Privacy Notice

Last Updated: July 27, 2026.

App Where, S.A. de C.V., located at Poniente 140 No. 839, Suite 204, Col. Industrial Vallejo, C.P. 02300, Azcapotzalco, Mexico City, Mexico, is responsible for the use and protection of your personal data.
Accordingly, we inform you of the following:

Personal data protected under the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and collected by App Where, S.A. de C.V. will be processed with the utmost responsibility by the Company, its employees, and collaborators for the purpose of properly providing the services for which we are engaged.

What purposes do we use your personal data for?

The personal data we collect from you may be used for the following purposes:

• To contact you.
• To provide information about our services, products, and events, when requested.
• To inform you about updates, new products, or new services.
• To send you promotional information via email, when requested.
• To follow up on your comments, suggestions, and feedback.
• To create and distribute promotional announcements, when applicable.
• To understand your experience while using our website.
• To develop marketing strategies, when applicable.

If you do not wish your personal data to be processed for these purposes, please refrain from providing such information, as submittingyour personal data implies acceptance of the terms of this Privacy Notice.

Refusing the use of your personal data for these purposes will not prevent us from providing the products or services you request or contract with us.

What personal data do we collect?

As a visitor, you are not required to provide personal information to use our website. This website only collects personal information that is voluntarily provided through our contact section.

Information collected through the contact form may include, but is not limited to:

• Full name.
• Email address.
• Landline telephone number.
• Mobile phone number.

With whom do we share your personal information and for what purposes?

App Where, S.A. de C.V. transfers personal data only to individuals or legal entities that collaborate in providing the services for which we have been engaged.

Any sensitive personal data transferred to us is handled responsibly and treated with the highest level of confidentiality.

App Where, S.A. de C.V. safeguards your personal data against damage, loss, destruction, theft, unauthorized access, alteration, or misuse.

App Where, S.A. de C.V. will not sell, assign, or transfer your personal data to third parties unrelated to the Company without your prior express consent.

However, App Where, S.A. de C.V. may transfer your personal data whenever such transfer is expressly authorized or required by applicable law.

Data Protection Officer

The Privacy Department is responsible for handling requests related to the protection of personal data and for promoting compliance with applicable privacy regulations.

How can you access, correct, delete, or object to the use of your
personal data?

You have the right to know what personal data we hold about you, how we use it, and the conditions under which it is processed (Right of Access).

You also have the right to request:

• The correction of your personal information if it is outdated, inaccurate, or incomplete (Right to Rectification).
• The deletion of your personal data from our records or databases when you believe it is not being processed in accordance with the principles, duties, and obligations established by applicable law (Right to Cancellation).
• To object to the processing of your personal data for specific purposes (Right to Object).

Collectively, these rights are known under Mexican law as the ARCO Rights.

As the data subject, you may submit a request to the Privacy Department to exercise your Rights of Access, Rectification, Cancellation, or Objection.

Your request must include at least the following information:

• Your full name, address, telephone number(s), email address, or any other means through which we may communicate our response.
• Documentation proving your identity or, where applicable, the legal authority of your representative.
• A clear and precise description of the personal data with respect to which you wish to exercise any of your ARCO Rights.
• Any additional information or documentation that facilitates the identification of your personal data.
• A description of the requested corrections or restrictions regarding the processing of your personal data.
• Supporting documentation, when applicable.

Response and Notification

App Where, S.A. de C.V. will communicate its decision regarding your request within a period not exceeding twenty (20) calendar days from the date your request is received.

This period may be extended once for an additional period of equal length whenever justified by the circumstances.

In accordance with applicable law, App Where, S.A. de C.V. will notify the data subject of its decision and the reasons supporting it through the same communication channel used to submit the request, including any supporting documentation when applicable.

If the request is deemed appropriate, the corresponding action will be carried out within fifteen (15) calendar days following notification of the decision.

This implementation period may also be extended once for an additional period of equal length whenever justified by the circumstances.

Grounds for Denying an ARCO Request

App Where, S.A. de C.V. may deny, in whole or in part, a request to access, correct, delete, or object to the processing of personal data under the following circumstances:

• The applicant is not the data subject or fails to provide sufficient evidence of legal representation.
• The requested personal data cannot be found in the databases of App Where, S.A. de C.V.
• Granting the request would infringe upon the rights of a third party.
• There is a legal impediment or an order issued by a competent authority.
• The requested rectification, cancellation, or objection has already been completed, making the request no longer applicable.

Consequences of Data Deletion

The cancellation of personal data will result in a temporary blocking period, after which App Where, S.A. de C.V. will permanently delete the corresponding personal data.

Once the personal data has been deleted, App Where, S.A. de C.V. will notify the data subject accordingly.

If personal data has previously been shared with third parties before the request for correction or deletion, App Where, S.A. de C.V. will inform those third parties of the request so that they may proceed with the corresponding correction or deletion, where applicable.

App Where, S.A. de C.V. shall not be required to delete personal data in the cases expressly provided for under Article 26 of the Mexican Federal Law on the Protection of Personal Data Held by Private Parties.

Likewise, when personal data is no longer necessary to fulfill the purposes described in this Privacy Notice or required under applicable law, such personal data will be permanently removed from the Company’s databases.

How can you withdraw your consent for the processing of your personal data?

You may withdraw the consent you have previously granted for the processing of your personal data at any time.

However, please note that in certain cases we may not be able to comply with your request immediately, as we may be legally required to continue processing your personal data.

Likewise, you should be aware that withdrawing your consent for certain purposes may prevent us from continuing to provide the products or services you have requested or may result in the termination of our relationship with you.

As the data subject, you may submit a request to the Privacy Department to withdraw your consent for the processing of your personal data.

Your request must include, at a minimum:

• A written request indicating your intention to withdraw consent.
• Your full name, address, telephone number(s), email address, or any other means through which we may communicate our response.
• Documentation proving your identity or, where applicable, the legal authority of your representative.
• Any additional information or documentation that facilitates the identification of your personal data.

Response and Notification

App Where, S.A. de C.V. will communicate its decision within a period not exceeding twenty (20) calendar days from the date the request is received.

This period may be extended once for an additional period of equal length, provided that the circumstances justify such extension.

The decision will be communicated through the same channel used to submit the request and, when applicable, will include the corresponding supporting documentation.

If the request is granted, the corresponding action will be implemented within fifteen (15) calendar days following notification of the decision.

Grounds for Denying the Withdrawal of Consent

App Where, S.A. de C.V. may deny a request to withdraw consent under the following circumstances:

• The applicant is not the data subject or has not provided sufficient evidence of legal representation.
• The requested personal data cannot be found in the Company’s databases.
• The withdrawal of consent has already been processed, rendering the request no longer applicable.

How can you limit the use or disclosure of your personal information?

To help you limit the use or disclosure of your personal information, we provide the following mechanism:

Exclusion List

You may request to be included in our exclusion list so that your personal data will not be used for marketing, advertising, or commercial prospecting purposes.

As the data subject, you may submit a request to the Privacy Department to restrict the processing of your personal data.

Your request must include, at a minimum:

• Your full name, address, telephone number(s), email address, or any other means through which we may communicate our response.
• Documentation proving your identity or, where applicable, the legal authority of your representative.
• A clear and precise description of the personal data that you do not wish to be processed, or the specific purposes for which you do not wish your personal data to be used.
• Any additional information or documentation that facilitates the identification of your personal data.

If you require additional information or have any questions regarding the processing of your personal data, you may contact our Privacy Department using the contact information provided in this Privacy Notice.

How will you be informed about changes to this Privacy Notice?

This Privacy Notice may be amended, updated, or modified from time to time as a result of:

• Changes to applicable legal or regulatory requirements.
• Updates to our products or services.
• Changes to our privacy practices.
• Changes to our business model.
• Any other applicable circumstances.

We are committed to keeping you informed of any modifications to this Privacy Notice through our official website.

Whenever changes are made, the revision date will be updated, and such modifications will become effective as of the published revision date.

We encourage you to review this Privacy Notice periodically to stay informed about how we collect, use, and protect your personal information.

This Privacy Notice is governed by the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) of Mexico.