PRIVACY POLICIES

PRIVACY NOTICE (INTEGRAL – SUPPLIERS / VENDORS) WHIP SOLUTIONS, S.A. DE C.V.

I. Identity and Address of the Data Controller

Whip Solutions, S.A. de C.V. (hereinafter referred to as the “Company”), duly incorporated under the laws of the United Mexican States, with registered address at Calle Ixcateopan No. 104, Colonia Letrán Valle, Benito Juárez, C.P. 03650, Mexico City, Mexico, acts as the data controller of personal data collected directly in connection with the legal and commercial relationship established with you, for the proper fulfillment of its legal, regulatory, and contractual obligations.

II. Personal Data Processed.

This Privacy Notice is addressed to the Company’s suppliers, including individuals, as well as legal representatives, attorneys-in-fact, employees, or authorized contacts of legal entities that maintain or intend to establish a commercial relationship with the Company; for the establishment, formalization, and administration of such relationship, the Company may collect and process personal data including full name, company name, legal representatives, tax identification data, business or fiscal address, telephone number, email address, signatures (handwritten or electronic), official identification, corporate documentation such as articles of incorporation or powers of attorney, tax information, tax status certificates, electronic tax invoices (CFDI), as well as banking and financial data necessary to process payments, including bank name, account number, and interbank CLABE, together with any information contained in contracts, purchase orders, quotations, invoices, account statements, and any other documentation necessary for supplier evaluation, onboarding, compliance with legal, fiscal, and contractual obligations, administrative management, identity verification, corporate due diligence, and compliance with internal policies related to information security and regulatory compliance; all such data shall be processed in accordance with the principles of lawfulness, purpose limitation, proportionality, and accountability

III. Means of Data Collection

Personal data may be obtained directly through physical or electronic means, including the Company’s offices, authorized personnel, corporate website, email communications, telephone interactions, or digital platforms, as well as indirectly through authorized third parties, public sources, or data generated as part of the legal relationship established or to be established between the parties.

IV. Primary Purposes of Processing

Personal data will be processed strictly for purposes necessary for the existence, maintenance, and fulfillment of the legal and commercial relationship with suppliers, including evaluating and selecting suppliers, integrating and maintaining supplier records, registering suppliers within internal management systems, verifying identity and legal capacity, negotiating, formalizing, administering, and monitoring contracts, purchase orders, and related agreements, managing procurement and supplier selection processes, administering the commercial relationship including receipt of goods or services and contractual follow-up, carrying out administrative, accounting, and tax processes including issuance and validation of tax invoices (CFDI), processing payments, and complying with all applicable legal, regulatory, and contractual obligations; such processing is considered lawful where it is necessary for the performance of a contractual relationship or compliance with legal obligations under applicable law.

V. Secondary Purposes

Additionally, personal data may be processed for secondary purposes related to strengthening the commercial relationship, including internal evaluation and classification of suppliers, commercial, financial, technical, quality, and information security assessments, participation in bidding or supplier selection processes, corporate due diligence and integrity verification, as well as compliance with internal policies related to audit, control, information security, anti-corruption, and regulatory compliance; the data subject may object to such processing at any time without affecting the primary contractual relationship.

VI. Data Transfers and International Data Transfers

The Company may transfer personal data to third parties, whether within Mexico or abroad, where such transfers are necessary for the purposes described in this Privacy Notice, including transfers to competent authorities, corporate group entities, and service providers acting as data processors such as technology providers, cloud infrastructure services, enterprise platforms, cybersecurity services, auditing, consulting, legal, accounting, or administrative services, who shall process personal data strictly in accordance with the Company’s instructions and under confidentiality and data protection obligations; such transfers may be carried out without the data subject’s consent where permitted by applicable law, particularly where necessary for compliance with legal obligations or the performance of a contractual relationship.

In the case of international data transfers, including transfers to the United States or other jurisdictions, the Company ensures that such transfers are conducted as an extension of the original processing activity and that they do not reduce the level of protection afforded to personal data; accordingly, the receiving party shall assume obligations equivalent to those imposed on the Company under applicable data protection laws, and the Company shall implement appropriate safeguards, including contractual data protection clauses, confidentiality agreements, technical and organizational security measures, and access controls, ensuring that personal data is processed solely for authorized purposes; where required by applicable law, the Company shall obtain the data subject’s consent prior to such transfers, or otherwise rely on lawful bases such as contractual necessity or legal compliance, thereby ensuring accountability, traceability, and continuous protection throughout the data lifecycle.

VII. Data Subject Rights

The data subject may exercise rights of access, rectification, cancellation, and objection (ARCO rights) by submitting a request to the Company’s Privacy Officer through the channels indicated herein, and such requests shall be processed in accordance with applicable law; additional information regarding the applicable procedure, requirements, and response timelines may be provided upon request or through the Company’s designated channels.

Data subjects may exercise their rights by contacting the Company; additional information regarding the applicable procedure may be provided upon request.

VIII. Limitation of Use and Disclosure

Given that the processing of personal data is necessary for the fulfillment of contractual and legal obligations, it cannot be limited with respect to primary purposes; however, the data subject may request limitation of use or disclosure for secondary purposes by contacting the Company through the designated email address and may request inclusion in internal exclusion lists maintained for such purposes.

IX. Withdrawal of Consent

The data subject may revoke consent at any time by contacting the Company, with the understanding that such revocation may result in the termination of the legal relationship where the data is necessary for primary purposes.

X. Security Measures

The Company has implemented administrative, technical, and physical security measures designed to protect personal data against damage, loss, alteration, destruction, or unauthorized access, ensuring compliance with applicable data protection laws and maintaining the integrity and confidentiality of the information.

XI. Changes to the Privacy Notice

This Privacy Notice, as well as any updates thereto, shall be made available through the Company’s website or other communication channels, ensuring accessibility and transparency to the data subject.

XII. Privacy Officer Contact Information

For any inquiries, requests, or exercise of rights, the data subject may contact the Company at privacidad_whip@whipsolutions.com.mx or at its registered address in Mexico City.

XIII. Consent

By engaging in a commercial relationship with the Company, the data subject acknowledges having read and understood this Privacy Notice and grants consent for the processing of personal data in accordance with its terms; where applicable, explicit consent is granted for the processing of financial, patrimonial, or sensitive data, as well as for international data transfers, in accordance with applicable legislation.

Last Updated: March 31, 2026

Identity and Address of the Data Controller

Whip Solutions, S.A. de C.V. (hereinafter, the “Company”), duly incorporated under the laws of the United Mexican States, with its address at Calle Ixcateopan No. 104, Colonia Letrán Valle, Benito Juárez, C.P. 03650, Mexico City, Mexico, is responsible for the processing of your personal data collected directly in connection with the legal relationship with you, for the proper fulfillment of its obligations.

Personal Data to Be Processed

The categories of personal data that the “Company” may collect, use, store, and process in connection with the employment or contractual relationship it maintains with its personnel include, without limitation, identification data and personal characteristics; contact and address details; employment, professional, and occupational data related to their position, duties, performance, employment history, and internal evaluation processes; academic and professional training data; financial or asset-related data necessary to administer the employment relationship; immigration data, where applicable; and information concerning administrative or judicial records when necessary for verification, regulatory compliance, or corporate security processes. In addition, given the nature of the “Company’s” activities in cybersecurity, information security, and the protection of technology infrastructure, data relating to access to, use of, authentication in, and administration of corporate computer systems, devices, networks, technology platforms, institutional accounts, activity logs for systems and networks, information security monitoring, technology audits, logical access controls, and any other information generated through the use of technology tools provided by the “Company” may be processed in order to protect digital assets, prevent security incidents, investigate possible breaches, ensure operational continuity, and verify compliance with internal information security policies. Additionally, and only when necessary to comply with legal or employment obligations, sensitive personal data, such as information concerning health status, physical characteristics, or personal traits, may be processed in accordance with applicable law and, where required by current regulations, after obtaining the data subject’s express consent.

Methods of Obtaining Personal Data

The Data identified in the categories and subcategories above may be obtained:

• Directly, at our offices, through officials or employees authorized for that purpose, through remote electronic or physical means, through our corporate website, images, email address, or our switchboard and telephone number.
• Indirectly, through transfers made by authorized individuals or legal entities, from publicly available sources, and generally through information generated in connection with the legal relationship we have entered into or may enter into.

PRIMARY Purposes of Processing

The aforementioned Personal Data will be processed for all purposes related to the legal relationship and the obligations arising from it, as follows:

Human Resources (Applicants, employees, and former employees). The data will be used for all purposes related to the employment relationship, especially selection, verification of references from previous employment, recruitment, job postings, training, assessment and measurement of skills and competencies, definition of development actions, and payment of employment benefits.

Video Surveillance and Recording in the Workplace

Personal data used for video surveillance and recording serves to keep a record of entries and exits; ensure the safety of people and facilities; where applicable, allow the identification of individuals when a legally protected interest is affected; protect our employees, visitors, and property; supervise compliance with internal policies and/or procedures; evaluate and improve productivity and operational efficiency; and comply with legal and regulatory obligations concerning security. You are hereby informed that this processing forms part of the security measures implemented both inside and around the perimeter of the facilities.

Video-Surveilled Areas

Cameras are located in common and work areas, such as entrances, hallways, offices, warehouses, and production areas. Installing cameras in areas of high privacy, such as bathrooms, changing rooms, or rest areas, is strictly prohibited.

Retention of Images

Video surveillance recordings will be retained for a maximum of 30 calendar days from the date of capture. After that period, the images will be automatically deleted unless a court order or legal provision establishes otherwise.

Access to Recordings

Access to recordings will be restricted to authorized personnel, such as the person responsible for security and/or human resources, and will occur only when necessary to fulfill the purposes described above. Any unauthorized access will be considered a violation of personal data protection regulations and may be reported to the Company’s Privacy Officer.

Processing of Data Derived from the Use of Information Technology (Monitoring)

Given the nature of the duties performed, and in order to protect the “Company’s” technology infrastructure, corporate information, and digital assets, the Data Controller may implement mechanisms for the administration, control, monitoring, and security of computer systems, networks, devices, and technology platforms provided to personnel as work tools.

In this context, the “Company” may process information derived from the use of computers, mobile devices, corporate networks, computer systems, institutional accounts, digital platforms, collaboration tools, and other technology resources provided by the “Company,” including system access logs, user authentication data, IP addresses, network and application activity logs, system usage history, network traffic, and any other technical information generated through the use of those resources.

The “Company” may also install, configure, and operate technology tools and specialized software for information security, system monitoring, data loss prevention, access control, technology auditing, and incident detection in order to:

• Ensure information security;
• Prevent unauthorized access or cybersecurity incidents;
• Protect the confidentiality, integrity, and availability of corporate data;
• Verify compliance with internal information security policies;
• Investigate possible security incidents or breaches.

Information derived from the use of corporate technology resources will be processed exclusively for employment, operational, information security, and regulatory compliance purposes, in accordance with the principles of proportionality, data minimization, and confidentiality. Access to that information will be limited to authorized personnel, and administrative, technical, and physical measures will be adopted to protect personal data.

The devices, systems, networks, and technology tools provided by the “Company” are work tools owned by the organization. Their use may therefore be subject to reasonable supervision and monitoring for the purposes described above, without an expectation of privacy regarding information generated, stored, or transmitted through those technology resources.

Information collected through these mechanisms will be stored securely, either on the “Company’s” own technology infrastructure or through technology services authorized by the “Company,” and will be retained only for the time necessary to fulfill information security, regulatory compliance, and applicable legal responsibility purposes.

SECONDARY Purposes of Processing

Your personal data may be processed for the offering and promotion of goods, products, and services and/or for marketing and commercial prospecting purposes, both by the Company and by business partners offering complementary services, provided that you consent to that purpose.

Transfers of Personal Data

The Company informs you that it will transfer your personal data to third parties for the PRIMARY purposes described in this Notice. These transfers will be made to service providers; regulatory, government, and judicial authorities; and social security institutions (to comply with applicable rules, including employment and social security laws, statistical studies, and the prevention and detection of transactions involving unlawfully obtained funds).

The Company may also transfer your personal data to third parties for the SECONDARY purposes set out in this Notice. Your tacit consent to such a transfer will be understood to have been granted if you do not object when the Privacy Notice is made available, where the data is collected directly or in person, or by email addressed to the Company’s Privacy Officer.

If the Company were to transfer financial or sensitive personal data for SECONDARY purposes or for any other purpose not included in this Notice, the Company will inform you and, where applicable, obtain your express or written consent, as required.

Personal data collected for primary purposes will be duly protected by the Data Controller. Once those purposes have been fulfilled, the data will be blocked and subsequently erased. During the blocking period, which will last seventy-two months from the date on which the processing purposes end, the data may not be used. After that period, the data will be permanently deleted from the databases of both the Data Controller and Third-Party Controllers.

Means of Exercising “ARCO” Rights

You may request from the Company, directly or through a representative, access to, rectification of, or cancellation of personal data concerning you, or object to its processing, by sending the form entitled “Exercise of ARCO Rights” to the Privacy Officer (which may be downloaded from https://whipsolutions.com.mx for use in the Human Resources section), together with the documentation specified in the form.

Exercising ARCO rights allows you to request the following from the Company:

Access

The data subject may request that we disclose the personal data processed by the Company. The Company may provide that data in simple printed copies or by electronic means.

Rectification

The data subject may request that the Company rectify one or more items of personal data, for which the data subject must provide documentary evidence supporting the rectification.

Objection

The data subject may object to the processing of personal data for a particular purpose, bearing in mind that processing for PRIMARY purposes is essential to fulfill the Company’s obligations arising from the insurance contract and the laws governing it.

Cancellation

The data subject may request cancellation of personal data processed by the Company, provided that the data is no longer used for the relationship established with the data subject and the Company is not required by law to process it for a minimum period. The following procedure will apply: cancellation of the personal data entails a blocking period, after which the data will be deleted. During that period, the Data Controller may retain the data only to address possible liabilities arising from its processing. The blocking period will correspond to the limitation period for legal actions related to the legal relationship that gave rise to the processing. Once the cancellation process is complete, the Data Subject or their representative will be notified. Exercising ARCO rights is free of charge; however, the “Company” may charge the data subject only justified shipping expenses or costs of reproducing the requested information.

Once your request has been submitted using the form and with all required documentation, the “Company” will inform the data subject of its decision within a maximum of 20 (twenty) days. If the request is granted, the decision will be implemented within 15 (fifteen) days after the response is communicated.

If the exercise of ARCO rights does not proceed, in whole or in part, under the grounds established in Article 33 of the Federal Law on Protection of Personal Data Held by Private Parties, the Data Controller may deny the request or fulfill it in part. In that case, the Data Controller will inform the Data Subject or their representative of the reasons for its decision, using the same means of contact and within the established deadlines, and will attach supporting evidence where applicable.

Means of Limiting the Use and Disclosure of Personal Data

Because processing your personal data is essential for activities and obligations inherent to the Employment Contract and for compliance with the legal provisions to which the Company is subject, its use cannot be limited with respect to the PRIMARY purposes established in this Notice.

Nevertheless, to limit the use and disclosure of your personal data for the SECONDARY purposes established in this Notice, you must notify the Company’s Privacy Officer by email at privacidad_whip@whipsolutions.com.mx. You may also request that your data be added to the Company’s exclusion lists to restrict its use and processing for Secondary Purposes.

When we collect your personal data through electronic means (Internet), the Company may automatically extract information it considers necessary for statistical and commercial prospecting purposes.

Withdrawal of Consent

You may withdraw any consent you have given us to process your personal data by emailing the Company’s Privacy Officer. It is understood that withdrawal may result in termination of the Employment Contract if it concerns data that must be processed for PRIMARY Purposes.

Security Measures for the Processing of Personal Data

The “Company” has adopted effective and corrective administrative, technical, and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, both by the Data Controller and by any third party involved in its processing, while ensuring compliance with this Privacy Notice at all times.

Means of Communicating the Privacy Notice and Amendments

This Privacy Notice and any amendments to it will be available on the website https://whipsolutions.com.mx, to which this notice is attached with respect to Human Resources until it has independent access, as well as in notices displayed in our offices, without prejudice to additional communication to you by any other means.

Contact Details of the Company’s Privacy Officer

EMAIL: privacidad_whip@whipsolutions.com.mx

ADDRESS: Calle Ixcateopan No. 104, Colonia Letrán Valle, Benito Juárez, C.P. 03650, Mexico City, Mexico.

Consent to the Privacy Notice

Having read and received an explanation of this Privacy Notice, I give my express consent to the processing of my sensitive health, financial, and asset-related personal data in the cases described above, which will be used solely for the purposes set out in this Privacy Notice. Likewise, I give my express consent to the transfer of my personal data under the terms of this document.

Last updated: March 31, 2026.