PRIVACY NOTICE

Last Update: [23/10/2025]

Controller: GRUPO RICORPE SA de CV (EPA DIGITAL or “EPA”), with registered address at Av. Ejército Nacional Mexicano 418, 9th Floor, Polanco V Sección, Miguel Hidalgo, 11550 Mexico City.

1. Identity and Address of the Controller

GRUPO RICORPE SA de CV (EPA DIGITAL or “EPA”), with tax address at Av. Ejército Nacional Mexicano 418, 9th Floor, Polanco V Sección, Miguel Hidalgo, 11550 Mexico City, is the legal entity responsible for the processing of your personal data collected through this website, mobile applications, social networks, and other digital channels.

2. Personal Data Collected

Depending on how you use EPA's website and services, we may collect different types of personal data, including but not limited to:

Data provided directly by you:

• Full name
• Email address
• Phone number (landline or mobile)
• Company or brand you work for
• Job title or position
• Country, state, city
• Physical address (when applicable)
• Billing information (when applicable)
• Other information you voluntarily provide (comments, requests, questions, etc.)

Data collected automatically or through website technologies:

• IP address
• Browser type and operating system
• Pages visited on the site
• Access date and time
• Cookies, pixels, tracking tags, device identifiers, approximate geolocation
• Information on site usage or interactions with advertising campaigns
• Other technical information related to your use of the site, either in aggregated or individual form, as applicable.

Other data provider by letting us access to your Google or Microsoft profile such as:

• Full name
• Email address
• Avatar image

3. Purposes of Processing

Primary purposes (necessary to provide the requested services)

• Identify you as a client or prospect and contact you to provide information about our services, proposals, quotes, or follow-up.
• Process your service request, fulfill the contract or request you have made to us, as well as invoice and charge when applicable.
• Provide support, customer service, and operational/administrative follow-up.
• Carry out internal analyses to optimize our processes, services, and the user experience on the website.
• Use your provided data or information to connect with applicable APIs and download needed or requested information.

Secondary purposes (facilitate the relationship but are not strictly necessary)

• Send you commercial communications, newsletters, promotional or content materials (provided you have given consent).
• Conduct market research, satisfaction surveys, service quality measurement, and improvements to the website or advertising campaigns.
• Send notifications or information about tools and subscription status.
• Personalize content, advertising, and the browsing experience on EPA's site or on external platforms.
• Perform user behavior analysis, segmentation, and implement digital marketing strategies.

If you do not wish your data to be used for these secondary purposes, you may state your objection as indicated in the “ARCO Rights / Objection” section.

4. Transfer of Personal Data

Your personal data may be shared with third parties only in the following cases:

• With providers that render services to EPA, such as hosting platforms, CRM, web analytics, digital advertising, email marketing, technology providers, accounting, invoicing, or administrative management.
• With government entities, authorities, or courts when required by law.
• With other companies within the EPA group, subsidiaries, or affiliates, when necessary to fulfill the purposes described.

We will not sell your personal data to third parties for uses other than those described in this notice.

5. ARCO Rights, Portability, Consent

Revocation, and Processing Limitation You have the rights of Access, Rectification, Cancellation, and Objection (ARCO) with respect to the personal data held by EPA, as well as, where applicable, the rights to data portability, to limit processing, and to revoke consent, in accordance with applicable law. To exercise any of these rights, you must send a request to the email address [contact@passporthub.io] or to the physical address indicated above, providing at least the following information:

• Your full name and a means to notify you of our response (email, physical address, or other).
• A document proving your identity or, as applicable, legal representation.
• A clear and precise description of the data regarding which you wish to exercise your right, or the action you request (access, rectification, cancellation, objection).
• Any other information that EPA may request to verify your identity or proper legal representation.

EPA will respond to your request within a maximum period of 20 business days from receipt of the complete request and, if appropriate, will carry out the requested action within 15 business days following the response, unless there are legal or technical impediments. If your request cannot be fulfilled, we will inform you of the reasons. If you wish to revoke your consent for data processing or limit its use, please note that in some cases this may imply the impossibility of providing certain services or the termination of the contractual relationship.

6. Use of Cookies and Other Tracking Technologies

EPA uses cookies, advertising pixels, remarketing tags, device identifiers, and other tracking technologies for the following purposes:

• Identify you as a user, improve site functionality, and personalize the user experience.
• Analyze site usage, measure the effectiveness of advertising campaigns, segment audiences, optimize conversions and performance.
• Show you advertising that is more relevant to your interests.

Cookies may be first-party or third-party (for example, cookie consent platforms, Google Analytics, Meta Pixel, Tag Manager). You may disable or delete cookies in your browser settings, limit their use via a cookie-blocking add-on, or refuse their processing through the cookie banner; however, if you do so, some site features may be unavailable or limited.

7. Security Measures

EPA employs various administrative, technical, and physical security measures to protect your personal data against damage, loss, alteration, destruction, and unauthorized use, access, or disclosure. These measures are reviewed and updated in accordance with industry best practices (for example, data encryption, restricted access, internal audits, backups, incident management protocols). Even with these measures, please remember that no security system is infallible and EPA cannot absolutely guarantee that unauthorized third parties will not gain access to, misuse, alter, or destroy data.

8. Retention of Personal Data

Personal data will be retained only for the time necessary to fulfill the purpose for which it was collected, unless a specific legal provision requires a longer retention period. Once the data is no longer needed or you request its cancellation, EPA will delete or anonymize it, unless it is required for legal compliance, accounting purposes, or the defense of rights in legal proceedings.

9. Changes to the Privacy Notice

This privacy notice may be modified due to legislative, regulatory, operational, or technological changes at EPA. Any modification will be published on EPA's website (for example, https://epa.digital/aviso- de-privacidad) with the date of last update. If the change is significant, EPA may communicate it via email to those who have registered their address or through a pop-up notice on the site.

10. Contact

If you have questions, comments, requests, or complaints regarding personal data protection, you can contact us via:

• Email: contact@passporthub.io
• Phone: +52 55 5087 2478
• Address:Av. Ejército Nacional Mexicano 418, 9th Floor, Polanco V Sección, Miguel Hidalgo, 11550 Mexico City.
• Opening hours: Monday to Friday, 9:00 a.m. to 6:00 p.m.

Consent Statement:

By entering, browsing, or registering on EPA's website, or by providing your personal data through forms, you expressly consent to EPA collecting, using, storing, disclosing, and transferring your personal data in accordance with this privacy notice and the purposes stated herein. If you do not agree with this notice, we recommend that you do not use the website or provide your personal data.