This document constitutes the Privacy Notice for the purposes of the provisions of the Federal Law for the Protection of Personal Data in Possession of Individuals (hereinafter, the "Law"), its Regulations, as well as the Privacy Notice Guidelines (hereinafter, the "Legislation"). Therefore, this Privacy Notice (hereinafter, the "Notice") applies to the personal information collected about the Data Subject by Toroto, S.A.P.I. de C.V. (hereinafter "Toroto"). For the purposes of this Notice, the terms used herein that are not defined herein shall have the meaning attributed to them in the Legislation.

1.Identity and Address of the Responsible

Toroto, a company incorporated under the laws of the United Mexican States, domiciled in Tabasco 166, Colonia Roma Norte, Mexico City, is responsible for the collection, use, storage and disclosure of personal data of the Owners, as set forth in this Notice, ensuring in its capacity as responsible for the proper use, protection and confidentiality of the same, observing at all times the principles of legality, consent, information, quality, purpose, loyalty, proportionality and accountability, provided in the Legislation.

2. Personal Data

In order to provide you with the services and products you request or contract with Toroto, we require identification and contact data including full name, address(es), cell phone number, landline and alternate numbers, email, unique population registry code (CURP), place and date of birth, sex, marital status, nationality, fiscal address, digitalized autograph signature, RFC, voter registration number, social security number, labor information including type of employment, employer and employment telephone number, patrimonial and/or financial, geolocation and labor information. Additionally, we may collect sensitive data classified as biometric, such as fingerprint, facial recognition and iris recognition and the following data of the company, which you represent: company name, address, RFC; identification and contact data, data verification through social networks, assets and/or financial data, current debt data, data on income and expenses, type and line of business. Information about the devices or computers from which you access the Platform and other automatically captured data (such as the type or version of the browser or operating system, settings, connection data, information about some of the downloaded applications and parameters), internet IP address used when connecting to our services or browsing the Platform, certain information about the activity of users and visitors within our website and apps, the URL from which they come or what URL they access next (whether or not they are on our website). Also the pages visited, interactions with these pages, searches performed, publications, purchases or sales, ratings and responses entered, complaints made and received, messages in forums, among other information may be stored and retained.

It is important to mention that the previously mentioned items are categories of personal data; in case you require to know each of the personal data that are collected, please contact Toroto through the means indicated in this Notice. The personal data that we may request and that are collected, will be treated under the strictest security measures to ensure its confidentiality, once your consent is obtained.

Personal Data may be collected in person or through our website https://toroto. com/ (the "Site"), our computer application (the "App") or by any other electronic, telephonic, video, or other technology (the "Electronic Media" and together with the Site and the App, the "Platform") including Landing Pages, hyperlinks or Plug-ins within the Platform and, if applicable, through agents, promoters, commission agents, suppliers, or business partners when (including without limitation) the Data Subject: (i) registers to make use of any of the services available from the Platform, including Landing Pages, hyperlinks, or Plug-ins within the Platform; (ii) uses the Platform; (iii) submits questions, inquiries, or comments or contacts the Platform; (iv) requests information or materials; and/or (v) provides in any way information to the Platform (chats, forums, uploads, etc. ).

The foregoing in order to follow up on a user creation request made by you, to provide you with services that are promoted on the Site, in accordance with the Platform Terms and Conditions set forth on the Site (the "Services"), or to enforce agreements or contracts entered into with Toroto.

Toroto may perform the analysis, reports, video calls and/or photographs, conduct interviews in person or by remote means (electronic media or any other technology), as well as the necessary actions to verify by itself or through third parties hired specifically for this purpose, the veracity of the data that were provided by you.

The Platform may contain links to and from other Internet sites. Toroto is not responsible for the privacy practices or the treatment of personal data on those sites. Toroto recommends that you consult the privacy practices of such websites before using them.

3. Purposes

Toroto will use your data for the following purposes:

• The fulfillment of the contractual relationship derived from the request and/or contracting of our Services.
• To identify the person who hires any of Toroto's Services.
• Identification or verification of the identity of a person, based on the biometric data provided, in internal systems, authorized third parties and authorities.
• Verify and validate the information provided by the customer for the contracting of any of Toroto's Services.
• Manage, operate and follow up the Services and products requested or contracted with Toroto.
• The performance of each and every one of the operations and the provision of services, as well as the celebration of the other acts that Toroto may perform in accordance with the law and its bylaws.
• To generate files for customer tracking in our database, directly or through a third party.
• Process the requests you make through the Platform. To create your profile as a user of the Platform.
• To comply with know your client (KYC) and money laundering prevention provisions, either for Toroto or for its affiliates or subsidiaries, as provided by the respective legislation and to consult restrictive lists and financial reports with banking entities and/or governmental authorities.
• Inform about changes or new products or services that are related to the contracted service.
• To comply with regulatory obligations contained in the Legislation and those obligations contracted with our clients.
• Evaluate the quality of the service.
• Validate the financial conditions of people who present debts or payment delays;
• The promotion of products, services, additional benefits, discounts, promotions, bonuses, contests, market research, sweepstakes and advertising in general.
• Respond to queries, claims or complaints raised by the Holders about the products and services provided.
• To elaborate, for research purposes, statistics and derive, by means of mathematical models, conclusions from them.
• In connection with a possible merger, acquisition, restructuring or sale of assets or shares of Toroto.
• Linkages between accounts and users in connection with fraud prevention efforts.

In addition, we will use your personal information for the following purposes that are not necessary for the requested service, but allow and facilitate us to provide you with better service:

• Sending newsletters, as well as sending information for marketing, advertising and commercial prospecting purposes.
• To inform about new products or services.
• Conduct business intelligence, conduct market research, give visibility to your activity on the Platform, monitor the quality of the Platform, evaluate and improve the Platform and send our newsletter and offers. Send and receive communications through the Platform in connection with our Services.

If you, the Data Subject, do not wish your personal data to be processed for the secondary purposes, you may, at any time, object to the processing for such purposes by exercising your right to object in accordance with this Notice. In case you do not want your personal data to be processed for these additional purposes, you may, from this moment on, submit a written statement to hola@toroto.mx.

4. Transfer of Personal Data

Toroto informs you that some or all of your personal data may, where appropriate, be transferred, within and outside the country, to any affiliate, controlling or subsidiary company, as well as all those companies with which we have business relationships, for the purposes set forth in this Notice. In the event that such transfer is made, it will be made in order to comply with the legal relationship with you and with the authorities of the countries in which it operates. The transfers provided for in this paragraph may be carried out without the consent of you Holder under the provisions of Article 37 of the Law, which are cases of exception to your consent.

Your personal data may, where appropriate, be communicated to any natural or legal person providing services for the maintenance or fulfillment of the legal relationship between you and us, assuming at all times Toroto the corresponding obligations in terms of the Legislation. In the case of our employees and suppliers, with respect to your personal data, these are not subject to any transfer, except for the exceptions provided in the aforementioned article 37 of the Law. In any case, the recipient of your personal data will treat them according to this Notice and in accordance with the Legislation.

In that sense, the information of the Data Subject may be shared with: (i) employees, parent, controlling, affiliated or subsidiary companies of Toroto, (ii) service providers who have entered into a contract with Toroto and business partners with whom contracts have been entered into for the marketing of products and/or services for the benefit of customers, (iii) public agencies, public administrations (federal, state or municipal), commissions, institutes, and/or regulatory bodies for the fulfillment of informational obligations, (iii) public agencies, public administrations (federal, state or municipal), commissions, institutes, and/or regulatory entities for compliance with information, transparency and money laundering prevention obligations, as well as for compliance with judicial or administrative requirements issued by competent authorities, (iv) agencies, entities or authorities abroad for compliance with requirements or requests with effects in Mexican territory, or enforceable pursuant to International Treaties to which Mexico is a party, (v) Credit Information Companies; (vi) Toroto's legal and financial advisors; (vii) programmers for the maintenance and management of electronic media; and (viii) other users and/or visitors of the Platform.

Based on the provisions of Article 68 of the Regulations of the Law and Article 36 of the Law, the Data Subject expressly consents to and authorizes any transfer of his Personal Data that Toroto makes to any of the companies and/or entities listed in the preceding paragraph; Toroto guarantees that the transfers made will comply at all times with the provisions of the Legislation. By not expressing your opposition to the transfers of your personal data described above, it will be understood that you have given your consent to it. To exercise your right to revoke your consent, you can do so at the address of Toroto or through the following email account: hola@toroto.mx.

5. ARCO Rights

You are the owner of your personal information, therefore, you have the right to access your personal data that we possess, as well as to rectify them in case they are inaccurate or instruct us to cancel them when you consider that they are excessive or unnecessary for the purposes that justified their collection or oppose the treatment of them for specific purposes or secondary purposes. You may exercise these ARCO rights (Access, Rectification, Cancellation and Opposition) on your personal data at any time. You can exercise these rights by the following free means: (i) By sending an email to the email address hola@toroto.mx and/or (ii) In writing in a format with acknowledgement of receipt, at our address.

Your request to exercise your ARCO rights must contain: (i) full name of the Data Subject, address or other means to communicate the response to your request; (ii) documents proving your identity or, if applicable, the legal representation of the Data Subject (voter's credential or passport); (iii) clear and precise description of the Personal Data with respect to which you seek to exercise any of the ARCO rights; and (iv) any other element or document that facilitates the location of the personal data. In the case of requests for rectification of personal data, the Data Subject must also indicate the modifications to be made and provide the documentation supporting the request.

Once the request has been received with all the above requirements, Toroto will have a maximum period of 20 (twenty) working days to notify the Data Subject the adopted determination, so that, if it is appropriate, the same becomes effective within 15 (fifteen) days following the date on which the response is communicated. The aforementioned terms may be extended only once for an equal period of time, provided that the circumstances of the case so justify.

In case the information provided in the request is insufficient or erroneous, or if the necessary documents are not provided, Toroto may, within 5 (five) business days following its receipt, require the Holder to provide the necessary elements or documents to process the request, and the latter will have a period of 10 (ten) business days to respond to the requirement, which will begin to run from the day following receipt of the requirement; if no response is given within such period, the corresponding request will be considered as not submitted, without liability for Toroto, however, the Holder may resubmit the request at any time. Toroto's response will be given by the means indicated in the request.

6. Revocation

The Data Subject may revoke the consent given to Toroto for the processing of his Personal Data at any time, without retroactive effect, in those cases in which such revocation does not imply the impossibility of fulfilling obligations arising from a legal relationship in force between the Data Subject and Toroto. The Holder knows that, for certain purposes, the revocation of consent implies that Toroto can no longer provide the service for which it was hired or otherwise the conclusion of the existing relationship between the parties. The procedure for the revocation of consent, if any, will be the same as that set forth in the preceding paragraph for the exercise of ARCO rights.

7. Limitation on the use or disclosure of Personal Data

Toroto will use your personal data in strict accordance with the purposes set forth in this Notice and for as long as necessary in accordance with the applicable legal provisions. Also, you can contact us at any time in the indicated means, to answer any questions, clarification or suggestion regarding your personal data.

Toroto puts at your disposal the following email address hola@toroto.mx so that the Holder can express at any time his refusal to continue receiving communications or promotions from us from the account in which he receives such communications or promotions, as well as adhere to our exclusion list, which aims to register his refusal to the processing of his personal data for marketing and advertising purposes. The Data Subject may also exercise his or her right to limit the use or disclosure of his or her information, for example, for marketing and/or advertising purposes, following the same procedure as with the ARCO rights.

Toroto is not responsible for the use that any user or other person may make of the information published on the Platform. Users agree that Toroto shall not be liable for any loss or damage that may arise as a result of negotiations between users. Accordingly, you release Toroto from any and all liability in the event that you have a dispute with one or more users.

8. Modifications to the Privacy Notice

This Notice may be changed or updated as a result of regulatory changes; our own needs for the products we offer; privacy practices; changes in our business model; or for other reasons. Changes and updates to this Notice will be made known on our Portal or by any means of communication with the Holder, notifying the changes and / or update to this privacy notice. Once the change to the present notice is published, it will become effective the day after its publication in the aforementioned media. The Holder will have 5 (five) days from the date of publication in the Portal to state if he/she does not agree with the modifications, in which case the provision of services will be suspended. Once this term has expired without disagreement from the Holder, it will be considered that he/she accepts the modifications to the Notice.

By using the electronic media and/or hire the services we offer and by providing us, by any means, your personal data you expressly acknowledge and accept this Notice, so that such consent gives us the power to proceed with the treatment of the same in the manner indicated in this Notice and in strict accordance with the Legislation, without prejudice to the rights conferred by the Legislation.

If you believe that your right to the protection of your personal data has been violated by any conduct of our employees or our actions or responses, you may contact us through the means indicated, without prejudice to the right to go before the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI), who is the guarantor authority in Mexico of the right to the protection of personal data held by individuals.

You declare, as the Holder of the personal data that you have read this Notice, that you know the categories of personal data collected (including the categories related to financial and patrimonial data), as well as the purposes for the treatment of your personal data; the transfers that Toroto carries out and that you freely consent to the treatment of your personal data in the terms described.

To resolve any complaint, doubt or comment regarding our website or the services of our site, as well as to request further information, please contact us: