Comprehensive privacy notice

1. Personal data that will be collected

For the purposes described in this Privacy Notice, BLOOM may collect the following categories of personal data:

2. Identification data

• Full name.
• Company name or corporate name (where applicable).
• Handwritten signature.
• Federal Taxpayer Registry number (RFC), when necessary for the business relationship.

3. Contact data

• Email address.
• Landline or mobile phone number.
• Address, when necessary.

4. Sensitive personal data

BLOOM does not collect or process sensitive personal data for the purposes described in this Privacy Notice. If it were exceptionally necessary to collect sensitive personal data, BLOOM will first request the Data Subject's express, written consent, in accordance with the Applicable Law.

5. Primary purposes of processing

Primary purposes are those necessary for the existence, maintenance, and fulfillment of the legal relationship between you and BLOOM. Your personal data will be used to:

• Establish a contact channel between you and BLOOM.
• Respond to requests for information.
• Prepare quotes.
• Provide information about the services offered by BLOOM.
• Follow up on business inquiries.
• Identify the data subject.
• Maintain communication during the business process.
• Address inquiries, comments, or requests.
• Comply with legal obligations arising from the relationship between the parties.
• Fulfill contractual obligations that may be entered into.

6. Secondary purposes of processing

In addition, BLOOM may use your personal data to:

• Build a database of prospective clients.
• Send information about products and services.
• Carry out marketing campaigns.
• Send electronic newsletters.
• Share invitations to events, webinars, training sessions, or demonstrations.
• Conduct satisfaction surveys.
• Prepare market studies and statistical analyses.
• Develop business and marketing strategies.

7. Objecting to secondary purposes

If you do not want your personal data to be processed for these secondary purposes, you may state so by sending an email to the address indicated in the section on exercising ARCO Rights. Refusing the processing of your personal data for secondary purposes may not be grounds for denying you the requested services.

8. Tacit or express consent

Where the Applicable Law so permits, consent for the processing of personal data may be understood to be given tacitly if the Data Subject does not object after this Privacy Notice has been made available. Where the law requires express consent, BLOOM will request it beforehand.

9. Transfers of personal data

BLOOM may transfer your personal data without requiring your consent in the cases set out in Article 36 of the LFPDPPP, including, without limitation, when the transfer:

• Is necessary to comply with legal obligations.
• Is required by a competent authority.
• Is necessary for the recognition, exercise, or defense of a right in a judicial proceeding.
• Is made to holding companies, subsidiaries, or affiliates under BLOOM's common control, to a parent company, or to any company in the same group operating under the same internal processes and policies.

10. Data processors and confidentiality

BLOOM may also share information with providers of technology, storage, hosting, support, IT infrastructure, communications, marketing, or any other services necessary for its operations, who will act as data processors and will be contractually bound to keep the information confidential and secure. Except for the cases above or those provided by law, BLOOM will not sell, assign, or trade your personal data.

11. Security measures

BLOOM implements reasonable administrative, technical, and physical security measures to protect personal data against damage, loss, alteration, destruction, unauthorized use, access, or processing. Nevertheless, the Data Subject acknowledges that no security system is completely invulnerable.

12. ARCO Rights

You may exercise your rights to:

• Access.
• Rectification.
• Cancellation.
• Objection.

13. Procedure for exercising your rights

You may also revoke the consent given for the processing of your personal data where legally applicable. To do so, you must submit a request addressed to BLOOM's Privacy Department by email to: contact@bloomdev.mx. The request must contain, at a minimum:

• The Data Subject's name.
• An address or email to receive a response.
• Documents proving your identity or legal representation.
• A clear description of the personal data for which you wish to exercise a right.
• Any information that helps locate the data.

14. Response time

BLOOM will respond within the timeframes set out in the LFPDPPP and its Regulations.

15. Revocation of consent

You may revoke the consent given for the processing of your personal data by following the procedure described for exercising ARCO Rights. Revocation will not have retroactive effect and will not apply where a legal obligation prevents it.

16. Limiting the use or disclosure of personal data

You may request that BLOOM limit the use or disclosure of your personal data by sending a request to the Privacy Department. You may also register with the Public Registry to Avoid Advertising (REPEP), administered by the Federal Consumer Protection Agency (PROFECO), where applicable.

17. Use of cookies and similar technologies

BLOOM's website may use cookies, web beacons, and other technologies that allow it to:

• Remember user preferences.
• Improve the browsing experience.
• Obtain usage statistics.
• Measure site performance.

18. Cookie settings

Users may disable these technologies through their browser settings; however, some functionality may be limited as a result.

19. Retention of personal data

Personal data will be kept only for as long as necessary to fulfill the purposes described in this Privacy Notice, as well as for the periods established by applicable law or for as long as a legal relationship exists with the Data Subject. It will thereafter be deleted, blocked, or anonymized in accordance with applicable regulations.

20. Changes to this Privacy Notice

BLOOM may modify or update this Privacy Notice at any time to reflect legislative changes, changes to its internal processes, or new requirements for providing its services. Updates will be made available on this same site or, where applicable, communicated by email.

21. Competent authority

If you believe your right to the protection of personal data has been violated, you may file a complaint with the competent data protection authority, in accordance with applicable law.

22. Acceptance by the Data Subject

By voluntarily providing your personal data to BLOOM, the Data Subject acknowledges having read this Privacy Notice and agrees to the processing of their personal data under the terms set out herein.