Privacy notice

In compliance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties and other applicable regulations (hereinafter referred to as the "LFPDPPP"), De la Riva Investigación Estratégica, S.C. (hereinafter "De la Riva"), with registered address at Barranca del Muerto No. 348, Colonia Guadalupe Inn, Postal Code 01020, Álvaro Obregón, Mexico City, hereby informs you that it is responsible for the use and protection of your personal data and has the legal and ethical obligation to implement adequate security measures to protect any personal data it may collect.

The personal data we collect from you voluntarily is used to identify you in relation to your participation in any of the processes listed below. This notice also explains the purpose of collecting your data, its intended use, and, where applicable, any transfers of such data and the purpose thereof.

1. Participants in focus groups and interviews (interviewee, respondent or informant, recruiter or moderator)

   Personal data we may request: Name, address, age, home, work and/or mobile phone number, email, marital status, gender, place and date of birth, names of relatives, dependents, beneficiaries, Tax ID (RFC), Unique Population Registry Code (CURP). Professional data such as occupation, education level, position, department, work address, work email, employment references, personal references, academic history.

   Purpose: Conducting market research studies, record keeping, statistics and data analysis on various topics; preparation of reports and market and statistical analysis; opinion polls on products, goods, services, people, brands, trade names or any other matter relevant to the study, report or survey in question; contacting you to participate in focus groups, in-depth interviews and/or ethnographic studies, either as a participant (interviewee, respondent or informant, recruiter or moderator); contacting you by email to invite your opinion on various topics for the preparation of market research. In some cases, and in addition to the personal data previously mentioned, we may collect sensitive personal data for the purposes stated in this privacy notice. Such data may include: racial or ethnic origin, past and/or present health conditions, political preferences, sexual orientation.

   Third parties to whom your data may be transferred: Companies engaged in market research and business units or related parties within De la Riva Group, which includes Auditor Service, S.C., Lemon Ice Casos Cuantitativos, S.C., Audiencias Sociales, S.A.P.I. de C.V., Inmobiliaria Guate, S.C., Info Design, S.C., High Speed Solutions, S.A. de C.V., as well as subsidiaries, affiliates, and/or parent companies, within or outside of Mexico, for the purposes identified herein.

   Depending on the study, analysis, or research in question, you will be informed if any entity or legal person may receive your personal data.

   To comply with the Mexican Market Research Service Standard (ESIMM) and other rules of the Mexican Association of Market and Public Opinion Agencies (AMAI), De la Riva Investigación Estratégica S.C. may transfer data to said association.

2. Job applicants at De la Riva (Job Board)

   Once your information is received, it is handled exclusively by De la Riva personnel responsible for recruitment.

   Personal data we may request: CV including name, address, age, home, work and/or mobile phone number, email, marital status, place and date of birth; professional data such as occupation, education level, position, department, work address, work email, employment references, and academic history.

   Purpose: To assess candidates’ knowledge, areas of expertise, work experience, and place of residence in order to determine their suitability for a position within the company.

3. De la Riva employees

   Once your information is received, it is handled exclusively by De la Riva’s human resources personnel.

   Personal data we may request: Full name; copy of official photo ID (passport, voter ID, professional license); age; date of birth; copy of birth certificate; address; proof of address (utility bills); copy of military service card (if applicable); marital status; nationality; copy of immigration documents (if applicable); email; personal, work, and mobile phone numbers; RFC; CURP; Social Security Number; education certificates or transcripts; language proficiency certificates; salary, earnings and deductions; copy of IMSS employment status forms; final pay stubs; photographs; personal references; emergency contact details; beneficiary or dependent information, including name, date of birth and identification documents (e.g., birth certificates); CV; previous employment certificates; mortgage credit documents (INFONAVIT); recommendation letters and/or any other documentation or information related to the employment relationship with De la Riva.

   Sensitive data may include current health status, allergies, and blood type.

   Names and general contact details of at least two emergency contacts may also be collected.

   Purpose: To fulfill obligations related to the employment relationship, such as HR management, payroll and benefits administration, bonuses, reimbursements, pensions, insurance, assignment of IT assets and tools, internal audits, email account creation, directory inclusion, issuing credentials, assigning access credentials, ensuring confidentiality obligations are met, verifying personal and employment references, and contacting relatives or beneficiaries in case of emergency.

   If you do not object, De la Riva may also use your personal data for secondary purposes aimed at improving the workplace environment (e.g., sharing announcements and celebrations).

   Third parties to whom your data may be transferred: Banks for payroll purposes or outsourcing companies.

4. Vendors and/or clients

   Personal data we may request: Name, physical address, tax domicile, RFC, tax compliance certificates, and billing information including bank account numbers.

   Purpose: To register you as a vendor or client and to meet legal obligations arising from the business relationship with De la Riva; to prepare orders, service requests, commercial assessments, quotes, and other pre-contractual activities; to conduct business research related to products and services provided.

   Additionally, we may use your personal data to contact you and send you relevant event or topic-related information, as well as for marketing, advertising, or commercial prospecting purposes. If you do not wish your data to be used for these additional purposes, you may let us know by sending your request to mexico@delarivagroup.com

5. Images, Audio, and Video

   In addition to the personal data you provide directly, De la Riva Investigación Estratégica S.C. may collect images and/or audio through surveillance systems and/or audio recordings at our facilities. This data may include, but is not limited to, physical features, voice, behavior, and movements. These systems are implemented based on Article 16 of the Mexican Constitution (which establishes the right to privacy) and the LFPDPPP, allowing the processing of personal data provided the data subject is informed and the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and accountability are upheld.

   Purpose of image/audio data:

   • Security and access control to our facilities

   • Safeguarding the integrity and security of individuals (employees, clients, visitors), assets, and facilities

   • Prevention, detection, and investigation of unlawful acts (theft, vandalism, violence, etc.)

   • Monitoring operations in specific areas to ensure service quality and compliance with internal or external regulations

   • Resolution of labor or legal disputes

   You have the right to request access to your personal data captured in recordings, as well as to request their cancellation or object to their processing, under the terms of this privacy notice.

6. Data Transfers

   In all cases where personal data is collected, recipients are subject to the terms of this Privacy Notice. We will not transfer your personal information to third parties without your consent.

   You may deny consent for data transfers by emailing: mexico@delarivagroup.com

7. Means to Exercise ARCO Rights (Access, Rectification, Cancellation, and Objection) and Revocation of Consent

   You have the right to know what personal data we hold about you, the purpose of its use, and the conditions of its processing (Access). You also have the right to request correction of inaccurate or incomplete information (Rectification), deletion when data is not used as per legal principles (Cancellation), and to object to its use for specific purposes (Objection). These are known as ARCO rights.

   To exercise any ARCO rights, you may send a request by email to: mexico@delarivagroup.com or submit it in person at our office with proper identification and contact information, to the attention of the Talento & Cooltura department, Monday through Thursday from 11:00 a.m. to 5:00 p.m.

   The request must clearly specify the right you wish to exercise and include a detailed description of the personal data involved. For data rectification, include the corrected information. De la Riva will respond within 20 business days. If applicable, data will be updated within 15 business days. De la Riva may extend these deadlines once, with justification.

   We will respond to your request via the email you provide and, where applicable, provide electronic copies of your data.

   You may also revoke your consent to data processing. However, this may not always be possible immediately due to legal obligations that may require continued data processing.

   To revoke consent, follow the same process outlined above. De la Riva will respond within the same timeframes applicable to ARCO rights.

8. Use of Cookies, Web Beacons, and Similar Technologies

   Our website uses cookies, web beacons, and similar technologies to monitor user behavior and enhance your browsing experience.

   Data collected through these technologies may include: Browser type, operating system, websites visited before and after our site, links clicked, time spent on our site, IP address, and general location.

   Your device may accept cookies by default, but you can adjust your browser settings to reject them. Note that if you disable cookies, we may not be able to store your site preferences.

   All personal data collected is protected with technological, physical, and administrative security measures to prevent unauthorized use or disclosure.

9. Changes to the Privacy Notice

   This privacy notice may be modified or updated due to legal requirements, our service offerings, privacy practices, business model changes, or other reasons. We are committed to keeping you informed of such changes via our website: www.delarivagroup.com

   Last updated: July 22, 2025