Sirio Privacy NoticePrivacy Notice

1. Identity and Address of the Data Processor.

   In accordance with the provisions of the Federal Law for the Protection of Personal Data Held by Private Parties (the “Data Law”), its Regulations, the Privacy Notice Guidelines, and other applicable provisions, we inform you that Sirio Soluciones Digitales SAPI de CV, with address at Lago Neuchatel 45, Int B2002, Ampliación Granada, Miguel Hidalgo, C.P. 11529, Mexico City, Mexico, acts as data processor for the personal data collected by the producer organization that obtained your personal data in its capacity as data controller, which will be processed in accordance with the terms of this privacy notice (the “Privacy Notice”).

2. Contact Information.

   If you would like any information regarding this Privacy Notice or in connection with exercising any of your rights arising from the processing of your personal data, you may contact the following email address: [email protected] (the “Contact Person”).

3. Purposes of the Processing of Your Personal Data.

   Your personal data will be processed with your consent for the purposes detailed below:

   1. Necessary purposes:
   2. Processing of data for the technical management of production, issuance of receipts, generation of internal reports, traceability analysis, and compliance with certification standards.
   3. Advanced analysis to identify patterns unique to the organization. This level transforms data into personalized recommendations and dashboards that optimize strategic decision-making.
   4. Non-necessary purposes:
   5. Use of anonymized and aggregated data to identify trends among different organizations in the region. This level is optional and requires explicit activation by the organization.

   Likewise, your personal data may be processed without your consent in the following cases: (i) when a legal provision so provides; (ii) when the personal data appear in publicly accessible sources; (iii) when the personal data are subject to a prior dissociation procedure; (iv) when the personal data are necessary to exercise a right or comply with obligations arising from a legal relationship between the data subject and the controller; (v) when there is an emergency situation that could potentially harm an individual or their property; (vi) when the personal data are essential for processing related to medical care, prevention, diagnosis, provision of health care, or management of health services, pursuant to applicable law; or (vii) when there is a court order, resolution, or a substantiated and reasoned mandate from a competent authority.

4. Personal Data to Be Processed.

   To achieve the purposes mentioned in Section III above, the following personal data of the Data Subject may be processed, without limitation:

   1. Contact and identification data: Name, phone number, identity number (CURP/DPI/DNI or national equivalents), digital signature, labor and agronomic practices (use of agrochemicals, fertilizers, etc.), cultivated varieties, processing, and traceability.
   2. Financial or asset data: Production volumes, sale prices, income, cultivated hectares, land tenure status, credits, and receipts.
   3. Sensitive data: Membership in indigenous ethnic groups, family composition, education level, photographs, GPS coordinates, centroids, and polygons of plots or apiaries.
5. Means to Exercise Your ARCO Rights.

   The Data Subject may at any time exercise their rights of access, rectification, cancellation, or objection to the processing we give to their personal data (the “ARCO Rights”) before the controller of their personal data. It is important to mention that the exercise of each of these rights is independent of the others; that is, it is not necessary to exhaust one in order to exercise any of the others.

   Each of these rights, respectively, allows you to:

   1. Access: The Data Subject may request at any time to know what data about them has been collected, as well as the details of its processing.
   2. Rectification: If any of your data is inaccurate or incomplete, you may request its correction in the databases, and must attach documentation supporting such modification.
   3. Cancellation: You may request at any time the cancellation of your personal data when you consider that it is not required for the purposes for which it was collected, or that it is being used for purposes not consented to, or that the legal relationship has ended; if the request is deemed appropriate, the data will be blocked and may not be processed in any way.
   4. Objection: The Data Subject may object at any time to the processing of their personal data when there is a legitimate cause and their specific situation so requires, or when the personal data is subject to automated processing that produces undesired legal effects or significantly affects their interests, rights, or freedoms.

   To exercise the ARCO Rights, the Data Subject or their legal representative must complete the “ARCO Rights Exercise Request” and send it, scanned, to the controller’s email address, or to Sirio, which may act as a facilitator of the request, addressed to the Contact Person, for handling and follow-up.

   It is important that you consider the following points when sending or submitting your request:

   1. The request must be filled out completely and clearly, in block letters.
   2. Indicate your name, address, and email address so that we may communicate the response to your request.
   3. Indicate the personal data with respect to which you seek to exercise any of the rights.
   4. Attach any document or information that facilitates locating your personal data.
   5. Attach a copy of the document proving the identity of the Data Subject (voter ID, professional license, or valid passport).
   6. If the request is processed through a legal representative, include the notarized power of attorney evidencing the authority granted by the data subject for this procedure, or a letter of authorization granted by the data subject with the acceptance signature of the representative, in the presence of two witnesses, including the name, signature, address, and photocopy of the official identification of each of the signatories.
   7. For rectification of data, attach documentation supporting such modification.

   The response will be sent to the email address indicated in your request within a maximum period of 20 (twenty) business days from the day your request was received. If your request is answered affirmatively or is deemed appropriate, the requested changes will be made within a maximum period of 15 (fifteen) business days. If you request access to your personal data, the controller of your personal data will inform you, through the email in which we communicate our response to your request, of the means by which you will be given access to your information, if applicable. The Controller may extend the periods referred to in this paragraph, once, for a period equal to the original, which will be communicated to you.

   The Controller may deny the exercise of your ARCO Rights, in the cases permitted by the Data Law, and must inform you of the reason for such decision. The denial may be partial, in which case the Controller will carry out the access, rectification, cancellation, or objection to the extent applicable.

   If you believe that your personal data protection rights have been harmed by any conduct of our employees or by our actions or responses, or you suspect that there has been a violation of the provisions of the Data Law in the processing of your personal data, you may file the corresponding complaint or report with the Anti-Corruption and Good Government Secretariat.

6. Use of Cookies and Other Tracking Technologies.

   IP addresses, device type, operating system, and login geolocation may be collected solely to detect unauthorized access and optimize the performance of our technology platforms. They are not used for third-party advertising profiles.

7. Means to Limit the Use or Disclosure of Your Personal Data or to Revoke Consent to Its Processing.

   To limit the use or disclosure of your personal data or to revoke your consent to the processing of your personal data, you must contact the controller of your data, or Sirio, which may act as a facilitator of your request, if you send it to the Contact Person.

   Please note that it may not always be possible to fulfill your request or immediately conclude the processing of your personal data, since a legal obligation may require us to continue processing your personal data. Revoking your consent to the processing of your personal data may result in the impossibility of continuing our legal relationship.

8. Transfers and Remittances of Your Personal Data.

   We inform you that your personal data may be transferred within Mexico or abroad, for the following purposes:

   Recipient	Purpose
   Aggregated data for funding partners	Monitoring, tracking, and evaluation of the project's impact.
   External actors	Support in the execution and fulfillment of the purposes set forth in this Privacy Notice.
   Marketing or public relations third parties	Dissemination and communication of the project's social and environmental impact.
   Any authority	For the purpose of complying with any applicable law, regulation, or legal provision when the transfer is mandatory.

   If you do not want your personal data to be transferred under the terms described above, you may state so from the moment you provide us with your personal data or, at any time thereafter, following the procedures described in the privacy notice of the controller of your personal data or in this Privacy Notice.

9. Changes or Modifications to the Privacy Notice.

   The Processor reserves the right to make modifications or updates to this Privacy Notice at any time, it being understood that any modification thereto will be made known to the Data Subject through the visible publication of a new privacy notice on our website www.sirioapp.com and/or by email.

   This Privacy Notice applies to personal data collected through the Sirio application. Consent for the processing of personal data, including sensitive data, is obtained through a digital signature on the mobile device used to capture information in the field, under the terms described in this Notice. For more information about the applicable consent mechanisms, you may contact us at [email protected].