PERSONAL DATA PROTECTION POLICY

EDULAG SA DE CV, in an effort to safeguard the fundamental right to the protection of our customers, suppliers and members of the organization with respect to the treatment of your information, the right
of every person to know and decide who and how to collect, use and share your personal data, as well as the power of disposition and control to decide which of your information provided to a third party, created
this policy to establish the controls and procedures necessary for this purpose.

OBJECTIVE
Establish guidelines that norm and orient staff to comply to the principles laid down in the law, in order to ensure the proper treatment of the personal data safekeeping and privacy.

SCOPE

The following policy is of general observance and immediate implementation from the emission date of the same. Ignorance of this does not absolve anyone of their compliance.

DEFINITIONS

Privacy Notice: physical document, electronic or in any other format generated by the responsible for that is made available to the holder, prior to the processing of personal data, in accordance with article
15 of this law.

Databases: the ordered set of personal data pertaining to a person.

Consentment: Manifestation of the will of the holder of the data, by which it is treated as such.

Personal data: any information concerning a natural person identified or identifiable.

Sensitive personal data: the personal data that can affect the most intimate sphere of its owner, or whose improper use may lead to discrimination or carries a serious risk to him/her. In particular, are considered
sensitive those who can reveal aspects as racial or ethnic origin, State of health, present and future, genetic information, religious beliefs, philosophical and moral, Union membership, political views, sexual
preference.

ARCO rights: They are the rights of access, cancellation and opposition.

Law: Federal law of protection of personal data in the possession of private individuals.

Regulation: The regulation of the Federal law of protection of personal data in possession of particulars Third: The physical or moral person, national or foreign, other than the holder or the responsible for the
data.

Owner: The natural person to whom personal data correspond

Treatment: The collection, use, disclosure and storage of personal data, by any means. Use includes any action of access, handling, transfer, use or provision of personal data

Transfer: All data communication made to a person other than the person responsible for or in charge of the treatment.

Guidelines: Guidelines of the privacy notice. Source: Federal law of protection of personal data in possession of Particulars / Regulations of the Federal law of protection of personal data in possession of
the Particulars.

COLLECTION OF PERSONAL DATA

EDULAG SA DE CV obtains, stores, and treats your personal data pursuant to the business relationship (customers and suppliers) and labor (members of the Organization), the services provided or received, as
well as any application or contact you make with EDULAG SA DE CV

It is important that when you provide personal data to EDULAG SA DE CV, these belong, or you are the representative of the proprietor of the data or person authorized to provide them. Likewise, and for better
care and greater protection of your data, it is necessary that the personal data provided to EDULAG SA DE CV, are correct, complete, truthful, accurate and current. In case of any error or update, we request carefully notified us in accordance with the contents in the present policy.

Where some form indicate that some data are optional, the delivery of the same will be your decision. These data will be used to facilitate the rendering of the service and the best adaptation of the same.

Any processing of personal data must not contravene any regulatory provisions established by law; It should be with adherence and compliance to Mexican law and international law.

The processing of personal data must be in response to what was agreed, taking into account the reasonable expectation of privacy, without causing any harm to the interests of the owner. There should
not be deceptive or fraudulent means to collect and process personal data.

From the above, the following should be understood as fraudulent actions:

That there is fraud, bad faith or negligence in the information supplied to the holder of your data. It violates the reasonable expectation of privacy of the owner.

The purposes are not the same as informed in the privacy notice.

The personal data processed, should be the necessary minimum for the fulfillment of the purpose for which they were gathered; they must be correct, accurate, complete, relevant and updated, in accordance
with the purpose for which they were collected.

Among the personal data EDULAG SA DE CV obtained by its users, customers, suppliers or anyone else
connected with its services can be found in the following classification:

-ID: full name, email, address, phone number, mobile number, signature, date of birth, age, nationality, RFC, social security, CURP, marital status, sex, number of ID, number of INFONAVIT, among others.

* ACADEMICS: level of education, title, ID, among others.

* Economic and financial: credit card or bank account information, data between others. Identification and data assets are required for the provision of services from EDULAG SA DE CV.

The processing of personal data must be only the necessary to fulfill the purpose

determined and legitimate that noted in the privacy notice in a clear and objective manner and originate and are necessary for the legal relationship that is with holder.

Collection Consent and treatment of data must be provided by the holder of the information, which should be free, specific, informed and unequivocal; needs to inform the holder through the privacy notice, the
purposes and main objectives of the treatment that will have the personal data collected.

HOW WE PROTECT YOUR PERSONAL DATA.

EDULAG SA DE CV. has the proper means and security measures, techniques and physical means to protect your personal data in order to prevent loss, damage, destruction, alteration or use, unauthorized
treatment or access.

The staff from EDULAG, SA DE CV that handles, uses, collects or transfers personal data in any step of the processing of the same, is bound to maintain secrecy, discretion and confidentiality and custody over
them.

The staff of EDULAG SA DE CV, is duly trained and committed to manage your personal information while preserving your confidentiality and privacy.

Is strictly forbidden to copy, destruct, use, access, treatment, damage, alteration or unauthorized modification of the personal data provided by the incumbents.

EDULAG SA DE CV. It is a company committed to the security of your data and the rendering of a quality service, therefore, aware of the technological development and the risks that It entails, is committed to
implement and maintain the necessary security measures, adequate and optimal for the effect, to avoid as far as possible any risk which could affect your personal data. In the event that there is any risk
situation, EDULAG SA DE CV. immediately shall adopt the procedure suitable for the solution of the problems that are presented.

All requests that the holder to exercise his ARCP right, must be directed and served exclusively by the Manager of the Department of protection of personal data.

SANCTIONS

As stipulated in the Law and the Regulation, the following penalties are established:

Cause a breach of safety databases under their custody, from 3 months to 3 years of prison.

Processing of personal data by means of deception, taking advantage of the error of the proprietor or Manager, 6 months to 5 years in prison.

For sensitive personal data, the sanctions will be double those set out above