Privacy Notice for the users of our product

Who are we? (Identity and address of the Responsible)

Truface, S.A.P.I. de C.V., (“Trully” or “The Responsible”) in compliance with the Mexican Federal Law for the Protection of Personal Information in Possession of Private Entities and its Regulations (both together, the “Law”), with address in Rio Lerma 94, 3rd Floor, Cuauhtémoc. 06500. Mexico City, Mexico. This address is also valid to hear and receive notifications.

Definitions

• Personal data: Any information concerning an identified or identifiable natural person.
• Holder: The natural person to whom the personal data identifies or corresponds.
• Responsible: Natural or legal person of a private nature who decides on the processing of personal data.
• Treatment: Obtaining, using (including access, handling, use, transfer or disposal of personal data), disclosure or storage of personal data by any means.

What personal data do we collect?

For users of our website, available at: https://trully.ai

In order to comply with the purposes indicated in this Privacy Notice, Trully will process the following documentation and information: (i) Name; (ii) Email; and (iii) Curricular profile.

In order to comply with the purposes indicated in this Privacy Notice, Trully will process the data listed in the previous paragraph for the purpose of notifying our end customers of the availability of using the identity theft alert product.

In order to comply with the purposes indicated in this Privacy Notice, Trully will process the data stated in the previous paragraph with the purpose of contacting talent for a possible incorporation into our company.

In addition to the above, we obtain information through cookies and similar technologies that help us identify you and differentiate you from other users of our website. These resources will optimize your online experience, not having to fill in information that has already been requested again and will allow us to make improvements to our platform. For more information on this matter as well as for the use of cookies, please consult the section corresponding to the cookie policy that you will also find in the legal documents section of our platform

Treatment purposes

For the User of our website, we will treat your personal data for the following primary purposes:

• Provide you with the required attention in case you communicate by telephone, instant messaging or means of communication established by Trully.
• Manage communications and interactions through our contact form or ChatBot.
• Contact talent for a possible incorporation into the company.

For all holders to whom this privacy notice is addressed, we will use your personal data for the following secondary purposes:

• Send you information about our services, this may include newsletters.
• Send communications regarding the quality of the services provided by Trully.

In the event that you do not want your personal data to be processed for any or all of the secondary purposes, from this moment you can notify us by sending an email to legal@trully.ai CCP: jpaoli@paolibusinesslaw.com

The refusal to use your personal data for secondary purposes may not be a reason to deny you the requested services or to terminate the relationship established with us.

To navigate within the site and share your data, you must necessarily read and accept that you have read this privacy notice available on the website.

Transfer of personal data:

To comply with the purposes that were previously written and others that are required by law or by competent authorities, through a well-founded and motivated request, the following transfers of your personal data will be made:

To our affiliates, controllers, subsidiaries, parent company or companies of the same group and, where appropriate, to competent authorities.

The transfer of personal data can be national and/or international, the transfer of data will be carried out when the competent authorities request it and/or when Trully so decides to fulfill its purpose and its services.

In relation to the transfers that require your consent, if after reading this Privacy Notice, you do not express your rejection for them to be carried out, Trully will take it for granted that you have given us said consent.

If you do not want your personal data to be transferred with respect to those for which your consent is necessary, we ask you to send an email to legal@trully.ai CCP: jpaoli@paolibusinesslaw.com, requesting the revocation of your consent regarding to the processing of your personal data.

Exercise of ARCO rights

Our users have the right to know what personal and/or sensitive data we have about them, what we use them for and the conditions of use we give them (Access). Likewise, it is your right to request the correction of your personal information in case it is outdated, inaccurate or incomplete (Rectification); that we remove it from our records or databases when it considers that it is not being used properly (Cancellation); as well as oppose the use of your personal and/or sensitive data for specific purposes (Opposition). These rights are known as ARCO Rights.

To exercise any of the ARCO Rights, you must submit the respective request in writing, at the address of the Controller or through a data message sent via email to the Controller with a copy to the following email addresses: legal@trully. ai and jpaoli@paolibusinesslaw.com

In order to exercise some of the rights indicated above, we suggest you know the following procedure:

• a) Requirements for submitting a request to exercise the ARCO Rights.

1. Submit the request to the person in charge who owns the personal data, through the means and mechanisms indicated above, with the following information:

• General information. Any request to exercise the ARCO Rights must contain the following information:
• Name of the Owner of the personal data.
• Documents that prove the identity of the Holder (the documents that will be considered valid are indicated in the following number).
• If applicable, the name of the Holder's representative and documents to prove her identity and personality. (The documents that will be considered valid are indicated in the following numeral).
• Address or any means to receive notifications (for example, email).
• Clear and precise description of the personal data that you want to rectify, cancel or oppose to its treatment.
• Description of the right to be exercised or what the Holder requests.
• Where appropriate, documents or information that facilitate the location of personal data, including the area responsible for processing.
• Specific information. In addition to the general information indicated above, depending on the right you wish to exercise, you must include the following information in the request:
• Right of Access: the modality in which you prefer the requested personal data to be reproduced.
• Right of Rectification: the modifications that you request to be made to the personal data, as well as providing the documents that support the request.
• Right of Cancellation: the causes that motivate the request to delete the data from the files, records or databases of the data controller.
• Right of Opposition: the causes or the situation that lead you to request that the processing of your personal data be terminated, as well as the damage or harm that said processing would cause you to continue; or, you must indicate the specific purposes for which you wish to exercise this right.

It is important that you take into account that, if the request does not have the information described above, you can contact the person in charge through the ChatBot in order to share the missing documentation and/or information to exercise your ARCO rights, and you will have 10 days working days, to provide the required information, otherwise your request will be considered not submitted.

When you submit your request, the person in charge must give you an acknowledgment accrediting receipt of it.

2. Prove the identity of the Holder and, where appropriate, that of his representative, as well as the personality of the latter.

The request must be accompanied by a simple copy of an official identification as the Holder of the personal data, as well as of your representative, in case this is the one who submits the request.

For this purpose, valid official identifications will be:

• Valid voting credential, issued by the National Electoral Institute (formerly the Federal Electoral Institute).
• Valid passport.
• Valid professional license with photograph. Electronic professional cards are excluded.
• Current credential from the National Institute for Older Persons.
• The identity of minors may be proven by means of their birth certificate, Unique Population Registry Code, credentials issued by educational institutions or social security institutions, passport, or any other official document used for such purpose, or documentation who exercises parental authority

The accreditation of personality as a legal representative may be done through any of the following mechanisms:

• Power letter signed by a Notary before two witnesses, attaching a simple copy of their official identifications.
• Document signed by a Notary Public.
• Going the Holder and his representative to testify in appearance before the person in charge.

It is important to bear in mind that the identity of the Holder and/or his representative, as well as the personality of the latter, must be duly accredited prior to the exercise of the right in question, if applicable, through the presentation of the original documents mentioned above or a certified copy of the same, for comparison.

b) Deadlines and procedure for dealing with requests to exercise ARCO Rights

Once the application has been submitted and it complied with the requirements described above, the regulated entity before whom it was submitted must do the following:

Within a period of 20 business days, counted from the receipt of the request, it must inform you whether or not the exercise of the requested right proceeds.

In the event that the exercise of the right has proceeded, you must carry out the necessary actions to make it effective, within a period of 15 business days, counted from the day after the previous response was notified.

The aforementioned deadlines can be extended for an equal period, when justified and you are informed of it.

Even if the exercise of the requested right is not appropriate, the regulated entity must respond to the request, explaining the causes of the respective inadmissibility, within the period of 20 business days indicated above.

Authority

If you consider that your right to the protection of personal data has been injured by any conduct or omission on the part of the Responsible Party, or presumes any violation of the provisions of the Federal Law on Personal Data Held by Private Parties, its Regulations and other applicable ordinances , you can file your disagreement or complaint with the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI). For more information, we suggest you visit its official website www.inai.org.mx.

Applicable Law and Jurisdiction

The parties express that this Privacy Notice will be governed by the legal provisions applicable in the Mexican Republic, in particular, by the provisions of the Federal Law on Protection of Personal Data Held by Private Parties, its Regulations and other related regulations. applicable.

Changes to this Privacy Notice

This Privacy Notice may be modified, changed or updated due to new legal requirements, our own needs for the services we offer, our privacy practices, or changes in our operating model or other causes.

We promise to keep you informed about the changes that this Privacy Notice may undergo, through updates to it published directly on our website https://trully.ai.