PRIVACY NOTICE

In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter the “Law”), its Regulations, and other applicable provisions, we provide you with this Privacy Notice, which informs you about the use, processing, and protection of the personal data we access through our websites, social media, technological tools, and/or as a result of our relationship or potential relationship with you through the use of our products, services, programs, and any related activity.

I. IDENTITY AND ADDRESS OF THE RESPONSIBLE PARTY.

BIOTHEA, SOCIEDAD DE RESPONSABILIDAD LIMITADA DE CAPITAL VARIABLE, S. DE R. L. DE C.V. (hereinafter “the responsible party”), with address located at Porfirio Neri Street Number 4423, Colonia Lomas del Paraíso I, Postal Code 44250 in Guadalajara, Jalisco, Mexico in accordance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties, last amendment published in the Official Gazette of the Federation on November 14, 2025; hereby informs you that it is responsible for the use, access, handling, exploitation, transfer, protection or disposal (hereinafter the “Processing”) of your personal data, and therefore informs you of the following:

II. THE PERSONAL DATA THAT WILL BE PROCESSED.

To carry out the purposes described in this privacy notice and taking into consideration the procedure, service, or matter you wish to carry out, by way of example but not limitation, I require obtaining the following personal data:

A) Identification data of the Holder and/or legal representative: consisting of name, Unique Population Registry Code (CURP), Federal Taxpayer Registry (RFC), address, or any personal or corporate ID data that you provide.

B) Contact details of the Holder and/or their legal representative: consisting of address, email, landline and/or work and/or mobile phone;

C) Commercial data of the Owner: consisting of legal information, trademarks and/or trade names;

D) Tax data: consisting of federal taxpayer registration, tax status certificate, opinion of compliance with tax obligations, tax domicile, use of the digital tax receipt (CFDI), tax regime, payment method and/or email address;

E) Employment data: consisting of employer registration, Social Security and Infonavit contributions, or documents equivalent to the provided personal data regarding employment.

F) Image and Voice Data of the Data Subject and/or their legal representative: consisting of images and audio captured by real-time video surveillance systems, in the event of entering the Controller's premises, as well as images and audio obtained during virtual meetings, video calls, or any other form of communication through electronic or internet means. In addition to the personal data mentioned above, for the purposes stated in this privacy notice, we will use the following personal data considered sensitive, which requires special protection:

G) Financial information and payment method: which may include payment method and/or bank details, if the client is an individual;

III. THE PURPOSES OF THE PROCESSING OF PERSONAL DATA.

The personal data we collect from you, or, if you are a legal entity, from your legal representative (the “Data Subject”), will be used for the purposes mentioned below:

A) Research, Analysis and Registration of Suppliers;

B) Payment of balances and invoices to Suppliers;

C) Comply with legal and tax obligations and requirements of the competent authority;

D) Contracting Services;

E) Protect the property, rights and personnel of the party responsible; and

F) To provide security in our facilities.

“The responsible party” processes the aforementioned personal data based on articles 6, 7, 11, 14, 16 and 22 of the Federal Law on the Protection of Personal Data Held by Individuals.

Images and/or audio obtained through the video surveillance system will not be transferred to third parties, except when such transfer is required by a competent authority in the exercise of its legal powers or is appropriate in terms of the applicable legal provisions.

IV. TRANSFER OF PERSONAL DATA.

Your personal data may be transferred and processed within and outside the country by parties other than the data controller. In this regard, your information may be shared with the Mexican Institute of Industrial Property (IMPI) or with lawyers located in other countries to proceed with the registration and defense of your industrial and intellectual property rights.

If you do not object to the transfer of your personal data, it will be understood that you have given your consent for it.

Transfers of personal data will be carried out by taking the reasonable, necessary and available measures of "the controller" to protect personal data against damage, loss, alteration, destruction or unauthorized use, access or processing.

V. LIMITATION ON THE USE OR DISCLOSURE OF PERSONAL DATA.

The Holder's personal data will be kept strictly confidential, in accordance with the security, administrative, technical, and physical measures implemented by the data controller in its security policies and procedures. Therefore, unlawful disclosure is prohibited, and its use by third parties is limited, as provided in this Privacy Notice. You may at any time choose to limit the use or disclosure of your personal data by exercising your ARCO Rights or by revoking your consent, in accordance with the provisions of this Privacy Notice.

We inform you that we will retain your personal data in accordance with applicable legal, tax, commercial and intellectual property obligations; after that, your personal data will be securely deleted.

VI. THE MECHANISMS, MEANS AND PROCEDURES TO EXERCISE ARCO RIGHTS

You may exercise your rights to access your personal data, rectify it if it is inaccurate or incomplete, cancel it when you consider that it is no longer necessary for the purposes for which it was collected, as well as oppose its processing, directly with “the controller” personally or through the email cmanzo@biothea.tech or on the website https://www.biothea.tech/

For more information on the procedure for exercising your ARCO rights, you can contact the data controller at the email address cmanzo@biothea.tech

VII. CONSENT.

The data subject declares having read and agreed to the terms and conditions of the Privacy Notice made available to them, understanding the purpose of the collection and processing of their personal data, as well as the procedure for exercising their ARCO Rights. By providing information via the internet, telephone, or in person, you consent to this Privacy Notice.

VIII. CHANGES TO THE PRIVACY NOTICE AND HOW TO CONSULT IT.

Any changes to the privacy notice will be communicated to the subjects of data via email to the address that has been provided.