Privacy Policy

PRIVACY NOTICE FOR THE PROTECTION OF PERSONAL DATA

The purpose of this Notice is to protect your personal data, through its legitimate, controlled, and informed
treatment, in order to guarantee your privacy, as well as your right to informational self-determination.
Metabase Q, informs you below the terms in which the Personal Data we collect will be treated, therefore,
we recommend that you carefully read the following information:
In terms of the provisions of the Federal Law for the Protection of Personal Data in Possession of
Individuals, the contribution you make of your Personal Data to Metabase Q constitutes acceptance of
these Terms and Conditions.

1. Identity and address of the responsible party

METABQ S.A.P.I. de C.V. (Metabase Q) declares that it is a company legally constituted under Mexican
law and will be individually responsible for the Personal Data it collects and indicates as its address for all
effects and obligations related to this PRIVACY NOTICE the property located at Av. Santa Fe 428, Torre I – 1503, Col. Contadero, Alc. Cuajimalpa, CDMX, 05500.

2. Definitions

For the purposes of this PRIVACY NOTICE, the terms indicated below shall have the meanings indicated
in this document, whether they are written in singular or plural:
1.1. “Personal Data”: Pursuant to article 3, section V, of the Law, Personal Data is understood as: Any
information concerning an identified or identifiable natural person.
1.2. “ARCO Rights”: The right of the Data Subject to request from the Controller the Access, Rectification,
Cancellation or Opposition with respect to such data, in accordance with the provisions of the LFPDPPP
and its Regulations.
1.3. “Dissociation”: The procedure by which the Personal Data cannot be associated to the Data Subject
or allow, due to its structure, content or degree of disaggregation, the identification of such Data Subject.
1.4. “Processor”: The individual or legal entity that alone or jointly with other individuals or legal entities
processes Personal Data on behalf and by instruction of the Controller, in accordance with the processes,
terms and conditions indicated by the Controller.
1.5. “LFPDPPP”: Federal Law for the Protection of Personal Data in Possession of Individuals.
1.6. “Regulation”: Regulation of the Federal Law for the Protection of Personal Data in Possession of
Individuals.
1.7 “Controller”: Metabase Q.
1.8. “Data Subject”: The natural person to whom the Personal Data corresponds.
1.9. “Transfer”: The communication of Personal Data within or outside the national territory, made to a
person other than the Data Subject or the Controller. 3. Personal Data collected by the Controller.

In order to fulfill the purposes stated in paragraph 4 of this PRIVACY NOTICE, the Controller informs you
that it will collect the following categories of Personal Data: (i) Identification Data; (ii) Contact Data; (iii)
Employment Data; (iv) Academic Data; (v) Health Data; and (vi) Financial and Compensation Data.
If you wish, you may disclose more sensitive information about yourself to assist in our diversity and
inclusion initiatives, such as your: race or ethnicity, sexual orientation, gender identity.

3. Personal data collected by the data controller

4. Purposes of data processing

Metabase Q, in accordance with the provisions of Section I of Article 16 of the Law, will be responsible for
your personal information (Personal Data). Metabase Q will make use of the information corresponding
to your work relationship and your role within the company, Metabase Q, as responsible for the treatment
of your personal data, is obliged to comply with the principles of legality, consent, information, quality,
purpose, loyalty, proportionality and responsibility protected by the Law; for this reason, based on articles
13 and 14 of the Law, Metabase Q is committed to treat your information with confidentiality and
administrative security standards, so we limit the use to what is necessary and legal, there are several
aspects related to this issue, we list some of them:

Relating to your employment relationship with us
Determine eligibility for subsequent relationships that involve hiring, and that are related to recruiting,
onboarding, and other employment-related processes.
Comply with labor and employment regulations and statutes.
Prepare your employment file.
Provide professional training.
Perform relevant procedures in case of termination of your employment relationship with Metabase Q.
Comply with Metabase Q’s policies and professional standards.
Promote equal opportunity, diversity and inclusion in our business, including participation in activities.
Plan, organize and operate the business, including our services, your work and the work of others.
Coordinate and collaborate with our customers and those with whom we do business.

Give access to relevant information about you, such as skills, abilities, experience to people within the
company or to customers, potential customers and others in our business community for the same
business-related purposes.
Participate in and conduct internal and external surveys, adjudicate applications and other requests for
information from customers, government entities or other organizations.
Confirm your employment, for example, for credit applications, apartment rentals and reference checks –
anything you need to demonstrate that you have a job.
To conduct marketing, advertising or prospecting activities.
Use your personal image (photo, video, etc.) in Metabase Q informational and promotional material.
Carry out diffusion of awards.
Send advertising and communications for marketing purposes.

When do we share and transfer your information?

To comply with applicable laws, regulations and Metabase Q policies and professional standards.
Applicable laws, regulations and professional rules, including your compliance with legal, regulatory and
professional obligations relating to your employment relationship.
Disclosure and Transfers with Third-Party Service Providers.
Metabase Q uses resources in different countries to process your information. It is also possible that your information may be transferred to third party service providers) but who process information on Metabase Q’s behalf. Third-party service providers may also include providers of benefits and services offered to employees (such as health and welfare programs, insurance companies, payroll services, etc.).
Third-party service providers are obligated to maintain appropriate levels of security and confidentiality
and to process information only in accordance with Metabase Q’s instructions. These providers act as
Agents for the purposes of this Privacy Notice.
Metabase Q does not share personal information to third parties on a regular basis unless:
It is permitted in this policy to use and disclose;
You consent; or Such disclosure is required or permitted by law, regulation, rule or professional standards.
We may also share non-personal, non-identifying and aggregate information for research or marketing
purposes. We do not sell or trade information to third parties.
Metabase Q respects your right to privacy so this notice outlines what personal information we may
communicate with your managers or colleagues for work and/or social purposes. I authorize you to share
the following information with my colleagues upon request: Address, Cell phone number, Day and month of birth, Other (Specify)

We never use or share personal information that is authorized to us in advance without clear notice and
without offering you the opportunity to opt-out or prohibit such use.
Timeliness of our handling of your Personal Information. Metabase Q will store your information for the
time necessary for the relevant purposes and as permitted by law or regulation from the date you provide
it to us. In terms of the provisions of Article 22 of the Law, you have the right at any time to exercise your
rights of access, rectification, cancellation and opposition to the processing of your personal data. You as
an employee of Metabase Q may request Access to your Personal Data, its rectification or updating to
ensure its accuracy and completeness, its Cancellation if it is no longer being used for the purposes for
which it was collected and/or there is no obligation or right to keep it and Oppose the processing of your
Personal Data for a legitimate cause. You may also limit the use or disclosure of your Personal Data and,
when possible, revoke the consent given for its processing.

5. Means to exercise the rights of access, rectification, cancellation, or
opposition (arch rights)

In case you require any change, you should send an email to hr@metabaseq.com.
In compliance with article 29 of the Law, such request must contain the following information:
a) your name and address or other means to communicate the response to your request;
b) the documents proving your identity or, as the case may be, the legal representation of the person
making the request on your behalf;
c) a clear and precise description of the personal data in respect of which you are seeking to exercise any
of the rights mentioned in the preceding paragraph; and
d) any other element or document that facilitates the location of your personal data. In case of requesting
the rectification of personal data, you must additionally indicate the modifications to be made and provide
the documentation supporting your request. The response to your request will be communicated to you
within twenty working days from the date it was received, which may be extended to twenty more days in
cases established by law, to carry out the measures adopted to comply with your request, which will be
carried out within fifteen working days following the date on which the response is communicated.
We suggest to know and analyze the content of the Federal Law for the Protection of Personal Data in
Possession of Individuals, since there may be regulatory changes to which we are subject.
July 2022