COMPREHENSIVE PRIVACY NOTICE

I. Identity of the Controller

DSD ABOGADOS, S.C. (hereinafter, “DSD”), with address at Calle Roberto Gayol 1219, Piso 1, Colonia del Valle Centro, Alcaldía Benito Juárez, Mexico City, C.P. 03100, is responsible for the processing of personal data collected from users, clients, and other data subjects (hereinafter, the “Users”) who visit our facilities or browse our websit www.dsd.legal.

DSD recognizes the importance of safeguarding the privacy and informational self-determination of its Users. Accordingly, we make this Comprehensive Privacy Notice available in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties and other applicable regulations (hereinafter, the “Law”), in order to inform Users about the purposes, mechanisms, and conditions under which their personal data are collected, used, stored, and, when applicable, transferred.

II. Personal Data Collected and Processed

DSD may collect and process the following personal data from Users, depending on the purposes described in this Privacy Notice:

• Identification and contact data: Full name, home address, date of birth, CURP, landline and/or mobile phone number, email address, and valid official photo ID.
• Academic data: Educational background, university degree, professional license number, specialization, master’s degree, certificates, and other documents evidencing academic qualifications.
• Employment data: Job position, work address, institutional email, landline and/or mobile phone number, and/or fingerprint.
• Financial data: Information related to bank accounts.
• Tax information: Tax status certificate, financial statements, invoicing information, and/or credit reports.

III. Processing of Sensitive Personal Data

For the purposes described in this Privacy Notice, DSD informs Users that it does not collect or process sensitive personal data, as defined under the Federal Law on the Protection of Personal Data Held by Private Parties—such as data revealing ethnic or racial origin, health status, genetic information, religious, philosophical or moral beliefs, union affiliation, political opinions, and/or sexual preferences.

IV. Purposes of Processing

DSD may process Users’ Personal Data for various purposes, depending on the nature of the legal or commercial relationship established. All processing will be carried out pursuant to the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality, and responsibility established in the Law.

The purposes of the processing are detailed below:

a) Primary Purposes (do not require consent):

1. Receipt of requests and/or claims addressed to DSD

• Verify the User’s identity.
• Collect contact information to follow up on requests.

2. Contact via telephone and/or email:

• Respond to questions, comments, and/or User requests.
• Establish a legal relationship with the User.

3. Job applicants and/or candidates

• Establish contact for recruitment and/or selection processes.
• Create employment records.
• Generate statistics and historical records of candidates.

4. Legal and administrative compliance:

• Identify, contact, and/or send information related to the legal relationship.
• Comply with applicable legal obligations.

b) Secondary Purposes (require express consent):

• Sending information for marketing and/or advertising purposes.

V. Personal Data Transfers

DSD does not transfer Personal Data for the fulfillment of the purposes described in this Privacy Notice.

VI. Security Measures

DSD informs Users that, to protect their Personal Data, we have implemented and maintain the necessary administrative, technical, and physical security measures to protect information against damage, loss, alteration, destruction, or unauthorized use, access, or processing.

VII. Exercising ARCO Rights

Data subjects may exercise their rights of Access, Rectification, Cancellation, and Opposition (ARCO Rights) before DSD, as the entity responsible for the processing of their Personal Data. Users may also revoke their consent at any time—when such consent is required for processing—and may request limitation on the use or disclosure of their data.

Requests must meet the requirements set forth in applicable law and must be submitted by email to: contacto@dsd.legal, briefly describing the ARCO Rights to be exercised:

• Access: Know which personal data DSD holds, their origin, how they are used, and to whom they have been disclosed.
• Rectification: Request the correction of inaccurate, incomplete, or outdated personal data.
• Cancellation: Request the deletion of personal data when they are no longer necessary for the purposes that justified their processing.
• Opposition: Object to the processing of personal data for specific purposes, such as advertising or market research.

Required information for ARCO requests:

1) Name and address or other means to receive a response.

2) Documents proving identity or, if applicable, legal representation.

3) Clear and precise description of the ARCO Rights to be exercised.

4) Any additional information that facilitates the location of personal data.

DSD will communicate its determination within 20 business days. If the request is deemed appropriate, it will be fulfilled within 15 business days from the date on which DSD communicates its response.

If the information in the request is incorrect or incomplete, or if required documents are missing, DSD will request the necessary corrections in order to process it.

Use of electronic means to exercise ARCO Rights authorizes DSD to issue responses by the same means, unless the User expressly indicates otherwise. Any delivery costs will be borne by the User.

When applicable, Users may obtain access to their personal data through simple copies or electronic documents in conventional formats (Word, PDF, or similar), and any associated costs will be borne by the User.

Users are responsible for keeping their Personal Data up-to-date. Therefore, you guarantee the accuracy, validity, and authenticity of the Personal Data you provide and agree to notify DSD of any changes.

VIII. Consent

When the User visits our website, sends us an email, accesses related pages, or provides us with their Personal Data, they grant their consent for the processing of such Personal Data in accordance with the terms of this Privacy Notice.

If the Law requires the User’s express consent, DSD will inform the User of this requirement so that the User may grant such consent expressly and in writing for the processing of their Personal Data.

IX. Revocation of Consent

The User may revoke their consent for the processing of their Personal Data at any time, without retroactive effects, provided that such revocation does not prevent the fulfillment of legal or contractual obligations arising from an ongoing legal relationship between the User and DSD.

The procedure to exercise this revocation shall follow the same steps established for the exercise of ARCO Rights, as described in the corresponding section of this Privacy Notice.

X. Amendments or Updates to this Comprehensive Privacy Notice

DSD reserves the right to modify, update, expand, or otherwise change the content and scope of this Privacy Notice at any time and at its sole discretion.

Any modification will be published on DSD’s official website: www.dsd.legal and will become effective as of its publication. Users are encouraged to periodically review this Privacy Notice to remain informed of any potential changes.

If there is an ongoing legal relationship between the User and DSD, and a communication channel has been established, DSD may notify such modifications through that channel. Should the User access the Privacy Notice remotely or wish to express disagreement with the processing of their Personal Data following a modification, they may do so through the mechanisms established for exercising their ARCO Rights.

01 November 2025.