LEGAL DOCUMENT

Integral Privacy Notice

FINNEX CAPITAL, S.A.S. · Version 1.0 · Last updated: September 19, 2026

FINNEX CAPITAL, S.A.S., with address at Avenida Bernardo Quintana 405, Colonia La Loma Santa Fe, Álvaro Obregón, C.P. 01219, Mexico City, Mexico, is responsible for processing personal data under this Privacy Notice.

This English version is provided for accessibility to international users. In the event of an inconsistency, the Spanish version will prevail to the extent permitted by applicable law.

1. Scope

This Notice applies to personal data processed through finnex.mx, forms and intake processes, portals, onboarding, FINNEX OS, electronic communications, meetings, contracts and other FINNEX-related interactions.

2. Personal data processed

FINNEX may process identification and contact data, professional and employment information, corporate and relationship data, financial and patrimonial data, tax and compliance information, operation, project or transaction information, and technical or usage data. FINNEX does not ordinarily request sensitive personal data unless necessary and legally appropriate.

3. Primary purposes

Data may be used to identify and authenticate users; manage onboarding and relationships; verify information; assess capital needs and readiness; evaluate eligibility, structuring and matching; manage due diligence, negotiations and contracts; make controlled disclosures; maintain communications; meet legal, commercial and administrative obligations; prevent fraud and protect systems; respond to authority requests; and operate and secure FINNEX technology environments.

4. Secondary purposes

Where applicable, FINNEX may use data for institutional information, content, news, event invitations, prospecting and product or service communications. These purposes will be separate and optional where required by applicable law, and refusal will not condition unrelated services.

5. Consent

FINNEX will obtain implied, express or written express consent depending on the data, purpose and applicable legal exceptions. Where legally required and no exception applies, processing financial or patrimonial personal data requires express consent. Sensitive data, when exceptionally necessary, is subject to applicable formalities. Consent may be revoked as provided by law.

6. Transfers and processors

FINNEX does not sell personal data. Legally permitted or consented transfers may be made to investors, funds, financial institutions, financiers, structurers, advisers, affiliates, authorities or other counterparties necessary to evaluate, structure, negotiate or execute an opportunity or relationship. FINNEX may also use processors and providers for cloud, hosting, databases, authentication, storage, email, support, security, electronic signatures, analytics and technology platforms.

7. Sources

Data may be obtained directly through the website, portals, forms, intake processes, FINNEX OS, communications and meetings, or through authorized sources and technology providers in the relevant context.

8. Cookies and similar technologies

FINNEX may use technologies necessary for session management, security, site functionality and technical measurement. This version of the Notice does not contemplate use of personal data for behavioral advertising or remarketing.

9. Security, confidentiality and retention

FINNEX maintains reasonable administrative, technical and organizational measures to protect personal data. Information is retained for the period necessary to meet stated purposes and legal or contractual obligations, then blocked or deleted as appropriate.

10. Privacy rights, revocation and limitation

Data subjects may request access, rectification, cancellation or objection, revoke consent, or limit use or disclosure where applicable. For privacy and personal-data matters, contact contact@finnex.mx. Requests should identify the data subject, the right being exercised and the relevant data or processing, together with information needed to verify identity or representation where appropriate.

11. Minors

FINNEX services are not directed to minors and FINNEX does not intentionally seek to collect their personal data. If information relating to a minor is identified without an adequate legal basis, appropriate measures will be taken.

12. Changes

FINNEX may amend this Notice to reflect legal, regulatory, operational or technological changes. The current version, date and related documents will be available through the FINNEX Legal Center.

Simplified Privacy Notice

FINNEX CAPITAL, S.A.S. is responsible for personal data collected to manage contacts and relationships, assess and structure opportunities, conduct onboarding and due diligence, operate its platforms, and meet legal and security obligations.

Where applicable, separate secondary purposes may include institutional communications, content, events and prospecting. The Integral Notice and privacy-rights channel are available through contact@finnex.mx and the FINNEX Legal Center.

Version 1.0 · 2026-09-19 · contact@finnex.mx