PROMOCIONES HABI S.A de C.V.

PRIVACY NOTICE

1. PARTY RESPONSIBLE FOR THE PROTECTION OF YOUR PERSONAL DATA

The legal entity PROMOCIONES HABI S.A. DE C.V., with address at Avenida Venustiano Carranza No. 2319, Interior 101, C.P. 78220, San Luis Potosí, S.L.P., Mexico, is responsible for the processing of your personal data.

Throughout this notice, it shall be referred to as the Responsible Party.

For the purpose of receiving any notifications regarding the rights of access, rectification, cancellation, opposition, or revocation contained in Chapters XIII, XIV, and XV of this Privacy Notice, the Responsible Party provides the following contact information:

Address: The one specified in the first paragraph of this Privacy Notice
Email: atencion@habi.com.mx
Official Website: www.habi.com.mx
Phone: 444 817 7771

1. DATA SUBJECT

The Data Subject is any natural person whose personal data is provided to the Responsible Party, such as prospects and/or clients for housing purchases, employees, suppliers, etc., who will hereinafter be referred to as the Data Subject.

III. GLOSSARY

For the purposes of this Privacy Notice, the following terms shall be understood as:

Privacy Notice: A physical, electronic, or any other form of document generated by the Responsible Party, made available to the Data Subject prior to the processing of personal data, pursuant to Article 15 of the Law.

Database: The organized set of personal data referring to an identified or identifiable individual.

Consent: The Data Subject’s expression of will whereby the processing of their personal data is carried out.

Personal Data: Any information concerning an identified or identifiable natural person.

Processor: Any individual or legal entity that, alone or jointly with others, processes personal data on behalf of the Responsible Party.

Law: Federal Law on the Protection of Personal Data Held by Private Parties.

Guidelines: Guidelines of the Privacy Notice.

Direct collection of personal data: When the Data Subject provides personal data directly through electronic, optical, sound, visual, or any other technology (postal mail, internet, telephone, etc.).

Indirect collection of personal data: When the Responsible Party obtains personal data without the Data Subject providing it directly (e.g., public sources or transfers).

In-person collection of personal data: When the Data Subject provides personal data personally in the physical presence of the Responsible Party or its designated individual.

1. SENSITIVE PERSONAL DATA OBTAINED FROM PROSPECTS OR CLIENTS

According to Article 16 of the Law and Section III of the Guidelines, the following are considered sensitive data:

1. a) Marital status
   b) Marital property regime
   c) Educational background
   d) Employment information (employer name, address, phone number, employer registration)
   e) Payment method (credit, SBV balance, voluntary savings, subsidy, down payment, remaining balance, total)

1. PURPOSES FOR PROCESSING PERSONAL DATA OF PROSPECTS OR CLIENTS

Personal data will be used solely for the following purposes:

1. a) To carry out all necessary actions for entering into a housing purchase agreement
   b) To enter into a preliminary reservation agreement
   c) To verify with INFONAVIT whether the Data Subject is eligible for a mortgage loan and for what amount
   d) To verify with FOVISSSTE whether the Data Subject is eligible for a mortgage loan and for what amount
   e) To conduct credit checks with credit information companies (credit bureau)
   f) To transfer data to entities or third parties that require them for loan authorization
   g) To transfer data to the corresponding Public Notary for the housing purchase process
   h) To carry out the necessary Remissions and Transfers among Processors, Third Parties, and the Responsible Party
   i) To transfer or remit data to attorneys or accountants when necessary
   j) To send commercial information regarding products offered by the Responsible Party
   k) To maintain a database of clients or prospects for housing sales

Purposes (a)–(i) are necessary for the existence, maintenance, and fulfillment of any legal relationship between the Data Subject and the Responsible Party.

Purposes (j)–(k) are not essential, and the Data Subject may object to them.
The Data Subject has five business days from learning of this Privacy Notice to express such objection.

VII. PERSONAL DATA COLLECTED FROM SUPPLIERS OR SERVICE PROVIDERS

1. a) Name
   b) Phone
   c) Email
   d) Address
   e) Bank account information

These data are obtained in-person, directly, and/or indirectly, as described in Chapter IV.

VIII. PURPOSES FOR PROCESSING PERSONAL DATA OF SUPPLIERS / SERVICE PROVIDERS

1. a) For the purchase and contracting of products/services offered by the supplier
   b) To ensure fulfillment of the delivery or service
   c) To carry out all actions needed for entering into a purchase or service agreement
   d) To request tax invoices or receipts
   e) To make payments or transfers
   f) To transfer data to entities requiring them for credit authorization
   g) To transfer data to the corresponding Public Notary
   h) To transfer or remit data to accountants for tax purposes
   i) To perform necessary Remissions and Transfers
   j) To maintain a supplier database

Purpose (k) is not essential and the Data Subject may object within five business days.

1. PERSONAL DATA COLLECTED FROM EMPLOYEES / COMMISSION-BASED WORKERS

Includes (translated exactly):

1. a) Name
   b) Phone
   c) Address
   d) Age
   e) Email
   f) Marital status
   g) Illnesses
   h) Pregnancy
   i) Social Security Number
   j) INFONAVIT Code
   k) Employment references
   l) Personal references
   m) Education
   n) Copy of Social Security registration
   o) Birth certificate
   p) Voter ID
   q) Proof of address
   s) Child-sized photograph
   t) CURP
   u) Professional license (if applicable)
   v) Previous payroll receipt
   w) INFONAVIT credit documentation (if applicable)
   x) Bank account
   y) Curriculum Vitae
2. PURPOSES FOR PROCESSING DATA OF EMPLOYEES / COMMISSION-BASED WORKERS
3. A) To manage everything related to the employment or commission contract and the resulting employment or commercial relationship.

Data is obtained in-person, directly, and/or indirectly, as described earlier.

1. SENSITIVE DATA OF EMPLOYEES / COMMISSION-BASED WORKERS
2. a) Marital status
   b) Illnesses
   c) Pregnancy
   d) Education
   e) Criminal background check

XII. MEASURES TO LIMIT USE OR DISCLOSURE OF DATA

The Responsible Party, its Processors, and Third Parties under confidentiality agreements will use the data solely for the purposes of this Notice.
Security measures and staff training are implemented to protect personal data.

XIII. RIGHTS OF ACCESS, RECTIFICATION, CANCELLATION, AND OPPOSITION (ARCO RIGHTS)

The Data Subject or legal representative may request ARCO rights at any time. Requests must include:

1. a) Name and address for notifications
   b) Identification or proof of representation
   c) Clear description of data and the right to be exercised
   d) Additional information to locate data
   e) For rectification, supporting documents
   f) Legal basis for the request

The Responsible Party will respond within 20 business days, and if applicable, will enforce the request within 15 business days.

The Responsible Party may deny requests in the following cases:

• The applicant is not the Data Subject or legal representative
• Data cannot be found
• Third-party rights are affected
• A legal or judicial restriction applies
• The request was previously executed

XIV. REQUESTS FOR ACCESS TO PERSONAL DATA

Data may be provided in simple copies or electronic documents upon identity verification.

1. REVOCATION OF CONSENT

The Data Subject may revoke consent at any time following the same procedure as ARCO requests.

XVI. DATA TRANSFERS

Personal Data may be transferred, domestically or internationally, when:

1. a) Required by entities, authorities, or organizations for credit authorization
   b) Required by attorneys, accountants, Public Notaries, or authorities for housing purchase processes

Consent is not required for these transfers (Article 37, Section VII of the Law).

XVII. MODIFICATIONS TO THIS PRIVACY NOTICE

The Responsible Party may update this Notice due to legal changes or internal needs.
Modifications will be communicated personally, by email, or via the official website.

XVIII. LEGALITY

This Privacy Notice complies with Articles 8, 9, 15, 16, 28–37 of the Law; relevant sections of the Regulations; and the Guidelines.
For further information, you may contact the Responsible Party using the contact details provided above.

XIX. IMPLIED CONSENT

For non-sensitive personal data, if the Data Subject does not express opposition within five business days, consent will be deemed granted.

This Privacy Notice was prepared by Peláez Barrera y Asociados, S.C. for HABI SERVICIOS, S.A. DE C.V., and is protected under the Federal Copyright Law. Any reproduction or distribution without written authorization is prohibited.

Habi is a real estate developer that transforms lives by offering well-located, accessible homes with financing options, focused on the well-being of Mexican families.

Facebook | LinkedIn | Instagram

Contact:
Phone: 444 817 7771
Email: atencion@habi.com.mx
Address: Paseo de los Horizontes 418, Horizontes, 78183 San Luis Potosí, S.L.P.