Controller's address (domicilio) Effective date: Effective date Format: Notice format

1. LEGAL BASIS 1.1. This notice is issued under the new Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), published in the DOF on 20.03.2025 and in force since 21.03.2025. 1.2. ⚠️ Under this new law, the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) was DISSOLVED; its data-protection oversight functions passed to the Secretaría de Anticorrupción y Buen Gobierno. Any prior aviso referencing the INAI must be updated.

2. DATA PROCESSED 2.1. Categories of personal data processed, with sensitive data (e.g. health, biometric) expressly identified (datos tratados, con datos sensibles identificados): Data processed, sensitive data flagged (datos tratados, con sensibles identificados)

3. PURPOSES (FINALIDADES) 3.1. ⚠️ Under the new LFPDPPP structure, purposes must be separated according to whether they require the data subject's consent or not: a) Purposes REQUIRING consent: Purposes requiring consent b) Purposes NOT requiring consent (e.g. necessary for the relationship/contract, or a legal obligation): Purposes not requiring consent 3.2. Note: the former duty to separately disclose data TRANSFERS to third parties was removed under the new law's restructured content requirements — confirm current guidance with your abogado before omitting a transfers section if this business does share data with processors.

4. ARCO RIGHTS 4.1. ARCO rights (acceso, rectificación, cancelación, oposición) — the data subject (titular) may exercise access, rectification, cancellation and opposition (ARCO) rights, and may object to certain processing. 4.2. Channel to exercise these rights: Channel to exercise ARCO rights

5. REVOCATION OF CONSENT 5.1. Procedure to revoke consent

— — — ⚠️ This is a boilerplate template, not legal advice. Mexican labour, social-security, data- protection and consumer-protection law (the Ley Federal del Trabajo — LFT — including its Article 47 grounds for rescission, its Article 422–425 Reglamento Interior de Trabajo regime as updated by the "Ley Silla" decree of DOF 19.12.2024 (fully in force since 15.12.2025), and its Article 132-XXXI anti-harassment mandate; the Ley del Seguro Social — IMSS registration (alta) within 5 business days of Article 15; NOM-035-STPS-2018 on psychosocial risk factors; the new LFPDPPP, DOF 20.03.2025, under which the INAI was dissolved in favour of the Secretaría de Anticorrupción y Buen Gobierno; and the Ley Federal de Protección al Consumidor — LFPC) is highly procedural, tied to fixed statutory deadlines (e.g. IMSS alta before/within 5 business days of the start of work, personal delivery of an aviso de rescisión at the moment of dismissal or via the Tribunal within 5 business days, a 30-day limitation period under Article 517 LFT, a 5-business-day withdrawal right for distance sales) and to penalties denominated in UMA (Unidad de Medida y Actualización, re-indexed annually by INEGI), not in salario mínimo. ⚠️ ADDITIONAL CONTEXT TO VERIFY WITH YOUR ADVISORS: (1) the constitutional reform gradually cutting the legal workweek — 2026: 48h → 2027: 46h → 2028: 44h → 2029: 42h → 2030: 40h — was enacted in 2026 and introduces a duty to keep an ELECTRONIC record of working time (registro de jornada); confirm your current schedule and time-tracking compliance; (2) the "Ley Silla" decree is fully in force since 15.12.2025 — confirm your Reglamento Interior de Trabajo has been updated with seating/ rest-period provisions and re-deposited at the CFCRL if amended; (3) the new LFPDPPP (in force since 21.03.2025) is still in a transitional period — subordinate regulations (reglamento) and the practice of the Secretaría de Anticorrupción y Buen Gobierno are still developing; any aviso de privacidad still referencing the defunct INAI must be updated; (4) the 2021 outsourcing reform (REPSE) prohibits labour subcontracting outright and requires any specialised-services contractor (cleaning, security, etc.) to hold a valid REPSE registration, on pain of joint liability and fines of 2,000–50,000 UMA — verify contractor status separately if relevant; (5) CFDI 4.0 payroll stamping (CFDI de nómina), SAT filings and IMSS/INFONAVIT contributions (via IDSE/SUA) are issued through your accountant's (contador) authorised systems and are OUT OF SCOPE for this template — a contador is a de facto mandatory partner for any business with employees. This English text is a DRAFTING AID ONLY. It must be reviewed, translated into Spanish where required for validity/ enforceability, and adapted by a Mexican labour/commercial lawyer (abogado) and accountant (contador) — and checked against current guidance from the STPS, IMSS, the Secretaría de Anticorrupción y Buen Gobierno, PROFECO and the applicable Centro de Conciliación — before use.