Comprehensive Privacy Notice

Altumware and AltumTI

Version 2.0 · Effective date: July 1, 2026 · Pursuant to the LFPDPPP published in the Official Gazette (DOF) on March 20, 2025

1. Data Controllers

Altumware, S.C. and AltumTI, S.A. de C.V. (hereinafter, jointly, "Altumware"), Mexican companies operating under a single brand and under common data protection policies and standards, are responsible for processing your personal data in accordance with the applicable Federal Law on Protection of Personal Data Held by Private Parties (the "Law") and its secondary regulations. The responsible company in each case is the one with which you maintain the corresponding commercial, contractual, recruitment, or employment relationship; this notice applies identically to both.

Address for purposes of this notice: Humboldt 1119-D, Col. Mirador, C.P. 64070, Monterrey, Nuevo León, Mexico.

For all matters related to this notice and the protection of your personal data, the group data protection officer may be contacted at: datospersonales@altumware.com.

2. Personal Data We Process

We process only the data that is necessary, adequate, and relevant for the purposes described in this notice, depending on the relationship you have with us:

a) Contacts of clients, prospects, and suppliers (individuals acting on behalf of a company)

Identification and contact data: name, position, company, corporate email, telephone.
Tax and invoicing data of the company they represent: Tax ID (RFC), tax address, bank details for payments and collections.

b) Candidates in recruitment and selection processes

Identification and contact data: name, date of birth, nationality, CURP, email, phone, city of residence.
Academic and employment data: education, certifications, professional background, résumé, portfolio, professional references, salary expectations, and availability.
Results of technical assessments, language evaluations, and interviews.

c) Consultants and employees

Identification data: name, CURP, RFC, Social Security Number, official ID, proof of address.
Financial and asset data: bank account for payroll payment, information required for tax and social security obligations.
Employment data: position, level, assignment history, performance evaluations, training, and certifications.
Data of designated beneficiaries for benefits.

d) Visitors to our website

Browsing data collected through cookies and similar technologies: IP address, browser type, pages visited. You may disable cookies from your browser settings.

Sensitive Personal Data

We do not request or process sensitive personal data for the purposes of this notice, with one exception: with respect to our consultants and employees, we may process health data (disability records, medical certificates) exclusively when necessary to comply with labor and social security obligations. In such cases, we will obtain your express written consent and limit the processing period to the minimum necessary.

3. Purposes of Processing

Necessary purposes (do not require your consent as they arise from the legal relationship we have with you)

To identify you and maintain communication in the corresponding commercial, pre-contractual, or employment relationship.
To provide the contracted services: staffing, project cells, custom development, systems integration, software quality, licensing, and recruitment.
To evaluate profiles and manage recruitment and selection processes, including the presentation of candidates to our clients.
To manage the relationship with consultants and employees: hiring, payroll, benefits, social security, professional development, certifications, and evaluations.
Invoicing, collections, and payments.
To comply with applicable legal, tax, labor, and regulatory obligations, including those derived from the REPSE registry for specialized services.
To respond to requests from competent authorities.

Voluntary purposes (require your consent; you may refuse without affecting the service)

To send you commercial communications, newsletters, and invitations to events about our services.
To retain your résumé and profile for consideration in future vacancies and projects other than the process in which you participated.
To publish testimonials or success stories with your name and image.

If you do not wish us to process your data for voluntary purposes, you may state so at any time by writing to datospersonales@altumware.com. Refusal will not be grounds for denying you services or affect your participation in recruitment processes.

4. Use of Artificial Intelligence Tools

We use artificial intelligence tools to support certain internal processes, for example, organizing and conducting preliminary analysis of information in recruitment processes. No decision that produces legal effects concerning you or significantly affects your rights —such as hiring, assignment, or rejection of a candidacy— is made solely through automated means: a person is always involved. You have the right to object to the automated processing of your data under the terms of section 7 of this notice.

5. Transfers of Personal Data

Your personal data may be transferred, within and outside Mexico, only in the following cases:

Between Altumware, S.C. and AltumTI, as companies of the same group that operate under common data protection policies and standards, when required by the service. This transfer does not require your consent under the Law.
To our clients, when you participate as a candidate or consultant in a process or project with that client. Only the professional information necessary for the evaluation or execution of the service is transferred, and this is a transfer necessary for the legal relationship you request or maintain with us.
To competent authorities, when there is a grounded and justified request or a legal obligation.

Additionally, we share data with service providers (for example, Microsoft cloud and productivity services and Anthropic artificial intelligence services). These providers act as processors on our behalf, not as third-party recipients: they process the data solely in accordance with our instructions and under contractual confidentiality and security obligations, therefore such processing does not constitute a transfer under the Law.

In any transfer other than those above that requires your consent, we will obtain it in advance and will communicate to the third-party recipient this notice and the purposes to which you subjected the processing. If you do not express your refusal through the means indicated in this notice, you will be deemed to have granted your consent for the transfers described herein that legally require it.

6. Means to Limit the Use or Disclosure of Your Data

In addition to refusing voluntary purposes, you may request removal from our commercial communication lists and limit the use or disclosure of your data by writing to datospersonales@altumware.com, indicating your name and the limitation you desire. We will address your request within a maximum period of 20 business days.

7. ARCO Rights and Revocation of Consent

You or your legal representative may exercise at any time the rights of Access (to know what data we have about you and the conditions of its processing), Rectification (to correct inaccurate, incomplete, or outdated data), Cancellation (to delete your data from our files, records, databases, and systems when no longer necessary), and Opposition (to object to processing, including automated processing that significantly affects your rights), as well as to revoke the consent you have granted us.

To exercise them, send your request to datospersonales@altumware.com with the following:

Full name and means to communicate the response to you (email).
Copy of valid official identification or, where applicable, document proving legal representation.
Clear and precise description of the data and the right you wish to exercise.
Any document or information that facilitates locating your data (for example, whether you were a candidate, consultant, or client contact, and during what period).

We will respond within a maximum period of 20 business days from receipt of the complete request and, if applicable, will make it effective within 15 business days following the response. Revocation of consent will not have retroactive effects and will not proceed when processing is necessary to comply with a legal obligation or the existing legal relationship.

8. Retention and Security Measures

We retain your personal data only for the time necessary to fulfill the described purposes and applicable legal obligations (tax, labor, and social security); thereafter, they are blocked and securely deleted. We maintain administrative, technical, and physical security measures to protect your data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, including multi-factor authentication, access controls, encryption in transit, and confidentiality obligations for all our personnel in accordance with our Code of Ethics.

9. Changes to This Privacy Notice

This notice may be amended to reflect legal changes, new services, or new processing practices. Any current version will be published at www.altumware.com/privacy with its update date. If a change involves processing your data for purposes other than those set forth herein, we will obtain your consent again before doing so.

10. Competent Authority

If you believe your right to personal data protection has been violated, you may contact the Secretaría Anticorrupción y Buen Gobierno, the competent authority for personal data protection held by private parties in Mexico.

Annex — Simplified Privacy Notice (for web forms and data collection points)

Text to be placed in contact forms, candidate registration, and data collection points:

Altumware, S.C. and AltumTI, S.A. de C.V., with address at Humboldt 1119-D, Col. Mirador, C.P. 64070, Monterrey, N.L., will process the identification, contact, academic, and employment data you provide for the necessary purposes of addressing your request, managing recruitment processes, and providing our services; and, only with your consent, to send you commercial communications and consider you for future vacancies. We do not collect sensitive data through this means. You may limit the use or disclosure of your data and learn about the transfers provided for in our comprehensive privacy notice, available at www.altumware.com/privacy. To exercise your ARCO rights: datospersonales@altumware.com.

☐ I accept the use of my data for commercial communications and future vacancies (optional).