GEEK VIBES S. DE R.L. DE C.V.

COMPREHENSIVE PRIVACY NOTICE

In accordance with the Federal Law for the Protection of Personal Data Held by Private Parties (LFPDPPP).

1. Identity and Address of the Responsible Party

In accordance with the provisions of articles 15 and 16 of the Federal Law for the Protection of Personal Data Held by Private Parties (hereinafter, the "Law" or "LFPDPPP"), and articles 23, 24 and 26 of its Regulations, Geek Vibes S. de R.L. de C.V. (hereinafter, "Geek Vibes", the "Responsible Party" or "we") makes available to the holder of personal data (hereinafter, the "Data Subject" or "you") this Comprehensive Privacy Notice.

Business Name: Geek Vibes S. de R.L. de C.V.

Federal Taxpayer Registry (RFC): GVI150303C78

Tax Address: Circunvalación Poniente 149-B, Ciudad Satélite, Naucalpan de Juárez, State of Mexico, C.P. 53100, Mexico.

Website: https://geekvibes.agency

Email for privacy matters: datos@geekvibes.agency

Geek Vibes is a Mexican company dedicated to developing comprehensive digital solutions, including strategic consulting, technology architecture, performance digital marketing, specialized 3PL logistics for digital brands, audiovisual production and UX/UI design, and provision of specialized talent on demand.

2. Personal Data Collected

For the purposes outlined in this Notice, Geek Vibes may collect the following personal data from the Data Subject. Data is collected directly from the Data Subject when they voluntarily provide it through website forms, email communications, phone calls, in-person or virtual meetings, or when they interact with the site's services and tools.

2.1 Identification and Contact Data

• Full name (first and last names).

• Personal or corporate email address.

• Fixed or mobile phone number.

• City and country of residence or workplace location.

2.2 Professional Data

• Name of the company, organization or entity for which they work.

• Position, function or role they hold.

• Industrial sector or organizational vertical.

• Approximate size of the organization (number of employees or revenue), only when voluntarily provided.

• Information about needs, projects or commercial interests that the Data Subject shares with Geek Vibes.

2.3 Technical and Navigation Data

When the Data Subject browses the website https://geekvibes.agency, technical data necessary for site operation and analytical purposes are automatically collected, in accordance with the cookies section of this Notice:

• IP address of the device accessing the site.

• Type and version of web browser used.

• Device operating system.

• Screen resolution and device type (desktop, mobile, tablet).

• Pages visited within the site, time spent and navigation order.

• Traffic origin (referrer URL, search engine, advertising campaign).

• Date, time and duration of each visit.

• Unique identifiers generated by cookies and similar technologies.

2.4 Sensitive Data

Geek Vibes does not collect sensitive personal data from the Data Subject. In the context of the LFPDPPP, sensitive data are considered those that could reveal racial or ethnic origin, present or future health status, genetic information, religious, philosophical or moral beliefs, union affiliation, political opinions or sexual preference. The Data Subject should not provide this type of information to Geek Vibes. Should the Data Subject include sensitive data in any communication directed to Geek Vibes, such data will be deleted from the Responsible Party's records.

3. Purposes of Personal Data Processing

The personal data collected will be used by Geek Vibes for the purposes described below. Purposes are divided into primary (necessary for service provision) and secondary (those that require additional and specific consent from the Data Subject).

3.1 Primary Purposes

The following purposes are necessary for the existence, maintenance and fulfillment of the legal relationship between Geek Vibes and the Data Subject. The Data Subject's consent to these purposes is essential for Geek Vibes to address their requests and provide the contracted services:

• Respond to and follow up on requests for information, contact, quotation or advice that the Data Subject makes through website forms, email or any other communication channel.

• Generate and deliver personalized commercial proposals according to the needs expressed by the Data Subject.

• Establish, formalize, execute and monitor the contractual relationship arising from service provision.

• Issue invoices, digital internet tax receipts (CFDI) and other documentation of a fiscal, accounting or legal nature required under applicable law.

• Conduct collection management related to services provided to the Data Subject.

• Operate, maintain, improve and provide technical support for the products, platforms and services contracted by the Data Subject.

• Comply with legal, contractual, fiscal or any other obligations corresponding to Geek Vibes.

• Address requests for the exercise of ARCO rights (Access, Rectification, Cancellation and Opposition) and revocation of consent.

3.2 Secondary Purposes

The following purposes are not necessary for service provision but allow Geek Vibes to offer a better experience to the Data Subject. The Data Subject may object to the processing of their data for these purposes at any time, in accordance with the procedure described in the ARCO Rights section of this Notice:

• Sending monthly newsletters with educational content, industry analysis, case studies and Geek Vibes updates.

• Invitations to events, webinars, workshops or training sessions organized by Geek Vibes.

• Communication of new services, products or capabilities that may be of interest to the Data Subject according to their professional profile.

• Conducting satisfaction surveys and continuous service improvement.

• Aggregate statistical analysis of visitor behavior on the website to improve content and user experience.

• Personalization of the website experience according to the preferences and interests expressed by the Data Subject.

• Remarketing and personalized advertising on third-party digital platforms, only when the Data Subject has provided express consent through the cookie banner.

Mechanism to object to secondary purposes: The Data Subject may at any time manifest their refusal to the processing of their personal data for secondary purposes by sending a request to the email address datos@geekvibes.agency, stating their full name, the contact details being followed up on, and specifying the purpose or purposes to which they wish to object. Opposition to secondary purposes does not affect in any way the provision of primary services contracted with Geek Vibes.

4. Legal Basis for Processing

The processing of the Data Subject's personal data by Geek Vibes is carried out under the basis of articles 8, 9, 10, 11, 12, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28 and other applicable articles of the Federal Law for the Protection of Personal Data Held by Private Parties, as well as articles 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32 and other applicable articles of the Regulations of the Federal Law for the Protection of Personal Data Held by Private Parties.

The Data Subject's consent is obtained in accordance with article 8 of the Law. Consent is considered granted implicitly when, after this Notice has been made available to the Data Subject, they do not manifest opposition. For the processing of sensitive personal data (which does not apply in Geek Vibes' case), express written consent would be required.

5. Transfers of Personal Data to Third Parties

Geek Vibes may transfer the Data Subject's personal data to national or foreign third parties, under the terms and for the purposes described below. The transfer is based on contractual clauses that guarantee confidentiality and adequate protection of personal data, in accordance with articles 36 and 37 of the Law and articles 68, 69, 70, 71, 72, 73, 74 and other applicable articles of the Regulations.

5.1 List of Third Parties with Whom Data is Shared

Geek Vibes uses the following technology and service providers that may have access to the Data Subject's personal data for the provision of the services indicated:

The "GeekAgent" chat assistant and the form email delivery (Geek Vibes' own SMTP server) are services operated directly by Geek Vibes. Data processed through these means remains under the Data Controller's control and does not constitute a transfer to a third party; the infrastructure providers on which they run (Contabo and DigitalOcean) are listed above as processors.

5.2 Cases in Which Transfer Does Not Require Consent

In accordance with article 37 of the Law, national or international transfers of data may be carried out without the Data Subject's consent when:

1. They are necessary for the fulfillment of legal obligations of the Responsible Party.

2. They are necessary for the recognition, exercise or defense of a right in legal proceedings.

3. They are required by competent authority in the exercise of their legal powers.

4. They are necessary for the maintenance or fulfillment of a legal relationship between the Responsible Party and the Data Subject.

5.3 Consent for Transfers

By accepting this Privacy Notice, the Data Subject grants express consent for Geek Vibes to perform the personal data transfers described in this section, understanding that such transfers are made exclusively for the purposes stated here and under the technical, administrative and physical security measures that Geek Vibes has implemented to protect their data.

6. Data Subject's Rights (ARCO Rights)

In accordance with articles 22, 23, 24, 25, 26, 27 and 28 of the Law, the Data Subject has at all times the right to know what personal data Geek Vibes holds about them, what it is used for, and the conditions of use (Access). They also have the right to request correction of their personal information if it is inaccurate or incomplete (Rectification); that it be deleted from records or databases when they consider it is not being used in accordance with the principles, duties and obligations provided for in the Law (Cancellation); as well as to object to the use of their personal data for specific purposes (Opposition). These rights are collectively known as ARCO Rights.

6.1 Procedure to Exercise ARCO Rights

To exercise any of the ARCO Rights, the Data Subject must send a written request to Geek Vibes' Personal Data Department, directed to the email address:

datos@geekvibes.agency

The request must contain at least the following elements, in accordance with article 29 of the Law:

5. Full name of the Data Subject and address or any other means to receive response to their request.

6. Documents proving the Data Subject's identity or, where applicable, the legal representation of whoever acts on their behalf (copy of valid official identification).

7. Clear and precise description of the personal data regarding which they seek to exercise any of the ARCO Rights.

8. Any other element or document that facilitates the location of the Data Subject's personal data.

9. In case of rectification of personal data, indicate the modifications to be made and provide documentation supporting the request.

6.2 Response Period

Geek Vibes will communicate to the Data Subject, within a maximum period of 20 (twenty) business days from the date the request was received, the determination adopted, so that, if applicable, it takes effect within the following 15 (fifteen) business days from the date the response is communicated. The aforementioned periods may be extended only once for an equal period, provided that the circumstances of the case justify it.

The obligation to access personal information will be considered fulfilled when the Data Subject's personal data is made available or through the issuance of simple copies, electronic documents or any other means that Geek Vibes determines in the response.

6.3 Cost of Exercising Rights

In accordance with article 35 of the Law, the exercise of ARCO Rights is free of charge. Costs may only be charged for justified shipping expenses or the cost of reproduction in copies or other formats when the Data Subject requests that the information be delivered by these means. In any case, Geek Vibes will inform the Data Subject of any applicable costs before they are incurred.

6.4 Grounds for Inadmissibility

In accordance with article 34 of the Law, Geek Vibes may deny access to personal data, or perform rectification or cancellation or grant opposition to processing thereof, in the following cases:

10. When the requester is not the Data Subject, or the legal representative is not properly accredited.

11. When the personal data of the requester is not found in the database.

12. When the rights of a third party would be harmed.

13. When there is a legal impediment or resolution from a competent authority that restricts access, rectification, cancellation or opposition.

14. When the rectification, cancellation or opposition has been previously performed.

7. Revocation of Consent

The Data Subject may revoke the consent that they may have granted to Geek Vibes for the processing of their personal data. However, it is important to note that Geek Vibes may not be able to address their request or conclude use immediately in all cases, as it is possible that due to some legal or contractual obligation the Responsible Party must continue processing their data for a determined period.

The revocation of consent is requested through the same procedure described for the exercise of ARCO Rights. The Data Subject must send their request to the email address datos@geekvibes.agency complying with the requirements of article 29 of the Law.

Furthermore, the Data Subject should consider that revoking their consent may result in being unable to continue using the service they requested, or ending their relationship with Geek Vibes.

8. Limitation of Use or Disclosure of Personal Data

The Data Subject may limit the use or disclosure of their personal data by sending a request to the Personal Data Department at the email address datos@geekvibes.agency. The request must comply with the same requirements required for the exercise of ARCO Rights.

If the request is deemed appropriate, the Data Subject will be registered on an internal exclusion list and will be notified in writing of such situation. Furthermore, Geek Vibes will notify the Data Subject of any transfer or processing of their data that is incompatible with the limitation requested.

9. Cookies and Tracking Technologies

The Geek Vibes website uses cookies and other similar tracking technologies (hereinafter, collectively, "cookies") in order to improve the Data Subject's experience, analyze site usage and, when the Data Subject consents, display personalized advertising.

9.1 What are Cookies?

Cookies are small text files that are stored on the Data Subject's device (computer, tablet, mobile phone) when they visit a website. Cookies allow the site to remember information about the visit, such as preferred language or session status, and facilitate certain functionalities.

9.2 Categories of Cookies Used

Geek Vibes classifies the cookies it uses into four categories. Essential cookies do not require the Data Subject's consent because without them the site could not function. The other categories require express consent, which the Data Subject grants or denies through the cookie management banner displayed on their first visit to the site:

9.3 Consent Management

On the first visit to the Geek Vibes website, the Data Subject will see a cookie management banner that will allow them to:

• Accept all cookies (essential, functional, analytical and marketing).

• Reject all non-essential cookies (only cookies strictly necessary for site operation will be loaded).

• Customize consent, allowing individual selection of which cookie categories they accept.

The Data Subject may modify their cookie preferences at any time by clicking the "Manage cookies" button available in the footer of all site pages. They may also delete cookies stored on their device through their browser settings.

9.4 Deleting Cookies from the Browser

The Data Subject can configure their browser to block all cookies or alert them when a cookie is sent. If they choose to block cookies, some site functions may not work correctly. Procedures for managing cookies in major browsers are available on their respective official help pages (Chrome, Firefox, Safari, Edge, Opera).

10. Security and Confidentiality Measures

Geek Vibes has implemented and maintains administrative, technical and physical security measures in accordance with articles 19 and 20 of the Law and articles 57, 58, 59, 60, 61 and other applicable articles of the Regulations, to protect the Data Subject's personal data against damage, loss, alteration, destruction or unauthorized use, access or processing. Among the main measures implemented are:

Administrative Measures

• Formal designation of a Personal Data Processing Officer.

• Internal policies for handling, retention and deletion of personal data.

• Confidentiality agreements with employees, collaborators and suppliers.

• Staff training in personal data protection matters.

• Formal procedures for addressing ARCO rights requests.

Technical Measures

• Encryption of data in transit using HTTPS/TLS 1.3 protocol in all communications with the website.

• Encryption of data at rest in databases and storage systems.

• Authentication systems with strong passwords and multi-factor authentication (MFA) for privileged access.

• Audit logs of access to personal data.

• Automatic periodic backups and incident recovery procedures.

• Continuous infrastructure monitoring and intrusion detection.

• Periodic software updates and security patch application.

Physical Measures

• Physical access control to offices and work areas where personal data is processed.

• Storage of sensitive physical documentation under lock in designated file cabinets.

• Secure destruction procedures for information on physical media.

Despite the measures implemented, Geek Vibes acknowledges that no security system is completely infallible. In the event that a breach of personal data security occurs that significantly affects the Data Subject's patrimonial or moral rights, Geek Vibes will notify the Data Subject in a timely manner in accordance with article 20 of the Law, so they can take appropriate measures to defend their rights.

11. Changes to the Privacy Notice

Geek Vibes reserves the right to make modifications or updates to this Privacy Notice at any time, arising from new legal requirements, service needs, new internal policies, market practices or any other reason.

Any modification to this Notice will be communicated to the Data Subject through one or more of the following means, in accordance with article 18 of the Law:

15. Publication of the updated version on the website https://geekvibes.agency/legales/privacidad.

16. Visible notification on the site for a reasonable period from the date of change.

17. Email communication, when the Data Subject has provided an email address and the change is substantial.

It is the Data Subject's responsibility to review this Notice periodically to stay informed about the processing of their personal data. The date of last update always appears on the first page of the document.

12. Competent Authority

If the Data Subject considers that their right to personal data protection has been harmed by any action or omission by Geek Vibes, or suspects any violation of the provisions of the LFPDPPP, its Regulations and other applicable laws, they may file the corresponding complaint or report with the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI), whose contact information is:

Website: https://home.inai.org.mx

Phone: 800 835 4324 (TELINAI)

Address: Av. Insurgentes Sur 3211, Col. Insurgentes Cuicuilco, Alcaldía Coyoacán, C.P. 04530, Mexico City.

For more information about the procedures for protecting rights before the INAI, the Data Subject may consult the Institute's website.

13. Personal Data Department

For any matter related to the processing of the Data Subject's personal data, including the exercise of ARCO Rights, revocation of consent, limitation of use or disclosure, questions about the content of this Notice or any communication related to privacy, the Data Subject should contact Geek Vibes' Personal Data Department:

Processing Officer: Sophia Gómez Altamirano

Position: Director of Administration

Email: datos@geekvibes.agency

Phone: +52 55 8640 1495

Address: Circunvalación Poniente 149-B, Ciudad Satélite, Naucalpan de Juárez, State of Mexico, C.P. 53100, Mexico.

The Personal Data Department will address the Data Subject's request in accordance with the deadlines and procedures established in this Notice and in applicable legislation.

14. Acceptance of the Privacy Notice

The Data Subject's acceptance of this Privacy Notice will be understood to be manifested implicitly by any of the following acts:

18. When the Data Subject continues browsing the website https://geekvibes.agency after having had the opportunity to read this Notice.

19. When the Data Subject completes any form available on the website and marks the corresponding acceptance checkbox.

20. When the Data Subject sends any communication to Geek Vibes including their personal data by any means.

21. When the Data Subject signs a contract, commercial proposal or any other document with Geek Vibes.

In accordance with article 8 of the Law, it will be understood that the Data Subject implicitly consents to the processing of their data when, after this Notice has been made available to them, they do not manifest opposition.