PERSONAL DATA PROTECTION POLICY

​EDULAG SA DE CV, in an effort to safeguard the fundamental right to protection of our customers, suppliers and members of the organization with respect to the processing of their information, the right

of each individual to know and decide who and how to collect, use and share their personal data, as well as the power of disposal and control to decide which of their data provided to a third party, created

this policy to establish the necessary controls and procedures for this purpose.

OBJECTIVE

Establish guidelines to regulate and orient staff to comply with the principles established by law, in order to guarantee the proper handling of personal data custody and privacy.

SCOPE

The following policy is of general observance and applies immediately from the date of issue. Ignorance of this does not absolve anyone from compliance.

DEFINITIONS

Privacy notice: a physical, electronic or any other format document generated by the person responsible for it that is made available to the owner, prior to the processing of personal data, in accordance with article 15 of this law.

Database: the ordered set of personal data of a person.

Consent: Manifestation of the will of the data owner, by which it is treated as such.

Personal data: any information relating to an identified or identifiable natural person.

Sensitive personal data: personal data that may affect the most intimate sphere of the data subject, or whose misuse may lead to discrimination or entail a serious risk for the data subject. In particular, they are considered sensitive and may reveal aspects such as racial or ethnic origin, state of health, present and future, genetic information, religious, philosophical and moral beliefs, membership of the Union, political views, sexual preference.

ARCO rights: These are the rights of access, cancellation and opposition.

The law: Federal Law on the Protection of Personal Data held by individuals.

Regulation: The regulation of the Federal Law on the Protection of Personal Data held by

private individuals Third: The natural or legal person, national or foreign, who is not the owner or the person responsible for the data.

Owner: The natural person to whom the personal data correspond

Processing: The collection, use, disclosure and storage of personal data, by any means. Use includes any action to access, handle, transfer, use or provide personal data

Transfer: Any communication of data made to a person other than the person responsible for or in charge of the processing.

Guidelines: Privacy notice guidelines. Source: Federal Law on the Protection of Personal Data held by Private Individuals / Regulation of the Federal Law on the Protection of Personal Data held by Private Individuals

COLLECTION OF PERSONAL DATA

EDULAG SA DE CV obtains, stores and processes your personal data in accordance with the commercial (customers and suppliers) and employment (members of the Organisation) relationship, the services provided or received, as well as any request or contact made with EDULAG SA DE CV

It is important that when you provide personal data to EDULAG SA DE CV, it belongs to either the representative of the owner of the data or the person authorized to provide it. Similarly, and for better care and greater protection of your data, it is necessary that the personal data provided to EDULAG SA DE CV be correct, complete, true, exact and current. In the event of any error or update, please inform us carefully in accordance with the contents of this policy.

In the event that any form indicates that some data is optional, it will be your decision to provide it. These data will be used to facilitate the provision of the service and the best adaptation of it.

The treatment of personal data must not contravene any of the regulatory provisions established by law; it must be done with adherence and compliance with Mexican and international law.

The processing of personal data should respond to what has been agreed upon, taking into account the reasonable expectation of privacy, without causing any prejudice to the interests of the owner. There should be

are not misleading or fraudulent means of collecting and processing personal data.

It follows that the following should be understood as fraudulent actions:

That there is fraud, bad faith or negligence in the information provided to the data subject. That the reasonable expectation of privacy of the holder is violated.

The purposes are not the same as those reported in the privacy notice.

The personal data processed must be the minimum necessary to fulfill the purpose for which it was collected; it must be correct, accurate, complete, relevant and updated, according to the purpose for which it was collected.

Among the personal data that EDULAG SA DE CV obtains from its users, customers, suppliers or any other person related to its services can be found in the following classification:

-ID: full name, e-mail address, address, telephone number, mobile number, signature, date of birth, age, nationality, RFC, social security, CURP, marital status, sex, ID number, INFONAVIT number, among others.

* ACADEMICS: level of education, degree, certificate, among others.

* ECONOMIC AND FINANCIAL: credit card or bank account information, data among others. Identification and active data are necessary for the provision of EDULAG SA DE CV services.

The processing of personal data must be the only one necessary to comply with the determined and legitimate purpose that is noted in the privacy notice in a clear and objective manner, which originates and is necessary for the legal relationship with the holder.

Collection, consent and processing of the data must be provided by the data subject, who must be free, specific, informed and unambiguous; the data subject must be informed through the privacy notice of the main purposes and objectives of the processing to be done with the personal data collected.

HOW WE PROTECT YOUR PERSONAL DATA.

EDULAG SA DE CV. has the appropriate security, technical and physical means and measures in place to protect your personal data in order to prevent its loss, damage, destruction, alteration or unauthorised use, processing or access.

The personnel of EDULAG, SA DE CV who handle, use, collect or transfer personal data at any stage of the processing thereof, are obliged to maintain secrecy, discretion and confidentiality and custody over them.

The personnel of EDULAG SA DE CV are duly trained and committed to handling your personal information, preserving its confidentiality and privacy.

It is strictly forbidden to copy, destroy, use, access, treat, damage, alter or modify without authorization the personal data provided by the owners.

EDULAG SA DE CV. Is a company committed to the security of your data and the provision of a quality service, so, aware of technological development and the risks involved, undertakes to implement and maintain the necessary security measures, appropriate and optimal for the purpose, to avoid as far as possible any risk that may affect your personal data. In the event of any risk, situation EDULAG SA DE CV. will immediately adopt the appropriate procedure for the solution of the problems that arise.

All requests that the holder to exercise his right of ARCP, must be directed and attended exclusively by the Manager of the Department of Personal Data Protection.

PENALTIES

As stipulated in the Law and Regulations, the following sanctions are established:
Causing a violation of the security databases in your custody, from 3 months to 3 years in prison.
Processing of personal data by deception, taking advantage of the error of the owner or administrator, from 6 months to 5 years of imprisonment.
For sensitive personal data, the penalties will be double those established above.