ACTIUS CORPORATE GROUP

For Grupo Financiero VHM IMPULS SAPI DE CV and its financial entities, hereinafter referred to as the “Responsible Parties,” the protection of your personal data, your privacy, and your trust are our priority. Therefore, we protect your personal data through the continuous review of our information security processes, both physical and electronic. For this reason, we share with you our privacy policy and how we safeguard the integrity, privacy, and protection of your personal data, in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties and its Regulations, the “Law.” As the owner of personal data, you have this privacy notice available to you at all times on our website: www.grupoactius.com, and you can access the content of the Law on the portal provided by the Federal Government through the Ministry of the Interior at www.ordenjuridico.gob.mx.

Identity and Address of the “Responsible Parties” for the Processing of Your Personal Data

The controlling entity Grupo Financiero VHM IMPULS SAPI DE CV, with its registered address for the purposes of this privacy notice at Pablo Villaseñor, 76 Col. Arcos Vallarta, Guadalajara, Jalisco, C.P. 44680, acts as the Responsible Party in relation to you as the owner of your personal data.

PRINCIPLE OF INFORMATION

Each Responsible Party informs you that it holds, collects, or will collect from you the personal data necessary for the proper contracting of products, execution of operations, and provision of services, as well as for the completion of other actions that each Responsible Party may undertake according to the Law and its corporate statutes. Such personal data may have been or may be obtained from you personally or through any electronic, optical, sound, visual, or other technology. Additionally, we may obtain personal data from third parties and other sources permitted by the Law, such as credit information companies.

The data will be collected from the documents you provide, as well as from the service request(s) you submit to the Responsible Parties mentioned in this privacy notice, as well as from the complementary services used to provide the required service, formalize the contract, and maintain the commercial relationship that may arise.

We also inform you that the Responsible Parties have video surveillance systems in their offices and branches. The images and recordings captured by these systems are used as security measures and for monitoring and controlling physical access to the premises.

NECESSARY PURPOSES

Each Responsible Party informs you that the data it holds, collects, or will collect from you, is or will be used for all or some of the following purposes:

• Provision of the contracted service and/or product.

• Verify and confirm your identity, as well as the authenticity of the information you provide us, including that of your authorized third parties, spouses, beneficiaries, co-borrowers, references, guarantors, co-obligors, sureties, sellers, or other legal entities that need to be authenticated.

• Verify the payment capacity of your prospects and/or clients.

• Create files and databases necessary for the provision and operation of the contracted products and/or services, as well as the obligations derived from them.

• Claim prizes awarded by rewards programs and other promotions, assistance services, and complementary services that may be established.

• Provide products and/or services requested through our business partners.

• Address questions, complaints, clarifications, and legal requirements from various competent authorities that request them.

• Notify you via electronic, optical, sound, visual, or other technologies about changes in conditions for the contracted products and/or services, obligations arising from them, and maintenance of the commercial relationship.

• Perform complementary activities necessary to achieve the above purposes.

• Carry out collection activities resulting from the breach of contractual obligations for the contracted products and/or services, including visits, phone calls, and sending emails for collection purposes if required.

Additionally, the Responsible Parties may use your personal data for the following secondary purposes, which are not necessary for the requested product and/or service but allow us to provide you with better service:

SECONDARY PURPOSES

• Marketing, advertising, promotion, commercial prospecting, and customer profiling for the development and offering of new products, conducting surveys, creating or implementing analytical and statistical processes related to the mentioned operations and services, as well as for participation in non-profit activities related to the stated purposes of Grupo Financiero VHM IMPULS SAPI DE CV, as well as affiliates, associates, subsidiaries, controlling companies, and commission agents.

Furthermore, the processing of personal data will be necessary, appropriate, and relevant in relation to the purposes set out in this privacy notice and other purposes that are compatible or complementary related to the services provided by Grupo Financiero VHM IMPULS SAPI DE CV identified in this privacy notice. Refusal to use your personal data for these secondary purposes will not be a reason for us to deny you the services and/or products you request or contract with us.

Personal Data Processed

To carry out the described purposes, we will use the following personal data:

CATEGORY OF DATA:

• Identification data

• Contact data

• Academic data

• Employment data

• Immigration data

• Property and/or financial data

Personal Data of Minors and Persons with Disabilities or Under Guardianship

We inform you that we are particularly concerned about safeguarding the personal information of minors, people under guardianship, and persons with disabilities whose data may be processed due to the nature of the products you contract. In these cases, parents or guardians will give their express consent for the processing of their data by accepting this privacy notice.

Sensitive Personal Data Processed

To carry out the described purposes, we will use the following sensitive personal data:

SENSITIVE PERSONAL DATA:

• Biometric data, such as fingerprints, voice, facial recognition, hand geometry, and iris and retina patterns, to verify your identity and document the expression of your will.

• Current and/or future physical health data if you are interested in contracting a complementary product and/or service, and such data is required.

• Political affiliation data (PEP)

We also inform you that for processing your property and/or financial data, your express consent will be obtained, and for your sensitive data, your express written consent will be obtained. Once personal data of third parties, such as authorized persons, co-owners, spouses, beneficiaries, co-borrowers, references, guarantors, co-obligors, sureties, tutors, suppliers, beneficiaries, and other legal entities related to products and/or services are provided by you to the Responsible Parties for the fulfillment of the identified purposes, you must inform third parties about the existence of the processing of their personal data and the content of this privacy notice.

Transfer of Your Personal Data

The owner of personal data who maintains products and/or services and/or establishes a legal relationship with any of the Responsible Parties of Grupo Financiero VHM IMPULS SAPI DE CV consents to the transfer of their personal data within and outside of Mexico under the terms described. Each Responsible Party undertakes to ensure that all legal principles of protection are met regarding the transfer of your personal data and expresses its commitment to respecting this privacy notice at all times, both by us and by our providers (processors), and the purposes to which the owner subjected their processing.

We inform you that your personal data may be transferred without your consent to third parties within and outside of Mexico, in accordance with the scenarios contemplated in Article 37 of the LFPDPPP, which are as follows:

a) The transfer is provided for in a law or treaty to which Mexico is a party. b) It is necessary for medical prevention or diagnosis, the provision of healthcare, medical treatment, or the management of health services. c) It is made to controlling companies, subsidiaries, or affiliates under the common control of the Responsible Parties or to a parent company or any company of the same group as the Responsible Parties that operate under the same processes and internal policies. d) It is necessary by virtue of a contract concluded or to be concluded in the interest of the owner, by the Responsible Parties and a third party. e) It is necessary for the maintenance or fulfillment of a legal relationship between the Responsible Parties and the owner. f) It is legally required for the safeguarding of a public interest or for the administration of justice. g) It is necessary for the recognition, exercise, or defense of a right in a judicial process.

In compliance with the provisions of financial regulations and other applicable regulations for financial institutions, any of the Responsible Parties may make transfers to various authorities that so require and to credit information companies. Additionally, any of the Responsible Parties may transfer personal data, in addition to the aforementioned scenarios, for commercial prospecting purposes and complementary services to those provided by the financial entities of Grupo Financiero VHM IMPULS SAPI DE CV identified in this privacy notice, to Grupo Financiero VHM IMPULS SAPI DE CV, and to commercial partners who have contracts with the financial entities to offer benefit programs, rewards, assistance, other promotions and/or complementary services to the clients of any of these financial entities, when you decide to join a rewards program, benefits, assistance, or other promotions and/or complementary services provided by our commercial partners.

Transfers to third parties, such as the National Electoral Institute (INE) and the National Population Registry (RENAPO), may also be made to validate your identity under the applicable regulations to combat identity theft.

Transfers of your personal data to companies belonging to Grupo Financiero VHM IMPULS SAPI DE CV, investors (individuals or legal entities), or other credit institutions for portfolio sales or consultations with credit information companies, within or even outside of Mexico, may also occur. In any case, we will communicate this privacy notice to the recipients of your personal data so that its terms are respected.

ARCO Rights of the Personal Data Owner

The Responsible Parties designate the Directorate of Data Governance and Information Systems to attend to and process requests from personal data owners for the exercise of ARCO rights referred to in the Law (Access, Rectification, Cancellation, and Opposition).

Access: Know specific information that the Responsible Parties process concerning your personal data. Rectification: When your personal data is outdated, inaccurate, or incomplete. To exercise this right, you must provide documentation that proves the requested rectification of personal data. Cancellation: Prior “blocking” and subsequent deletion of personal data from the databases of the Responsible Parties when you consider that it is not being used and/or processed appropriately. Opposition: To the processing of your personal data for specific purposes.

Exercising any ARCO right is not a prerequisite nor does it prevent the exercise of another.

Revoking Consent to Process Your Personal Data

The owner or their legal representative may revoke the consent that you have given us for processing your personal data. However, it is essential to note that we may not always be able to fulfill your request or terminate the use immediately, as we may require continued processing of your data due to a legal obligation.

To revoke consent, any client or non-client may request to revoke their consent for processing their personal data for secondary purposes of marketing, promotion, advertising, and/or commercial prospecting. This request can be made through our contact point available on our website www.grupoactius.com, accompanied by documentation that proves your identity and/or legal capacity, as well as any other element or document that facilitates the location of the personal data, and if necessary, the necessary supporting documentation or via reference number in our Contact Center.

Additionally, you have the option to limit the use of your personal data for marketing, promotion, advertising, and/or commercial prospecting purposes by registering (valid for two years) in the User Register (REUS) managed by the National Commission for the Defense of Financial Service Users at the phone number: 800 999 8080 or through its website https://www.condusef.gob.mx.

Use of Tracking Technologies on Our Website

We inform you that our website uses cookies, web beacons, and/or other technologies through which it is possible to measure and collect statistical and demographic data that allows identifying or generating segments and usage trends in the behavior of our users on the portal. Additionally, we may obtain personal information from you, such as the type of browser, operating system, IP address, and data about activities on the website, through which it is possible to monitor your behavior as an internet user, create personalized content, and provide you with better service and user experience while browsing our website.

We also inform you how to disable them, except those that are technically necessary for the proper functioning of the website or system in question:

https://support.google.com/accounts/answer/61416?co=GENIE.Platform%3DDesktop&hl=en https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies

Geographic Location or Geolocation

We inform you that to provide some of our products and/or services, you must authorize obtaining the geolocation of the device, which provides the geographical coordinates of latitude and longitude where the device is located through which you access the mobile application. This information will be used to comply with applicable regulatory provisions.

We inform you that the personal data obtained through these technologies are not shared with third parties.

Modifications to the Privacy Notice

This privacy notice may be subject to modifications, changes, or updates due to new legal requirements, our own needs for the products or services we offer, our privacy practices, changes in our business model, or other causes. Any modification to this privacy notice will be notified to you through our website www.grupoactius.com or any other means considered convenient.

The owner understands and accepts the terms outlined in this privacy notice, including the changes established in the updates made to it, regarding the processing of their personal data.

Online Security Protocol

The owner who has access to the website agrees to receive files transmitted by the servers of Grupo Financiero VHM IMPULS SAPI DE CV. These files may contain information such as the identification provided by the owner or information to track the pages the owner has visited. The security and confidentiality of the data provided by the owners online will be protected by a secure server under the Secure Socket Layer (SSL) protocol so that the transmitted data will be encrypted to ensure its confidentiality and protection. Depending on the web browser used, you may be informed when the security of information is activated, with the common example being the appearance of the letter “s” at the beginning of the web address.

If dissatisfied, you may contact the National Institute of Transparency, Access to Information and Personal Data Protection (INAI), and/or consult its website www.inai.org.mx.

​

​