Privacy Statement

Comprehensive Privacy Notice

FLEXCAR MÉXICO MOVILIDAD, S.A. DE C.V. (""FLEXAUTO"")

Mexico City, September 2026

Data Controller: FLEXCAR MÉXICO MOVILIDAD, S.A. DE C.V.

Trade Name: FLEXAUTO
Address: Calle Hegel 713, Colonia Polanco V Sección, Alcaldía Miguel Hidalgo, C.P. 11560, Mexico City, Mexico

Privacy Email: privacy@flexauto.mx
Telephone: 800 351 1010"
FLEXCAR MÉXICO MOVILIDAD, S.A. DE C.V. ("FLEXAUTO"), in its capacity as responsible for the processing of personal data, makes known this Comprehensive Privacy Notice in compliance with the Federal Law on the Protection of Personal Data Held by Individuals (LFPDPPP), its Regulations and other applicable legal provisions.
"I. Legal Framework and Guiding Principles

The processing of personal data by FLEXAUTO adheres at all times to the guiding principles of the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP): Lawfulness, Consent, Information, Quality, Purpose, Loyalty, Proportionality, and Accountability."
"II. Definitions

Key terms: Privacy Notice, CURP (Unique Population Registry Code), Biometric Data, Financial or Asset Data, Personal Data, Sensitive Personal Data (racial/ethnic origin, health, genetics, beliefs, union affiliation, political opinions, sexual orientation), Telematics Data, ARCO Rights (Access, Rectification, Cancellation, and Opposition), FLEXAUTO, GPS/GPS Systems, Law, Regulations, RFC (Federal Taxpayer Registry), RPC (Public Registry of Consumers), Data Subject."
"III. Purposes of Processing

A. Primary purposes: maintenance of the business/employment relationship; compliance with anti-money laundering regulations; billing and collections; recruitment and payroll; investment and risk profiling; credit bureau inquiries; vehicle data via GPS; notifications; quality assessment; video surveillance; payment processing; and background checks when required by law.

B. Secondary purposes (optional—the data subject may object by sending a request to privacy@flexauto.mx): advertising and communications; consulting reports; marketing and sales prospecting; customer satisfaction surveys."
"IV. Personal Data Collected

- Individual Clients: identification data (name, address, CURP [Mexican National ID Number], telephone numbers, photograph), biometric/sensitive data (fingerprints, voice, facial features), electronic data (email, IP address, geolocation), legal and tax information (RFC [Mexican Tax ID Number], CLABE [Mexican State Bank Code]), asset information, and vehicle identification.

- Corporate Clients: corporate data and information of the legal representative.

- Suppliers: identification data, tax information, CLABE [Mexican State Bank Code], REPSE [Mexican State Registry of Suppliers], and business references.

- Candidates: CV, academic documentation, psychometric evaluations, and employment references.

- Administrative and Unionized Personnel: identification data, employment data, tax information, and health and biometric data (express consent required)."
"V. Transfers of Personal Data

Recipients: FlexCar/FlexAuto group companies; financial institutions; credit reporting agencies; IT providers; law firms and auditors; trade unions; new purchasers/lessees (consent required); competent authorities.

Destination countries: Mexico, Italy (FlexAuto Italy), Cyprus (FlexCar Cyprus), Greece (FlexCar Greece — corporate), and any other country where the company or subsidiaries have current or future operations. The necessary legal instruments will be executed in accordance with Article 68 of the Regulation."
"VI. ARCO Rights and Revocation of Consent

The data subject may exercise their rights of Access, Rectification, Cancellation, or Opposition by sending a request to:
- Email: privacy@flexauto.mx
- In person: Hegel 713, Polanco V Section, Miguel Hidalgo Borough, CP 11560, Mexico City.

- Telephone: 800 351 1010

FLEXAUTO will respond within a maximum of 20 business days; delivery will be made within the following 15 business days (Art. 32 of the Law). If a satisfactory response is not received, the data subject may file a complaint with the INAI (Arts. 45-55 of the Law)."
"VII. Maximum Data Retention Periods

- Tax and accounting data: 5 years (Art. 30 CFF)
- Contractual and commercial data: 10 years (Art. 46 C.Com.)
- Employment data: 10 years (LFT and IMSS/SAR regulations)
- Credit information: up to 6 years from the first default
- Video surveillance: 30 calendar days
- Biometric and sensitive data: duration of the relationship + 3 years (Art. 11 of the Law)
- Telematics and GPS data: duration of the contract + 12 months
- Unselected candidates: 12 months
- Other data: up to 5 years from the last interaction (Arts. 11 and 13 of the Law)"
"VIII. Cookies and Tracking Technologies

FLEXAUTO uses cookies, web beacons, and tracking pixels on its website and mobile app to enhance the browsing experience and deliver personalized content.

You can manage cookies through your browser: Microsoft Edge, Mozilla Firefox, Google Chrome, Safari, or Chrome for Android. Disabling cookies may affect the functionality of some sections of the website or app."
"IX. Data Collection Sources and Methods

- Website, mobile app, and social media: online forms and service requests.

- FLEXAUTO centers, branches, and workshops: in-person visits and physical contracts.

- Contract applications and forms: banking, credit, and vehicle information.

- External sources: public databases, credit reporting agencies.

- Vehicle GPS and devices: automatically and continuously collected throughout the contract term.

- User devices: MAC address, operating system, and browser version.

- Calls and video calls: recorded for quality assurance purposes, after notifying the data subject."
"X. Security Measures

FLEXAUTO implements administrative, technical, and physical measures to protect data: internal privacy policies, ongoing staff training, physical and logical access controls, encryption of data in transit and at rest, and periodic internal and external audits.

These obligations apply to employees, subcontractors, subsidiaries, and third-party providers. In the event of a significant breach, FLEXAUTO will notify the data subject in accordance with Article 20 of the Law."
"XI. Modifications to the Privacy Notice

FLEXAUTO reserves the right to modify this notice at any time. The current version will always be available at www.flexauto.mx. Any changes will be notified within 10 business days of the change.

To request an updated copy or express disagreement: privacy@flexauto.mx.

FLEXCAR MÉXICO MOVILIDAD, S.A. DE C.V. | Hegel 713, Polanco V Section, Miguel Hidalgo Borough, CP 11560, Mexico City | privacy@flexauto.mx | 800 351 1010
Privacy Notice — Version September 2026 | In accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations