Full Privacy Notice

Version 1.1 · Last updated 2026-10-15

English translation for convenience — the Spanish version is the governing text.

TITLE I. IDENTITY AND DOMICILE OF THE DATA CONTROLLER

Chapter 1. Identity of the Data Controller

1.1 Legal objective

To fulfill the identification duty provided in Article 15 of the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter, the "Law"), clearly and unequivocally informing the identity and domicile of the individual responsible for the processing of the Personal Data collected through the Ancuria™ Inteligencia Inmobiliaria platform.

1.2 Identification of the Data Controller

James Marcus Patman, with domicile at Calle Aldama 470, Sin Número Interior, Colonia El Cerro, Puerto Vallarta, Jalisco, C.P. 48304, Mexico, is the individual responsible for the processing of the Personal Data collected in connection with the access, registration or use of the technology platform called "Ancuria Inteligencia Inmobiliaria" (hereinafter, "Ancuria", the "Platform" or the "Data Controller"), under the terms of this Full Privacy Notice (hereinafter, the "Notice").

1.3 Contact channel for privacy matters

For any matter related to the processing of Personal Data, including the exercise of rights, questions or clarifications, the data subject may write to the email address legal@ancuria.com, designated by the Data Controller as the official channel for data protection matters.

1.4 Internal data protection delegate or officer

As its operation grows, the Data Controller may designate a person or department in charge of handling data protection matters, whose identity and contact details will be made known to data subjects through an update of this Notice, without the absence of such formal designation exempting the Data Controller from its obligations under the Law.

1.5 Consequences of non-compliance

Omission or inaccuracy in identifying the Data Controller constitutes a breach of the information duty provided in the Law, and may give rise to the administrative sanctions provided therein, without prejudice to the validity of the rest of this Notice.

Chapter 2. Purpose and Nature of the Privacy Notice

2.1 Purpose

This Notice is intended to inform the holders of Personal Data (hereinafter, interchangeably, the "Data Subject" or the "User") about the purposes, processing, transfers and remissions, and the mechanisms for exercising rights applicable to their Personal Data, in compliance with the information and transparency principles provided in the Law.

2.2 Legal nature

This Notice constitutes a document in physical, electronic or any other format generated by the Data Controller, made available to the Data Subject prior to the processing of their Personal Data, in compliance with Article 15 and other applicable provisions of the Law and its Regulations.

2.3 Relationship with the Terms and Conditions of Service

This Notice supplements, and must be interpreted jointly with, Ancuria's Terms and Conditions of Service, without the existence of that contractual document diminishing or substituting the specific Personal Data protection obligations the Data Controller assumes toward Data Subjects under the Law. In case of discrepancy between the two documents regarding the protection of Personal Data, the provisions of this Notice shall prevail.

2.4 Comprehensive character of the Notice

This document constitutes a Full Privacy Notice, under the terms of Article 27 of the Regulations of the Law, being made available to the Data Subject in its entirety at the time their Personal Data is collected, without prejudice to the Data Controller additionally preparing simplified or short privacy notices for certain data-collection points, which shall refer to this Full Notice for complete consultation.

2.5 Consequences of non-compliance

Failure to make this Notice available, prior to the collection of Personal Data, constitutes a breach of the information principle provided in the Law, with the corresponding administrative consequences.

Chapter 3. Scope of Application

3.1 Bound parties

This Notice is applicable to all processing of Personal Data carried out by the Data Controller in connection with the Platform's operation, including processing carried out by its collaborators, internal personnel and data processors processing Personal Data on the Data Controller's behalf.

3.2 Data Subjects covered

This Notice applies to the Personal Data of: (i) Real-Estate Agents, Real-Estate Developers and other Users who register on the Platform; (ii) individuals who, without being registered Users, interact with the Platform's Artificial Intelligence Agents in their capacity as end clients of a Real-Estate Agent; (iii) visitors of the Ancuria website who do not complete a registration; and (iv) any other individual whose Personal Data is processed by the Data Controller in connection with the Platform's operation.

3.3 Territorial scope

This Notice applies regardless of the place where the Data Subject is domiciled, without prejudice to the Data Controller being able to issue specific territorial privacy notices as the Platform expands its operation to other jurisdictions, in which case those territorial notices shall prevail over this one with respect to Data Subjects domiciled in the corresponding jurisdiction.

3.4 Exclusions

This Notice is not applicable to the processing of legal entities' data, nor to information that, by its nature, does not constitute Personal Data under the corresponding legal definition, such as aggregated, statistical or anonymized data that does not allow identifying, directly or indirectly, a specific individual.

3.5 Consequences of non-compliance

Improper application of, or failure to inform, any of the categories of Data Subjects indicated in section 3.2 shall constitute a breach of the information principle provided in the Law, with respect to the omitted category of Data Subjects.

TITLE II. PERSONAL DATA SUBJECT TO PROCESSING

Chapter 4. Categories of Personal Data Collected

4.1 Legal objective

To detail, specifically and exhaustively, the categories of Personal Data the Data Controller collects from the different Data Subjects, in compliance with the information principle and the specificity duty required by the Law and its Regulations.

4.2 Identification and contact data

Regarding registered Users, the Data Controller collects data such as: full name, email address, telephone number, profile photograph, professional domicile, and other similar data necessary for the Data Subject's identification and contact.

4.3 Professional accreditation data

Regarding Real-Estate Agents, the Data Controller may collect data relating to their professional accreditation, such as trade-association membership numbers (including, where applicable, the Mexican Association of Real Estate Professionals), professional licenses, municipal or state permits or licenses, and other similar documentation.

4.4 Invoicing and payment data

In connection with the engagement of paid Plans, the Data Controller collects tax data (business name, Federal Taxpayers Registry number, tax domicile, CFDI use) necessary for issuing tax receipts, specifying that the complete payment-instrument data (card number and associated data) is collected and processed directly by the payment gateway provider, Conekta (Mexico), under the terms of section 4.9.

4.5 Usage and browsing data

The Data Controller automatically collects data relating to the use of the Platform, such as IP address, device type, operating system, browser, pages or modules visited, dwell time, and other technical data generated by the Data Subject's interaction with the Platform, including, where applicable, through the use of cookies and similar technologies pursuant to the Chapter on that subject matter to be developed in a later deliverable.

4.6 Data derived from interactions with Artificial Intelligence Agents

The Data Controller collects the content of the conversations, inquiries and requests the Data Subject holds with the Artificial Intelligence Agents integrated into the Platform, including, where applicable, contact data voluntarily provided by the Data Subject in the course of such interaction (for example, an end client who provides their name and telephone number to a customer-service AI Agent on behalf of a Real-Estate Agent).

4.7 Data generated by the use of specific modules

Depending on the Plan and the modules used by the User, the Data Controller may collect additional data such as: prospect and client information loaded into the real-estate CRM module; documents uploaded to the document management module; and data necessary for the use of the electronic signature module, when that module is available.

4.8 Geolocation data

The Data Controller may collect approximate geolocation data of the Data Subject, derived from the IP address or, when the Data Subject expressly authorizes it through the mobile application, from the precise geolocation of their device, for the purpose of improving the relevance of the Market Indicators and the listings displayed.

4.9 Data processed by data processors

Certain Personal Data, particularly financial data associated with payment instruments, is collected and processed directly by Conekta (Mexico), the Data Controller's payment gateway provider, which acts, regarding such data, according to its own privacy policies, which are made available to the Data Subject at the time of engagement.

4.10 Consequences of non-compliance

Collection of categories of Personal Data not informed in this Chapter, without the corresponding update of this Notice, shall constitute a breach of the information principle provided in the Law.

Chapter 5. Third-Party Personal Data Provided by the User

5.1 Legal objective

To delimit the Data Controller's responsibility regarding the Personal Data of third parties that a User loads or provides to the Platform in the course of their professional activity, distinguishing that case from the processing of the User's own Personal Data.

5.2 Prospect and client data loaded by the User

When a Real-Estate Agent loads to the Platform Personal Data of their own prospects or clients (for example, in the real-estate CRM module, or through the interaction of those third parties with an Artificial Intelligence Agent on the Real-Estate Agent's behalf), the Data Controller will act, regarding such Personal Data, as data processor on behalf of the Real-Estate Agent, who will retain the status of data controller toward those third parties.

5.3 User's obligation regarding third parties

It is the Real-Estate Agent's responsibility, in their capacity as data controller toward their own prospects and clients, to obtain the corresponding consent and make their own privacy notice available to those third parties, without the Data Controller assuming any obligation to collect such consent directly, except in those cases where the third party interacts directly with a Platform Artificial Intelligence Agent, in which case the provisions of the Chapter on Artificial Intelligence to be developed in later deliverables will additionally apply.

5.4 Processing pursuant to the User's instructions

The Data Controller will process third parties' Personal Data loaded by the User exclusively pursuant to the latter's instructions, and to the extent necessary for the provision of the Service, refraining from using such data for its own purposes other than those necessary for the Platform's operation, unless such data undergoes an anonymization process preventing individual identification, pursuant to the provisions of the Title on Artificial Intelligence.

5.5 Consequences of non-compliance

The Data Controller's use of third parties' Personal Data loaded by a User, for own purposes not authorized by that User, shall constitute a breach of the loyalty and purpose principles provided in the Law.

Chapter 6. Sensitive Personal Data

6.1 Declaration of non-collection

The Data Controller declares that, according to the Platform's current design, it has no intention of collecting sensitive Personal Data, understood as data that, if improperly disclosed, would affect the Data Subject's most intimate sphere, or whose misuse could give rise to discrimination or entail a serious risk for them, such as racial or ethnic origin, present or future health status, genetic information, religious, philosophical and moral beliefs, trade union membership, political opinions and sexual preference, under the definition provided in the Law.

6.2 Exception for professional information inherent to the sector

Without prejudice to the foregoing, the Data Subject acknowledges that, in the ordinary course of real-estate activity, certain information that might touch on sensitive categories could incidentally be mentioned in free-text communications (for example, within a Real-Estate Agent's note about a client's preferences), without this implying structured or intentional collection of sensitive Personal Data by the Data Controller, which does not request, structure, or use such information for any purpose.

6.3 Exceptional processing with express written consent

In the exceptional event that, due to the Platform's evolution, the processing of sensitive Personal Data became necessary, the Data Controller will update this Notice pursuant to the mechanism provided in the Title on Validity and Amendments, and will collect the corresponding Data Subject's express written consent, by means of a handwritten signature, electronic signature, or any authentication mechanism implemented for that purpose, under the terms of Article 9 of the Law.

6.4 Consequences of non-compliance

Processing of sensitive Personal Data without the express written consent required by the Law constitutes a material breach, with the administrative and, where applicable, criminal consequences provided therein.

TITLE III. PURPOSES OF THE PROCESSING

Chapter 7. Primary Purposes (Necessary)

7.1 Legal objective

To clearly and specifically inform of the purposes for which the processing of the Data Subject's Personal Data is necessary, and without which the Data Controller could not provide the requested Service, in compliance with the purpose principle provided in Article 12 of the Law and the specificity duty provided in its Regulations.

7.2 Creation and management of the Account

The Data Controller processes the Data Subject's Personal Data to create and manage their Account within the Platform, verify their identity according to the mechanisms described in the Terms and Conditions of Service, and enable access to the modules corresponding to their Plan.

7.3 Provision of the contracted Service

The Data Controller processes the Data Subject's Personal Data for the ordinary operation of the Platform modules they use, including the real-estate CRM module, the Marketplace, the Artificial Intelligence Agents, the Calculation Engine and other features corresponding to their Plan.

7.4 Payment processing and invoicing

The Data Controller processes the Data Subject's tax and invoicing data to process the payment of their Subscription, issue the corresponding tax receipts, and comply with its own tax and accounting obligations.

7.5 Customer service and technical support

The Data Controller processes the Data Subject's Personal Data to handle requests, questions, clarifications, error reports, and any other communication the Data Subject addresses to the Platform's support channels.

7.6 Compliance with legal obligations

The Data Controller processes the Data Subject's Personal Data to the extent necessary to comply with the legal, tax, accounting and regulatory obligations applicable to it, including handling requests from competent authorities.

7.7 Security and fraud prevention

The Data Controller processes the Data Subject's Personal Data for the purpose of protecting the Platform's security, preventing unauthorized access, detecting and preventing fraudulent activities or activities contrary to the Terms and Conditions of Service, and safeguarding the rights and interests of the Data Subject themselves and of other Users.

7.8 Operational communications

The Data Controller processes the Data Subject's contact data for sending strictly operational communications related to the Service, such as confirmations, security notifications, notices of amendment to the Terms and Conditions of Service or to this Notice, and other communications necessary for the contractual relationship.

7.9 Mandatory nature of consent for primary purposes

The processing of Personal Data for the purposes indicated in this Chapter is necessary for the existence, maintenance and performance of the legal relationship between the Data Subject and the Data Controller, so the Data Subject cannot object to such processing without this implying the impossibility of the Data Controller continuing to provide the Service.

7.10 Consequences of non-compliance

Processing of Personal Data for a primary purpose not informed in this Chapter shall constitute a breach of the purpose principle provided in the Law.

Chapter 8. Secondary Purposes (Not Necessary)

8.1 Legal objective

To inform of those processing purposes that, while not necessary for the legal relationship between the Data Subject and the Data Controller, generate an additional benefit for the Data Subject or the Data Controller itself, expressly distinguishing them from the primary purposes, in compliance with Article 12 of the Law.

8.2 Marketing and promotional communications

The Data Controller may process the Data Subject's contact data for sending marketing communications regarding new modules, features, Plans, promotions or events of the Platform or its commercial allies.

8.3 Surveys and market studies

The Data Controller may process the Data Subject's Personal Data to invite them to participate in satisfaction surveys, market studies or feedback programs about the Platform.

8.4 Development of usage profiles for product improvement

The Data Controller may process the Data Subject's usage and browsing data to develop general profiles of Platform utilization, for the purpose of improving the user experience and prioritizing the development of new features.

8.5 Referral programs and trade-association alliances

The Data Controller may process certain contact data of the Data Subject for the operation of referral programs between Users, or for communicating benefits derived from alliances with real-estate sector trade associations, when the Data Subject is a member of those associations.

8.6 Objection mechanism

The Data Subject may, at any time and without need for justification, express their refusal of the processing of their Personal Data for some or all of the secondary purposes indicated in this Chapter, through the mechanisms described in the Title on ARCO Rights and Mechanisms for Limiting Use and Disclosure to be developed in later deliverables, without such refusal affecting the provision of the Service corresponding to the primary purposes.

8.7 Tacit consent regarding secondary purposes

Pursuant to Article 8 of the Law, unless the Law requires express consent, the Data Subject's consent to the processing of their Personal Data for the secondary purposes indicated in this Chapter shall be deemed granted tacitly if, having been made aware of this Notice, they do not express their opposition.

8.8 Consequences of non-compliance

Processing of Personal Data for secondary purposes regarding a Data Subject who has expressly expressed their opposition pursuant to section 8.6 shall constitute a breach of the Law, with the corresponding administrative consequences.

Chapter 9. Specific Purposes of Processing in Artificial Intelligence Processes

9.1 Legal objective

To detail, with the level of specificity warranted by the particular nature of this technology, the purposes for which the Data Controller processes Personal Data in the context of the operation of the Platform's Artificial Intelligence Agents and Calculation Engine, consistent with the provisions of the Title on Personal Data Protection of the Terms and Conditions of Service.

9.2 Real-time operation of the Artificial Intelligence Agents

The Data Controller processes the Personal Data provided during an interaction with an Artificial Intelligence Agent for the primary purpose of generating a pertinent, contextualized response to the Data Subject's request in real time, including the consultation of indicators, answering questions, or assistance in sales or after-sales processes.

9.3 Quality control and human oversight

The Data Controller processes the interactions held with the Artificial Intelligence Agents for the primary purpose of conducting oversight and quality control processes, in order to verify the correct operation of those Agents and correct possible inaccuracies in their responses.

9.4 Model improvement and tuning

The Data Controller may process the interactions held with the Artificial Intelligence Agents, preferably through aggregated or anonymized information pursuant to section 9.6, for the secondary purpose of improving the performance of those Agents and of the Platform's underlying models.

9.5 Generation of Market Indicators

The Data Controller processes the data associated with the properties, transactions and inquiries made on the Platform, in an aggregated and statistical manner, for the primary purpose of generating the Market Indicators offered to Users, without such aggregated processing allowing, by itself, the individual identification of the Data Subjects whose original data contributed to that indicator.

9.6 Anonymization commitment

When the Data Controller processes interactions or data derived from the use of the Artificial Intelligence Agents for the improvement purposes indicated in section 9.4, it will apply, to the extent technically reasonable, anonymization or dissociation processes, so that the resulting information does not allow, without disproportionate effort, identification of the corresponding Data Subject.

9.7 Absence of automated decisions with definitive legal effects

The Data Controller informs that the results generated by the Calculation Engine and by the Artificial Intelligence Agents have the nature of informational support for the professional decision of the User or their client, without such results constituting, by themselves, an automated decision producing definitive legal effects on the Data Subject's sphere without human intervention.

9.8 Security purpose in the use of Artificial Intelligence

The Data Controller processes the interactions with the Artificial Intelligence Agents for the additional purpose of detecting and preventing misuse of that technology, including manipulation attempts, extraction of confidential information from the Platform, or generation of content contrary to the Acceptable Use Policy.

9.9 Consequences of non-compliance

Processing of Personal Data for the training or tuning of Artificial Intelligence models without observing the anonymization commitment indicated in section 9.6, or for purposes not informed in this Chapter, shall constitute a breach of the lawfulness and purpose principles provided in the Law.

TITLE IV. TRANSFERS, REMISSIONS AND USE OF COOKIES

Chapter 10. Remissions to Data Processors

10.1 Legal objective

To inform the Data Subject of the Data Controller's practice of remitting Personal Data to third parties acting as data processors, distinguishing such remission from a transfer proper, under the terms of Article 3, section XVIII, of the Law and the criterion held by the National Institute for Transparency, Access to Information and Personal Data Protection.

10.2 Nature of the remission

The remission of Personal Data to a data processor does not constitute a transfer subject to the consent regime provided in Chapter 11, by virtue of the processor processing the data exclusively according to the Data Controller's instructions, and not acquiring over them an interest of its own nor the status of independent controller.

10.3 Categories of data processors

The Data Controller remits Personal Data to the following data processors, to the extent necessary for the provision of the Service: (i) Railway, cloud computing infrastructure provider, responsible for hosting the Platform and the PostgreSQL database; (ii) Cloudflare R2, file storage provider, such as listing photographs and invoicing files; (iii) OpenRouter, Artificial Intelligence routing provider, which channels requests to the underlying language-model providers (Anthropic, Google, OpenAI and DeepSeek, depending on the function), all calls being made server-side; (iv) Conekta, payment gateway provider, for processing transactions in Mexico; (v) Migadu, transactional email (SMTP) service provider, for sending operational communications; (vi) Facturapi, invoicing provider, for stamping Digital Tax Receipts over the Internet (CFDI) 4.0, which receives tax data such as Federal Taxpayers Registry number, business name and email address; (vii) Mapbox, provider of interactive maps and geocoding of listing addresses; (viii) Sentry, technical error monitoring provider, to which no information identifying the User is attached; and (ix) Google Fonts, typeface provider, which receives no Personal Data. When that module is enabled, the Data Controller may additionally remit Personal Data to electronic signature platform providers. The Data Controller does not use traffic analytics tools, the WhatsApp Business API, SMS messaging service providers, or Stripe as a payment processor; WhatsApp contact, when offered, is made through simple links (wa.me), with no API integration or additional processing of Personal Data by a third party.

10.4 Contractual obligations of data processors

The Data Controller undertakes to ensure its data processors assume, through a contractual instrument, obligations equivalent to those the Data Controller itself has toward the Data Subject in matters of Personal Data protection, including confidentiality obligations, implementation of security measures, and return or deletion of the Personal Data once the corresponding service provision has concluded.

10.5 Specific identification of data processors

The detailed list of current data processors, including their names and the nature of the service provided, can be consulted through the website www.ancuria.com or the email address legal@ancuria.com, which the Data Controller will keep updated as its technology infrastructure evolves.

10.6 Consequences of non-compliance

The remission of Personal Data to a third party that, in fact, carries out processing with an interest of its own foreign to the Data Controller's instructions, shall be considered an unconsented transfer, with the consequences provided in the following Chapter.

Chapter 11. Transfers to Third-Party Controllers

11.1 Legal objective

To inform the Data Subject of the cases in which the Data Controller communicates Personal Data to third parties that become, regarding such data, independent data controllers, in compliance with Article 36 of the Law.

11.2 General consent rule

Unless one of the exceptions provided in Article 37 of the Law applies, every transfer of Personal Data to a third-party controller shall require the Data Subject's prior consent, which will be collected through the corresponding mechanism at the time such transfer becomes necessary.

11.3 Transfers not subject to consent

Pursuant to Article 37 of the Law, the Data Subject's consent shall not be required for transfers that are: (i) necessary by virtue of a contract executed or to be executed in the Data Subject's interest by the Data Controller and a third party; (ii) required by a competent authority, through a founded and motivated request; (iii) necessary for the recognition, exercise or defense of a right in a judicial proceeding; and (iv) any others expressly provided by the Law.

11.4 Transfers between companies of the corporate group

The Data Controller may transfer Personal Data to companies belonging to its same corporate group, when those companies operate under the same internal Personal Data protection policies and processes, under the terms of the exception provided in Article 37, section I, of the Law, and provided such transfer is necessary for internal administrative or operational purposes analogous to those informed in this Notice.

11.5 Transfers to trade associations

When the Data Subject participates in collaboration programs with real-estate sector trade associations (such as the Mexican Association of Real Estate Professionals), the Data Controller may transfer to those associations the data strictly necessary for the operation of such program, with the Data Subject's prior consent, when it has not already been manifested through their voluntary membership in the corresponding association.

11.6 Transfers in corporate transactions

The Data Controller may transfer Personal Data in the context of a merger, acquisition, spin-off, or substantial sale of assets, in which case the acquiring third party shall be bound by the same terms of this Notice, and that circumstance must be notified to the affected Data Subjects pursuant to the mechanism provided in the Title on Validity and Amendments.

11.7 Consequences of non-compliance

Carrying out an unconsented transfer not covered by one of the exceptions provided in this Chapter shall constitute a material breach of the Law, with the corresponding administrative and, where applicable, criminal consequences.

Chapter 12. International Transfers

12.1 Legal objective

To inform the Data Subject of the possible location of the Data Controller's technology infrastructure outside the national territory, and the measures adopted to safeguard their Personal Data in that case.

12.2 Location of the infrastructure

The Data Controller informs that its cloud computing infrastructure (Railway), its file storage (Cloudflare R2), and certain Artificial Intelligence service providers (OpenRouter, as well as the underlying model providers Anthropic, Google, OpenAI and DeepSeek), may be located, wholly or partially, outside the territory of the United Mexican States, particularly in the United States of America.

12.3 Nature of the international remission

To the extent those providers act as data processors pursuant to Chapter 10, the international communication of Personal Data deriving from that infrastructure constitutes a remission, not subject to the consent regime applicable to transfers proper, without prejudice to which the Data Controller adopts the contractual measures indicated in the following section.

12.4 Protection measures for international remissions

The Data Controller undertakes to ensure that data processors located abroad assume, through a contractual instrument, Personal Data protection obligations comparable to the standards required by the Law, including technical, administrative and physical security measures equivalent to those required of the Data Controller itself.

12.5 Consequences of non-compliance

International communication of Personal Data without the adoption of the protection measures indicated in this Chapter shall constitute a breach of the accountability principle provided in the Law.

Chapter 13. Use of Cookies, Web Beacons and Tracking Technologies

13.1 Legal objective

To inform the Data Subject of the use of cookies, web beacons and other similar tracking technologies within the website and the Platform, in compliance with Article 16, section II, of the Regulations of the Law.

13.2 Definition and operation

Cookies are small data files stored on the Data Subject's device when browsing the Platform's website, allowing the device to be recognized on subsequent visits; web beacons are images inserted into an internet page or email, used to monitor the visitor's behavior.

13.3 Categories of cookies used

The Data Controller uses, by way of illustration but not limitation: (i) strictly necessary cookies, indispensable for the basic operation of the site and the Platform, for which consent is not required; (ii) preference cookies, which allow remembering the settings chosen by the Data Subject; (iii) analytics or performance cookies, which allow learning aggregate browsing patterns for site improvement purposes; and (iv) marketing cookies, used to show relevant advertising, when such functionality is enabled.

13.4 Personal Data obtained through cookies

Through cookies and similar technologies, the Data Controller may obtain data such as the Data Subject's browser type and operating system, the pages visited within the site, browsing time, searches performed, and other technical and browsing data.

13.5 Settings mechanism

The Data Subject may disable the use of non-essential cookies through the privacy settings panel available on the Platform's website, or through their own browser's settings, the Data Subject acknowledging that disabling certain cookies may affect the full functionality of the site or the Platform.

13.6 Consequences of non-compliance

The use of non-strictly-necessary cookies without duly informing the Data Subject under this Chapter, or without offering the corresponding settings mechanism, shall constitute a breach of the information principle provided in the Law and its Regulations.

TITLE V. ARCO RIGHTS, LIMITATION OF USE AND DISCLOSURE, AND REVOCATION OF CONSENT

Chapter 14. Rights of Access, Rectification, Cancellation and Objection (ARCO Rights)

14.1 Legal objective

To inform the Data Subject, clearly and completely, of the rights the Law grants them regarding their Personal Data, in compliance with Article 16 of the Regulations of the Law.

14.2 Right of Access

The Data Subject has the right to know what Personal Data of theirs the Data Controller holds, what it is used for and the conditions of its processing, and may request a copy of such data in the format in which it is held, save the limitations provided in the Law.

14.3 Right of Rectification

The Data Subject has the right to request the correction of their Personal Data when it is inaccurate, incomplete or outdated, accompanying their request with the documentation supporting the requested correction, when it is reasonably required given the nature of the data.

14.4 Right of Cancellation

The Data Subject has the right to request that their Personal Data be deleted from the Data Controller's databases when they consider it is not being processed in accordance with the principles and obligations provided in the Law, or when it has ceased to be necessary for the purposes informed in this Notice, subject to the exceptions provided in Article 26 of the Law.

14.5 Right of Objection

The Data Subject has the right to object to the processing of their Personal Data for specific purposes when they have a legitimate cause for it, or to object unconditionally regarding the secondary purposes indicated in Chapter 8, without needing to establish any cause for the latter category.

14.6 Right to Data Portability

The Data Subject has the right to request, where technically possible, delivery of their Personal Data in a structured, commonly used, machine-readable format, allowing them to transmit it to another controller, as detailed in Chapter 18.

14.7 Nature of the rights

ARCO Rights are strictly personal, so they may only be exercised by the Data Subject themselves or by their duly accredited legal representative, following verification of identity or of the corresponding representation, pursuant to the procedure described in Chapter 15.

14.8 Consequences of non-compliance

Unjustified refusal of, or failure to timely respond to, the exercise of any of the ARCO Rights recognized in this Chapter shall entitle the Data Subject to file the corresponding complaint before the competent authority, under the terms of Chapter 19.

Chapter 15. Mechanism and Procedure for the Exercise of ARCO Rights

15.1 Request intake channel

Requests for the exercise of ARCO Rights must be addressed to the email address legal@ancuria.com, designated as the official channel for that purpose, or through the specific mechanism that, where applicable, is enabled within the Platform.

15.2 Requirements of the request

Pursuant to Article 29 of the Law, the request must contain at least: (i) the Data Subject's name and domicile or other means to communicate the response; (ii) documents evidencing the Data Subject's identity or, where applicable, the corresponding legal representation; (iii) the clear and precise description of the Personal Data regarding which the corresponding right is sought to be exercised; and (iv) any other element facilitating the location of the Personal Data.

15.3 Response period

The Data Controller will communicate to the Data Subject the determination adopted regarding their request, within a maximum period of twenty business days counted from the date of receipt, making it effective within the fifteen business days following the date the response is communicated, pursuant to Article 32 of the Law.

15.4 Extension of the period

The twenty-business-day period indicated in the preceding section may be extended once only, for an equal period, when the particular circumstances of the request so justify, the Data Controller being obliged to notify that extension to the Data Subject within the original period.

15.5 Free of charge and exceptions

The exercise of ARCO Rights shall be free of charge, the Data Subject only having to cover justified shipping expenses or the cost of reproduction in copies or other formats, pursuant to Article 35 of the Law.

15.6 Grounds for inadmissibility

The Data Controller may deny, totally or partially, the exercise of an ARCO Right in the cases provided in Article 34 of the Law, including when: (i) the requester is not the Data Subject or their duly accredited legal representative; (ii) the Personal Data is not in the Data Controller's databases; (iii) a third party's rights would be harmed; (iv) a legal impediment exists; or (v) a right acquired by a third party in good faith would be limited, the Data Controller being obliged to ground and motivate such refusal in its response.

15.7 Consequences of non-compliance

Non-compliance with the deadlines or procedural requirements provided in this Chapter shall constitute a breach of the Law, entitling the Data Subject to go before the competent authority under the terms of Chapter 19.

Chapter 16. Revocation of Consent

16.1 Right of revocation

The Data Subject may revoke, at any time, the consent they may have granted for the processing of their Personal Data, without such revocation having retroactive effects regarding the processing previously carried out.

16.2 Revocation mechanism

Revocation of consent may be requested through the same channel indicated in section 15.1 for the exercise of ARCO Rights, following a procedure analogous to that described in Chapter 15.

16.3 Effects of revocation on primary purposes

The Data Subject acknowledges that revocation of consent regarding the primary purposes indicated in Chapter 7 may imply the impossibility of the Data Controller continuing to provide the Service, in which case the revocation shall take effect as a request for cancellation of the corresponding Account, subject to the provisions of the Terms and Conditions of Service.

16.4 Effects of revocation on secondary purposes

Revocation of consent regarding the secondary purposes indicated in Chapter 8 shall take effect exclusively on those purposes, without affecting the continuity of the Service engaged by the Data Subject.

16.5 Consequences of non-compliance

Failure to timely attend to a request for revocation of consent shall constitute a breach of the Law, with the corresponding administrative consequences.

Chapter 17. Mechanisms to Limit the Use or Disclosure of Personal Data

17.1 Legal objective

To inform the Data Subject of the additional mechanisms, other than the formal exercise of ARCO Rights, that the Data Controller makes available to limit the use or disclosure of their Personal Data, pursuant to Article 16 of the Regulations of the Law.

17.2 Privacy preferences panel

The Data Controller shall make available to the Data Subject, within their Account settings, a preferences panel allowing them to simply activate or deactivate the processing of their Personal Data for secondary purposes, without needing to file a formal request pursuant to Chapter 15.

17.3 Public Registry of Users (REPEP)

Additionally, the Data Subject may register their contact data in the Public Registry of Users that, where applicable, corresponds under applicable consumer protection legislation, in order to limit the receipt of advertising generally, not limited to the Data Controller.

17.4 Opt-out of marketing communications

Every marketing communication sent by the Data Controller will include a simple, free-of-charge mechanism for the Data Subject to request opt-out from such communications, which will be handled promptly, without need for any justification.

17.5 Consequences of non-compliance

Failure to implement or timely attend to the use and disclosure limitation mechanisms indicated in this Chapter shall constitute a breach of the consent principle and of the duty to facilitate the exercise of rights provided in the Law.

Chapter 18. Right to Data Portability

18.1 Scope of the right

The Data Subject may request from the Data Controller delivery of their Personal Data in a structured, commonly used, machine-readable format, regarding those data the Data Subject themselves provided directly to the Platform, for the purpose of facilitating their transmission to another controller, where technically possible.

18.2 Limitations of the right

The right to portability shall not apply regarding: (i) data derived or inferred by the Data Controller from the data provided by the Data Subject, including Market Indicators generated by the Platform; (ii) third parties' data contained in the Data Subject's databases, when their exportation could violate those third parties' rights; and (iii) information protected by the Data Controller's industrial secrets or intellectual property, under the terms of the Title on Intellectual Property of the Terms and Conditions of Service.

18.3 Procedure

The portability request shall be subject to the same procedure and deadlines provided in Chapter 15 for the exercise of ARCO Rights.

18.4 Consequences of non-compliance

Unjustified refusal to attend to a portability request that is admissible under this Chapter shall constitute a breach of the Law.

TITLE VI. SECURITY MEASURES, RETENTION, VALIDITY AND PROCEEDINGS BEFORE THE AUTHORITY

Chapter 19. Security Measures

19.1 Legal objective

To inform the Data Subject of the Data Controller's commitment to implementing security measures for the protection of their Personal Data, in compliance with Articles 19 of the Law and 61 of its Regulations.

19.2 Administrative measures

The Data Controller implements internal information-access policies, training for its personnel and collaborators on Personal Data protection, and assignment of specific responsibilities regarding the processing of such data.

19.3 Technical measures

The Data Controller implements logical access controls, encryption of information in transit and, where applicable, at rest, database segmentation, authentication mechanisms for system access, and monitoring of the technology infrastructure hosting the Personal Data.

19.4 Physical measures

Regarding the Data Controller's own physical infrastructure, where it exists, facility access controls are implemented; regarding cloud infrastructure provided by third parties, the Data Controller obtains the certifications and contractual physical-security guarantees those providers offer according to industry standards.

19.5 Proportionality of the measures

The security measures implemented by the Data Controller are proportional to the existing risk, the type of Personal Data processed, and the Platform's technological development, the Data Controller committing to their periodic review and update as that risk evolves.

19.6 Consequences of non-compliance

Failure to implement reasonable security measures shall constitute a breach of the accountability principle provided in the Law, with the corresponding administrative consequences, without prejudice to the civil liability that could derive toward the affected Data Subjects.

Chapter 20. Notification of Security Breaches

20.1 Legal objective

To establish the procedure the Data Controller will follow in the event of a security breach significantly affecting Data Subjects' property or moral rights, in compliance with Article 20 of the Law.

20.2 Breach scenarios

A security breach shall be considered, by way of illustration but not limitation: the unauthorized loss or destruction of Personal Data; the theft, misplacement or unauthorized copying of such data; and their unauthorized use, access or processing.

20.3 Notification procedure

Upon a security breach that is significant pursuant to section 20.1, the Data Controller shall notify that circumstance to the affected Data Subjects, without unjustified delay, through the contact means registered in the Platform, informing: (i) the nature of the incident; (ii) the compromised Personal Data; (iii) recommendations to the Data Subject on measures they may adopt to protect their interests; (iv) the corrective actions carried out immediately; and (v) the means to obtain further information.

20.4 Root-cause analysis and corrective measures

The Data Controller will carry out an analysis of the causes of the security breach, and will implement the necessary corrective and preventive actions to adjust the corresponding security measures, in order to avoid subsequent breaches of a similar nature.

20.5 Consequences of non-compliance

Omitting to notify a significant security breach, or notifying it late or incompletely, shall constitute a material breach of the Law, with the corresponding administrative and, where applicable, criminal consequences.

Chapter 21. Personal Data Retention and Blocking Period

21.1 Legal objective

To inform the Data Subject of the retention criteria for their Personal Data, in compliance with the data-quality principle provided in Article 11 of the Law and the blocking, cancellation and deletion procedure provided in Article 65 of the Regulations.

21.2 General retention criterion

The Data Controller shall retain the Data Subject's Personal Data for the time necessary to fulfill the purposes informed in this Notice and, subsequently, for the additional period necessary to address legal, tax or accounting obligations or to handle liabilities deriving from the processing.

21.3 Specific retention periods

By way of illustration: (i) the data associated with the Data Subject's Account shall be retained while it is active, and for the additional period indicated in the Terms and Conditions of Service following its cancellation; (ii) tax and invoicing data shall be retained for the period required by applicable tax legislation; and (iii) interactions with the Artificial Intelligence Agents shall be retained for the period the Data Controller reasonably determines necessary for the quality control and improvement purposes indicated in Chapter 9, after which they shall be anonymized or deleted.

21.4 Blocking procedure

Once the retention periods indicated in this Chapter have elapsed, the Data Controller shall proceed to block the corresponding Personal Data, consisting of its identification and storage with the sole purpose of preventing its processing except for the eventual handling of liabilities deriving from it, until expiration of the applicable statute-of-limitations period, at which time it shall proceed to its definitive deletion.

21.5 Consequences of non-compliance

Retention of Personal Data beyond what is strictly necessary for the informed purposes, without observing the blocking procedure provided in this Chapter, shall constitute a breach of the data-quality principle provided in the Law.

Chapter 22. Validity and Amendments to the Privacy Notice

22.1 Entry into force

This Notice shall enter into force on the date stated on the cover page of this document, and shall remain in force until replaced by an updated version pursuant to this Chapter.

22.2 Power to amend

The Data Controller reserves the right to modify or update this Notice at any time, to address legislative developments, case-law or competent-authority criteria, new processing purposes, changes in its business model, or the incorporation of new modules or features into the Platform.

22.3 Change notification mechanism

Every modification to this Notice shall be communicated to the Data Subject through at least one of the following means: (i) a visible notice within the Platform; (ii) email to the address registered by the Data Subject; or (iii) publication of the updated version on the Data Controller's website, visibly indicating its last-update date.

22.4 Material amendments

When a modification implies a material change in the processing purposes, particularly the incorporation of a new purpose requiring express consent, the Data Controller shall collect such consent prior to the application of the corresponding modification, and may not apply it retroactively to Data Subjects who have not granted it.

22.5 Consequences of non-compliance

Applying a material modification without the notification or consent required by this Chapter shall constitute a breach of the information and consent principles provided in the Law.

Chapter 23. Proceedings before the National Institute for Transparency, Access to Information and Personal Data Protection

23.1 Data Subject's non-waivable right

Without prejudice to the direct-resolution mechanisms provided in this Notice, the Data Subject has a non-waivable right to go before the National Institute for Transparency, Access to Information and Personal Data Protection (hereinafter, "INAI"), or before the body that in the future proves competent in the matter, when they consider that their Personal Data protection rights have been violated.

23.2 Rights Protection Proceeding

The Data Subject may initiate a Rights Protection Proceeding before the INAI within the fifteen days following the date the Data Controller responded to an ARCO Rights exercise request, or from the expiration of the period for such response without the Data Controller having pronounced itself.

23.3 Verification Proceeding

Independently of the foregoing, the Data Subject may report to the INAI suspected violations of the Law by the Data Controller, giving rise, where applicable, to the initiation of a Verification Proceeding by that authority.

23.4 Data Controller's collaboration with the authority

The Data Controller undertakes to collaborate diligently with the INAI in the development of any proceeding deriving from the exercise of the powers indicated in this Chapter, providing the information and documentation legally required of it.

23.5 Consequences of non-compliance

The Data Controller's failure to collaborate with the competent authority, or obstruction of its verification powers, shall constitute an additional breach of the Law, aggravating the sanctions that, where applicable, apply.

Chapter 24. Third-Party Artificial Intelligence Assistants (Including ChatGPT)

24.1 Objective

To inform the Data Subject, in compliance with the identification and information duties provided in the Law, that the Platform offers part of its services through third-party artificial intelligence assistants, including ChatGPT, operated by OpenAI.

24.2 Scope of the channel

Through such assistants, users may (i) search the Platform's rental listings and consult their details and photographs; (ii) obtain payment-plan, mortgage and rental-return estimates prepared with Mexican reference rates; and, when this feature is enabled, (iii) submit a request to visit a property.

24.3 Personal Data processed through this channel

For the purposes of clause 24.2(iii), the Platform processes the user's name, email address or WhatsApp telephone number, and their viewing preferences (preferred dates, property of interest, number of occupants, pets and any message), exclusively following the user's express confirmation within the conversation. No financial data or official identification documents are requested through this channel.

24.4 Processing by the assistant provider

The conversation through which the user accesses the Platform is processed by the assistant's provider (OpenAI, United States of America) in its capacity as provider of the channel, which may entail the international communication of Personal Data under the terms disclosed in this Notice. The information the user submits through a viewing request is transmitted to the Platform's servers and treated in accordance with this Notice.

24.5 Exercise of rights

Data Subjects may exercise their ARCO rights in relation to the Personal Data processed through this channel through the official channel designated in this Notice (legal@ancuria.com).

Chapter 25. Final Provisions

25.1 Interpretation according to the Law

This Notice must at all times be interpreted according to the Law and its Regulations, the interpretation most favorable to the protection of the Data Subject's Personal Data prevailing in case of ambiguity.

25.2 Severability

Should any provision of this Notice be declared null, illegal or unenforceable by a competent authority, such declaration shall not affect the validity and enforceability of the remaining provisions.

25.3 Governing language

If this Notice is translated into another language for territorial expansion purposes, the Spanish (Mexico) version shall prevail for interpretation purposes in case of discrepancy, save contrary local legal provision.

25.4 Relationship to other documents

This Notice is understood without prejudice to the specific Personal Data protection provisions contained in the Platform's Terms and Conditions of Service, the provisions of this Notice having to prevail, in case of specific discrepancy on this subject matter, pursuant to what is indicated in section 2.3.

Version Control Annex

Version	Effective date	Description of the change
1.0	September 22, 2026	Initial version of the document
1.1	October 15, 2026	New Chapter 24 (third-party AI assistants, including ChatGPT); hosting-region placeholder filled (United States of America); Final Provisions renumbered as Chapter 25