Comprehensive Privacy Notice for Clients

1. IDENTITY AND ADDRESS OF THE RESPONSIBLE PARTY
   Twolander XYB, S.A.P.I. de C.V. (hereinafter, "Twolander"), located at Calderón de la Barca number 22, Polanco III Section, Miguel Hidalgo Borough, Postal Code 11540, Mexico City, in compliance with the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter, "LFPDPPP"), its regulations, and other applicable norms, is responsible for processing the following personal data of its clients (hereinafter, the "Data Subject"):
   
   

2. PERSONAL DATA COLLECTED
   i) Identification data; and ii) Contact data;
   2.1 SENSITIVE PERSONAL DATA COLLECTED
   Twolander does not collect sensitive personal data from the Data Subject.
   It is important to mention that the categories mentioned in items 2 and 2.1 are categories of personal data; if you require information on each personal data item collected, please contact Twolander’s Privacy Officer through the means indicated in this privacy notice.
   
   

3. PURPOSES OF PROCESSING
   Twolander requires the aforementioned personal data to be used for the following purposes:
   i) To identify the person contracting any of the products offered by Twolander; ii) To carry out the registration and enrollment of the Data Subject who purchases the various products offered by Twolander; iii) To generate files for the follow-up of the Data Subject; iv) The identification, granting, origination, operation, management, administration, collection, sale, disposal, transmission, discount, assignment, transfer, negotiation, and/or encumbrance of the credit rights of the Data Subject in favor of Twolander, and/or of the loan, credit, financing, and/or financial service contracted by the Data Subject with Twolander, carried out by and/or with the participation of Twolander and/or any holder, creditor, owner, and/or subsequent holder, whether national and/or foreign, including any funder, investor, provider, service provider, third party, and/or other related party and/or linked with and/or participating in and/or interested in any of these acts, initially and/or subsequently, nationally and/or internationally, with the consequent transfer; v) To conduct internal and external audits; vi) To prevent and detect frauds or other illegal activities; and vii) Compliance with applicable laws, regulations, and legal provisions.
   3.1 SECONDARY OR ACCESSORY PURPOSES
   i) To make welcome calls to new clients contracting a product; ii) To implement activities to measure service quality; and iii) To carry out marketing, advertising, promotion, commercial prospecting, and telemarketing activities of the goods, products, and/or services offered by Twolander, by any physical and/or electronic means.
   
   

4. MECHANISMS FOR THE DATA SUBJECT TO EXPRESS THEIR REFUSAL FOR SECONDARY OR ACCESSORY PURPOSES
   Last update: January 2024
   To state, as the Data Subject of the personal data provided, whether they wish their data to be processed by Twolander for the secondary purposes referred to in point 3.1 of this privacy notice.
   
   

5. DATA TRANSFERS
   Transfers are communications of personal data made to companies other than Twolander or, alternatively, to subsidiaries, affiliates, or controlling companies; in this regard, we inform you that Twolander and/or any of the physical and/or legal persons mentioned below, transfer and/or will transfer your personal data in the following cases:
   a) Transfers of personal data that do not require authorization from the Data Subject:
   i) To the Mexican Postal Service, to send invoices to clients who request it; ii) To the National Electoral Institute, to verify and validate the authenticity of the data and documents provided by the Data Subject regarding their identity; iii) To providers that offer services to Twolander; including external audit services; iv) To other financial institutions, when Twolander assigns, transmits, transfers, encumbers, or negotiates, in any form, the credit rights of the credits registered in the credit opening contracts signed; or in the promissory notes issued under the same by the Data Subject; or when Twolander undergoes mergers or spin-offs involving the Data Subject; v) To our subsidiaries, affiliates or controlling companies, to carry out the operation and administration of the credits contracted, when Twolander undergoes mergers or spin-offs involving these companies; vi) To the competent authority, in case it legally requests your personal data; and vii) In case of a merger or spin-off, to the company that acquires the legal obligations by carrying out the union or separation of Twolander.
   b) Transfers of personal data that require authorization from the Data Subject:
   i) To any holder, creditor, owner, and/or subsequent holder, whether national or international, including any funder, investor, provider, service provider, third party, and/or other related party and/or linked with and/or participating in and/or interested, initially and/or subsequently, nationally and/or internationally, in and/or for the identification, operation, management, administration, collection, acquisition, disposal, transmission, discount, assignment, transfer, negotiation, and/or encumbrance of the said credit rights of the Data Subject and/or of the referenced loan, credit, financing, and/or financial service contracted by the Data Subject.
   
   

6. MECHANISM OF ACCEPTANCE OF THE TRANSFERS
   To state, as the Data Subject of the personal data provided, whether they wish their personal data to be transferred to any holder, creditor, owner, and/or subsequent holder, whether national or international referred to in item 5, section b), of this privacy notice.
   
   

7. MEANS AND PROCEDURE TO EXERCISE ARCO RIGHTS AND TO REVOKE CONSENT
   Last update: January 2024
   The Data Subject has the right to access, rectify, cancel, or oppose the processing of their personal data (hereinafter, the "ARCO Rights"), in the cases provided by the LFPDPPP; or to revoke their consent if it was previously granted.
   If the Data Subject wishes to exercise any of the ARCO Rights or revoke their consent, they can learn the procedure for doing so in the following ways:
   • By sending an email to privacy@twolander.com, attention to the Privacy Officer of Twolander.
   Our office hours are from Monday to Friday from 9:00 AM to 2:00 PM and from 3:00 PM to 4:00 PM.

Our Privacy Officer
The Privacy Officer is the person formally designated by Twolander, to supervise and attend to requests for the exercise of the ARCO Rights or revocation of consent and to promote the protection of personal data within the organization.
If the Data Subject wishes to contact the Privacy Officer of Twolander, they can do so through the previously referred means in this section.

8. OPTIONS AND MEANS TO LIMIT THE USE OR DISCLOSURE OF PERSONAL DATA
   The Data Subject may register in the Public Registry to Avoid Advertising (hereinafter, "REPEP"), according to the Federal Consumer Protection Law with the purpose of limiting the use and disclosure of their personal data. The REPEP allows the Data Subject to enroll in a database in order to restrict promotional calls on specific numbers (fixed or mobile), work numbers or email, seeking to safeguard their privacy and avoid the inconveniences caused by these calls or sending of information. Data Subjects can enroll in the REPEP through the means established on the following website: http://repep.profeco.gob.mx/
   
   

9. USE OF COOKIES, WEB BEACONS OR SIMILAR MECHANISMS
   The Twolander Internet portal https://twolander.com/ (hereinafter, the "Portal"), uses cookies; cookies are data files stored on your hard drive when browsing the Portal and that allow the exchange of status information between the Portal and the browser of the Data Subject.
   If you wish to know the procedure to disable cookies, please consult the help section of your Internet browser or access the Privacy and/or Security options located in the Internet Options, Tools, Internet Preferences or similar functions of the Internet browser you are using or through the settings, tools or similar icon of the device on which the app(s) are installed. However, when disabling them, keep in mind that this action might prevent you from obtaining the full functionality that the sites and apps could offer you. If you wish to obtain additional information about the cookies mentioned in this section, you can visit www.allaboutcookies.org/es.
   Through cookies, Twolander collects information about the Data Subject visiting the Portal. Therefore, Twolander collects geographic information from which the Data Subject accesses the Portal, as well as the operating system, browser, and medium (search or advertisement) with which the Data Subject accesses the Portal. Likewise, Twolander collects the average browsing time and statistics of the most visited pages by the Data Subject.
   Twolander obtains the aforementioned data with the purpose of understanding the behavior of the Data Subject impacted through external digital channels to the Portal or those entering directly.
   
   

10. PROCEDURE AND MECHANISM TO LEARN ABOUT CHANGES IN THE PRIVACY NOTICE
    Any change or update to this privacy notice will be available in the "Privacy Notice" section of the Portal. The procedure is as follows: (i) access the "Privacy Notice" section; (ii) select the Comprehensive Privacy Notice for Clients; (iii) you will find the current version with the date of the last update.
    
    
    

IMPROPER PROCESSING OF YOUR PERSONAL DATA
If the Data Subject believes that their right to the protection of their personal data has been injured by any conduct or omission on the part of Twolander, or presumes any violation of the LFPDPPP, its regulations, and other applicable ordinances, they may file their grievance or complaint before the National Institute of Transparency, Access to Information, and Protection of Personal Data (INAI). For more information, visit the official website www.inai.org.mx.


CONSENT
The Data Subject of the personal data provided to Twolander declares that they have read the Comprehensive Privacy Notice for Clients, knows the categories of personal data collected and the purposes for the processing of their personal data, as well as the transfers that Twolander carries out and consents freely to the processing of their personal data in the terms described in this privacy notice. All processing of personal data will be subject to the express or tacit consent of the Data Subject, except for the exceptions provided by the LFPDPPP. In accordance with article 8 of the LFPDPPP, it will be understood that the Data Subject consents to the processing of their personal data in a: (i) tacit manner, when having this privacy notice made available to them through the Portal, they do not express any opposition; and, (ii) express manner, when they subscribe to this privacy notice in a handwritten manner, as indicated below.