GEEK VIBES S. DE R.L. DE C.V.

COMPREHENSIVE PRIVACY NOTICE

In accordance with the Federal Law on Protection of Personal Data Held by Individuals (LFPDPPP).

1. Identity and address of the Responsible Party

In accordance with the provisions of articles 15 and 16 of the Federal Law on Protection of Personal Data Held by Individuals (hereinafter, the "Law" or "LFPDPPP"), and articles 23, 24 and 26 of its Regulation, Geek Vibes S. de R.L. de C.V. (hereinafter, "Geek Vibes", the "Responsible Party" or "we") makes available to the holder of personal data (hereinafter, the "Holder" or "you") this Comprehensive Privacy Notice.

Legal name: Geek Vibes S. de R.L. de C.V.

Federal Taxpayer Registry (RFC): GVI150303C78

Tax address: Circunvalación Poniente 149-B, Ciudad Satélite, Naucalpan de Juárez, Estado de México, C.P. 53100, México.

Website: https://geekvibes.agency

Email for privacy matters: datos@geekvibes.agency

Geek Vibes is a Mexican company dedicated to the development of comprehensive digital solutions, including strategic consulting, technology architecture, performance digital marketing, specialized 3PL logistics for digital brands, audiovisual production and UX/UI design, and provision of specialized talent on demand.

2. Personal data collected

For the purposes stated in this Notice, Geek Vibes may collect the following personal data from the Holder. Data is collected directly from the Holder when they voluntarily provide it through website forms, email communications, phone calls, in-person or virtual meetings, or when they interact with the site's services and tools.

2.1 Identification and contact data

• Full name (first and last names).

• Personal or corporate email address.

• Fixed or mobile phone number.

• City and country of residence or work location.

2.2 Professional data

• Name of the company, organization or entity for which they work.

• Position, function or role they hold.

• Industry sector or organizational vertical.

• Approximate size of the organization (number of employees or revenue), only when voluntarily provided.

• Information about needs, projects or business interests that the Holder shares with Geek Vibes.

2.3 Technical and navigation data

When the Holder browses the website https://geekvibes.agency, technical data necessary for site operation and analytical purposes are automatically collected, in accordance with the cookies section of this Notice:

• IP address of the device from which the site is accessed.

• Type and version of web browser used.

• Device operating system.

• Screen resolution and device type (desktop, mobile, tablet).

• Pages visited within the site, time spent and navigation order.

• Traffic source (referrer URL, search engine, advertising campaign).

• Date, time and duration of each visit.

• Unique identifiers generated by cookies and similar technologies.

2.4 Sensitive data

Geek Vibes does not collect sensitive personal data from the Holder. In the context of the LFPDPPP, sensitive data are those that could reveal racial or ethnic origin, present or future health status, genetic information, religious, philosophical or moral beliefs, union affiliation, political opinions or sexual preferences. The Holder should not provide this type of information to Geek Vibes. If the Holder includes sensitive data in any communication directed to Geek Vibes, such data will be deleted from the Responsible Party's records.

3. Purposes of personal data processing

The personal data collected will be used by Geek Vibes for the purposes described below. Purposes are divided into primary (necessary for the provision of services) and secondary (those requiring additional and specific consent from the Holder).

3.1 Primary purposes

The following purposes are necessary for the existence, maintenance and fulfillment of the legal relationship between Geek Vibes and the Holder. The Holder's consent to these purposes is essential for Geek Vibes to be able to address their requests and provide them with the contracted services:

• Attend to and follow up on requests for information, contact, quotes or advice that the Holder makes through website forms, email or any other means of communication.

• Generate and deliver personalized commercial proposals according to the needs expressed by the Holder.

• Establish, formalize, execute and follow up on the contractual relationship arising from the provision of services.

• Issue invoices, digital tax receipts via the internet (CFDI) and other documentation of a fiscal, accounting or legal nature required by applicable legislation.

• Perform collection management related to services provided to the Holder.

• Operate, maintain, improve and provide technical support for products, platforms and services contracted by the Holder.

• Comply with legal, contractual, fiscal or other obligations corresponding to Geek Vibes.

• Address requests for the exercise of ARCO rights (Access, Rectification, Cancellation and Objection) and revocation of consent.

3.2 Secondary purposes

The following purposes are not necessary for the provision of requested services but allow Geek Vibes to offer a better experience to the Holder. The Holder may object to the processing of their data for these purposes at any time, in accordance with the procedure described in the ARCO Rights section of this Notice:

• Sending monthly informational newsletters (newsletter) with educational content, sector analysis, case studies and Geek Vibes news.

• Invitations to events, webinars, workshops or training sessions organized by Geek Vibes.

• Communication of new services, products or capabilities that may be of interest to the Holder according to their professional profile.

• Satisfaction surveys and continuous service improvement.

• Aggregated statistical analysis of visitor behavior on the website to improve content and user experience.

• Personalization of the website experience according to preferences and interests expressed by the Holder.

• Remarketing and personalized advertising on third-party digital platforms, only when the Holder has granted express consent through the cookies banner.

Mechanism to object to secondary purposes: The Holder may at any time express their refusal to process their personal data for secondary purposes by sending a request to the email datos@geekvibes.agency, indicating their full name, contact details being followed up, and specifying the purpose or purposes to which they wish to object. Objection to secondary purposes does not in any way affect the provision of primary services contracted with Geek Vibes.

4. Legal basis for processing

The processing of the Holder's personal data by Geek Vibes is carried out on the basis of articles 8, 9, 10, 11, 12, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28 and other applicable articles of the Federal Law on Protection of Personal Data Held by Individuals, as well as articles 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32 and other applicable articles of the Regulation of the Federal Law on Protection of Personal Data Held by Individuals.

The Holder's consent is obtained in accordance with article 8 of the Law. Consent is considered granted implicitly when, having made this Notice available to the Holder, they do not express opposition. For the processing of sensitive personal data (which does not apply in the case of Geek Vibes) express written consent would be required.

5. Transfers of personal data to third parties

Geek Vibes may transfer the Holder's personal data to national or foreign third parties, under the terms and for the purposes described below. The transfer is made on the basis of contractual clauses that guarantee confidentiality and adequate protection of personal data, in accordance with articles 36 and 37 of the Law and articles 68, 69, 70, 71, 72, 73, 74 and other applicable articles of the Regulation.

5.1 List of third parties with whom data is shared

Geek Vibes uses the following technological and service providers, who may have access to the Holder's personal data for the provision of the stated services:

5.2 Cases where transfer does not require consent

In accordance with article 37 of the Law, national or international transfers of data may be carried out without the Holder's consent when:

1. They are necessary for the Responsible Party to comply with legal obligations.

2. They are necessary for the recognition, exercise or defense of a right in judicial proceedings.

3. They are required by a competent authority in the exercise of its legal powers.

4. They are necessary for the maintenance or fulfillment of a legal relationship between the Responsible Party and the Holder.

5.3 Consent for transfers

By accepting this Privacy Notice, the Holder grants express consent for Geek Vibes to carry out the personal data transfers described in this section, with the understanding that such transfers are made exclusively for the purposes stated here and under the technical, administrative and physical security measures that Geek Vibes has implemented to protect their data.

6. Holder's Rights (ARCO Rights)

In accordance with articles 22, 23, 24, 25, 26, 27 and 28 of the Law, the Holder has at all times the right to know what personal data Geek Vibes holds in its possession, what it uses it for, and the conditions of its use (Access). Likewise, they have the right to request correction of their personal information if it is inaccurate or incomplete (Rectification); to have it deleted from records or databases when they consider that it is not being used in accordance with the principles, duties and obligations provided for in the Law (Cancellation); as well as to object to the use of their personal data for specific purposes (Objection). These rights are collectively known as ARCO Rights.

6.1 Procedure for exercising ARCO Rights

To exercise any of the ARCO Rights, the Holder must send a written request to the Personal Data Department of Geek Vibes, addressed to the email:

datos@geekvibes.agency

The request must contain at least the following elements, in accordance with article 29 of the Law:

5. Full name of the Holder and address or any other means to receive a response to their request.

6. Documents proving the identity of the Holder or, where applicable, legal representation of the person acting on their behalf (copy of current official identification).

7. Clear and precise description of the personal data with respect to which any of the ARCO Rights are sought to be exercised.

8. Any other element or document that facilitates the location of the Holder's personal data.

9. In case of rectification of personal data, indicate the modifications to be made and provide the documentation supporting the request.

6.2 Response timeframe

Geek Vibes will communicate to the Holder, within a maximum period of 20 (twenty) business days from the date the request was received, the determination made, so that, if applicable, it may be made effective within the following 15 (fifteen) business days from the date the response is communicated. The aforementioned periods may be extended only once for an equal period, provided that the circumstances of the case justify it.

The obligation to provide access to personal information will be considered fulfilled when the Holder is provided with the personal data or through the issuance of simple copies, electronic documents or any other means determined by Geek Vibes in the response.

6.3 Cost of exercising rights

In accordance with article 35 of the Law, the exercise of ARCO Rights is free of charge. Only justified costs of mailing or the cost of reproduction in copies or other formats may be charged when the Holder requests that information be delivered by these means. In any case, Geek Vibes will inform the Holder of any applicable costs before they are incurred.

6.4 Grounds for denial

In accordance with article 34 of the Law, Geek Vibes may deny access to personal data, or perform rectification or cancellation or grant objection to their processing, in the following cases:

10. When the requester is not the Holder of the personal data, or the legal representative is not properly accredited.

11. When the personal data of the requester is not found in the database.

12. When the rights of a third party would be harmed.

13. When there is a legal impediment or a ruling by a competent authority that restricts access, rectification, cancellation or objection.

14. When rectification, cancellation or objection has been previously performed.

7. Revocation of consent

The Holder may revoke the consent that they may have granted to Geek Vibes for the processing of their personal data. However, it is important that you note that not in all cases will Geek Vibes be able to comply with your request or conclude the use immediately, as it is possible that due to a legal or contractual obligation the Responsible Party must continue processing your personal data for a determined period.

Revocation of consent is requested through the same procedure described for the exercise of ARCO Rights. The Holder must send their request to the email datos@geekvibes.agency complying with the requirements of article 29 of the Law.

Also, the Holder should consider that revoking their consent may mean that it is no longer possible to continue providing the service they requested, or the conclusion of their relationship with Geek Vibes.

8. Limitation of use or disclosure of personal data

The Holder may limit the use or disclosure of their personal data by sending a request to the Personal Data Department at the email datos@geekvibes.agency. The request must comply with the same requirements required for the exercise of ARCO Rights.

If the request is approved, the Holder will be registered in an internal exclusion list and will be notified in writing of such situation. Likewise, Geek Vibes will notify the Holder of any transfer or processing of their data that is incompatible with the requested limitation.

9. Cookies and tracking technologies

Geek Vibes' website uses cookies and other similar tracking technologies (hereinafter, collectively, "cookies") in order to improve the Holder's experience, analyze site usage and, when the Holder consents, display personalized advertising.

9.1 What are cookies?

Cookies are small text files that are stored on the Holder's device (computer, tablet, mobile phone) when visiting a website. Cookies allow the site to remember information about the visit, such as preferred language or session status, and facilitate certain functionalities.

9.2 Categories of cookies used

Geek Vibes classifies the cookies it uses into four categories. Essential cookies do not require the Holder's consent because without them the site could not function. The other categories require express consent, which the Holder grants or denies through the cookie management banner displayed on the first visit to the site:

9.3 Consent management

On the first visit to Geek Vibes' website, the Holder will see a cookie management banner that will allow them to:

• Accept all cookies (essential, functional, analytical and marketing).

• Reject all non-essential cookies (only cookies strictly necessary for site operation will be loaded).

• Personalize consent, allowing individual selection of which cookie categories they accept.

The Holder may modify their cookie preferences at any time by clicking the "Manage cookies" button available in the footer of all site pages. They may also delete cookies stored on their device through their browser settings.

9.4 Deleting cookies from the browser

The Holder can configure their browser to block all cookies or to alert them when a cookie is sent. If they choose to block cookies, some site features may not work correctly. Procedures for managing cookies in major browsers are available on their respective official help pages (Chrome, Firefox, Safari, Edge, Opera).

10. Security and confidentiality measures

Geek Vibes has implemented and maintains security measures of an administrative, technical and physical nature in accordance with articles 19 and 20 of the Law and articles 57, 58, 59, 60, 61 and other applicable articles of the Regulation, to protect the Holder's personal data against damage, loss, alteration, destruction or unauthorized use, access or processing. Among the main measures implemented are:

Administrative measures

• Formal designation of a Personal Data Processing Responsible Party.

• Internal policies for handling, retention and deletion of personal data.

• Confidentiality agreements with employees, collaborators and providers.

• Staff training in personal data protection.

• Formal procedures for addressing ARCO rights requests.

Technical measures

• Data encryption in transit using HTTPS/TLS 1.3 protocol in all communications with the website.

• Data encryption at rest in databases and storage systems.

• Authentication systems with strong passwords and multi-factor authentication (MFA) for privileged access.

• Audit logs of personal data access.

• Periodic automatic backups and incident recovery procedures.

• Continuous infrastructure monitoring and intrusion detection.

• Periodic software updates and security patch application.

Physical measures

• Physical access control to offices and work areas where personal data is processed.

• Storage of sensitive physical documentation under lock in designated filing cabinets.

• Secure destruction procedures for information on physical media.

Despite the measures implemented, Geek Vibes acknowledges that no security system is completely infallible. In the event that a breach of personal data security occurs that significantly affects the Holder's patrimonial or moral rights, Geek Vibes will notify the Holder promptly in accordance with article 20 of the Law, so that they can take the corresponding measures to defend their rights.

11. Changes to the Privacy Notice

Geek Vibes reserves the right to make modifications or updates to this Privacy Notice at any time, arising from new legal requirements, service needs, new internal policies, market practices or any other reason.

Any modification to this Notice will be communicated to the Holder through one or more of the following means, in accordance with article 18 of the Law:

15. Publication of the updated version on the website https://geekvibes.agency/legales/privacidad.

16. Visible notification on the site for a reasonable period from the date of change.

17. Communication by email, when the Holder has provided an email address and the change is material.

It is the Holder's responsibility to review this Notice periodically to stay informed about how their personal data is being processed. The date of last update is always shown on the first page of the document.

12. Competent authority

If the Holder believes that their right to personal data protection has been violated by any conduct or omission by Geek Vibes, or suspects any violation of the provisions of the LFPDPPP, its Regulation and other applicable laws, they may file the corresponding complaint or report with the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI), whose contact details are:

Website: https://home.inai.org.mx

Phone: 800 835 4324 (TELINAI)

Address: Av. Insurgentes Sur 3211, Col. Insurgentes Cuicuilco, Alcaldía Coyoacán, C.P. 04530, Mexico City.

For more information about the procedures for protecting rights before the INAI, the Holder can consult the Institute's website.

13. Personal Data Department

For all matters related to the processing of the Holder's personal data, including the exercise of ARCO Rights, revocation of consent, limitation of use or disclosure, questions about the content of this Notice or any communication related to privacy, the Holder should contact the Personal Data Department of Geek Vibes:

Data Processing Responsible: Sophia Gómez Altamirano

Position: Administration Director

Email: datos@geekvibes.agency

Phone: +52 55 8640 1495

Address: Circunvalación Poniente 149-B, Ciudad Satélite, Naucalpan de Juárez, Estado de México, C.P. 53100, México.

The Personal Data Department will address the Holder's request within the timeframes and in accordance with the procedure established in this Notice and applicable legislation.

14. Acceptance of the Privacy Notice

Acceptance of this Privacy Notice by the Holder will be understood as implicitly expressed by any of the following acts:

18. When the Holder continues browsing the website https://geekvibes.agency after having had the opportunity to read this Notice.

19. When the Holder completes any form available on the website and checks the corresponding acceptance box.

20. When the Holder sends any communication to Geek Vibes including their personal data by any means.

21. When the Holder signs a contract, commercial proposal or any other document with Geek Vibes.

In accordance with article 8 of the Law, it will be understood that the Holder implicitly consents to the processing of their data when, having been provided this Notice, they do not express their opposition.