I. Data Controller; Data Processor

Newschool Latam, S.A.P.I. de C.V. (“NSL”), a company domiciled at Calle 8 de Mayo número 27, Colonia Lomas Manuel Ávila Camacho, Naucalpan de Juárez, Estado de México, Código Postal 53910, Mexico, in compliance with the Federal Law on Protection of Personal Data Held by Private Parties (the “Law”), its Regulations, and Guidelines, is responsible for the use and protection of your personal data. In this regard, NSL informs you that it collects and processes your personal data for the purposes set forth in this Comprehensive Privacy Notice (the “Privacy Notice”).

The Controller informs that, in order to collect and process the personal data referred to in this Privacy Notice, it may rely on individuals or legal entities acting as “Data Processors” in accordance with the Law (the “Processor”).


II. Purpose of Processing

NSL requests and/or collects personal data directly or through the Processor via written or electronic means, including forms and questionnaires (written or electronic), digital platforms such as the “EnCorto” platform, websites, email, WhatsApp, telephone, or SMS (the “Means”).

Additionally, NSL or the Processor may collect personal data indirectly through information transfers from affiliated companies and/or authorized third parties.

Personal data provided to the Controller and/or Processor by individuals of legal age, whether Mexican or foreign (the “Individuals”), will be processed in accordance with the principles established in the Law (lawfulness, consent, information, quality, purpose, loyalty, proportionality, and accountability). Therefore, the Controller does not collect personal data from minors.

This Privacy Notice specifically applies to information obtained by NSL through the Means in relation to individuals interested in obtaining loans, financing, or payment facilities for the purchase of goods in establishments where the “EnCorto” platform (the “Platform”) operates, including prior review of their credit history to assess payment capacity and responsibility, for the following primary and secondary purposes:

Primary Purposes:

A. To provide you with general information about the Platform;
B. To verify the identity of Individuals based on the identification and information they provide;
C. To carry out your registration on the Platform;
D. Initial consultation and periodic review of credit history and background before credit bureaus;
E. Evaluation of the behavior and authenticity of the email accounts provided for the integration of Individuals’ files, as well as for contact with them;
F. For third parties authorized by NSL to evaluate the payment capacity and credit profile of the Individual based on the information and documentation provided by them;
G. Integration of Individuals’ files, regardless of whether they are approved or not for the granting of loans or credit;
H. To integrate Personal Data of third parties related to Individuals indicated as references or contact means;
I. To confirm the purchase of goods through the use of the Platform in establishments authorized by NSL;
J. To contact Individuals for the purpose of presenting options for loans, financing or payment facilities for the purchase of goods in establishments where the Platform operates;
K. To communicate Platform updates.

In the development of the Primary Purposes mentioned above, the Controller and/or its Processors and/or the third parties that grant loans, financing or payment facilities, may carry out the disclosure, dissemination and/or transfer of Personal Data to third parties, for the following purposes:

1. Requesting credit history reports from credit bureaus.
2. Providing those third parties involved in the aforementioned purposes with any information of the Individuals for the monitoring and fulfillment of obligations, commitments and responsibilities assumed and rights of the Individuals; and
3. Disclosing, disseminating and/or transferring Personal Data to third parties acting as collection agencies to carry out extrajudicial collection actions in case of non-compliance by the Individual with the obligations assumed with the Controller and/or third parties related to the credits and loans granted in favor of the Individuals.

The identification and contact data of third parties that Individuals provide to NSL are understood to be shared with the consent of such persons for the processing of their Personal Data in accordance with this Privacy Notice.

In the development of the Primary Purposes mentioned above, the Controller and/or the Processor may carry out the disclosure, dissemination and/or transfer of Personal Data to third parties, for the following purposes:

Secondary Purposes:

(i) Advertising, marketing and commercial prospecting; and
(ii) For surveys that allow NSL to improve the Platform and its activities.

The additional purposes indicated in items (i) and (ii) above are not necessary for the main purposes referred to in this Privacy Notice, therefore You have the right to object or revoke your consent for NSL to stop processing your personal data for such purposes, which you may do through a request addressed to the email ana@newschool.pro

Refusal for the use of Personal Data for these purposes may not be a reason for the Controller to deny services to Individuals.


III. Personal Data Processed

The personal data collected by NSL directly and indirectly through the Means refer to the following (the “Personal Data”):

a) Identification data: Full name, paternal and maternal surnames, date of birth, federal taxpayer registry, CURP, country of birth, nationality, gender, marital status and official identification, full-face photograph, photograph of valid official identification.
b) Contact data: Full home address, full work address, personal email and work email and personal and work landline and mobile phone numbers.
c) Financial data: Monthly income, identification data of bank accounts of which the Individual is the holder for the purpose of setting up recurring charges related to granted loans;
d) Social Media Information: Data and information from Individuals’ social networks, such as Facebook, Instagram, Threads, LinkedIn, X, TikTok, YouTube channel.
e) Third-party data: Full name, relationship or close link with the Individual, landline telephone, mobile phone.

The Personal Data collected by NSL will be processed under the strictest security measures that guarantee its confidentiality, with the understanding that the accuracy, content and scope of the information and/or documentation provided is the sole responsibility of the Individual providing it.


IV. Sensitive Personal Data

The Controller will not require any Sensitive Personal Data from Individuals; however, in the event that any is required, it must notify the Individual in writing, expressly informing the Sensitive Personal Data required, as well as previously requesting the express consent of the data subject in writing, or of the person holding parental authority, guardianship or legal representation in the case of minors or legally incapacitated persons.

In the event that Individuals, without the express request of the Controller, voluntarily and/or by any means provide Sensitive Personal Data of any kind to the Controller, it will be understood that they provide it with express consent simply by providing it.

In all cases, the Controller, in accordance with this Privacy Notice and applicable regulations, will be responsible and careful in giving appropriate use to the Sensitive Personal Information provided by Individuals.


V. Transfer of Personal Data and Sensitive Personal Data.

NSL, without requiring the prior express consent of the Individual concerned, may reveal, disclose and/or transfer within the territory of the United Mexican States as well as abroad the Personal Data provided or collected, in favor of its parent companies, affiliates, subsidiaries and/or related companies, as well as to comply with legal provisions that so require, or when requested by national or foreign authorities.

Likewise, and subject to the purposes established in this Privacy Notice, the Controller may directly or through its Processors, without requiring prior express consent of the Individual concerned, reveal, disclose and/or transfer within the territory of the United Mexican States, as well as abroad, the Personal Data provided or collected, in favor of suppliers, contractors, sponsors, advertisers and/or business partners.

Such third parties will be obligated to comply with this Privacy Notice, as well as with the current and applicable legislation on the matter in the United Mexican States.

The Individual is hereby informed that the Controller will reveal, disclose and/or transfer Personal Data in favor of the following third parties and for the purposes indicated:

In the case of international transfers, NSL will previously verify that the receiving third party has adequate standards of personal data protection equivalent to those provided in the Law. When the receiving country or territory does not offer an equivalent level of protection, NSL will enter into the corresponding binding contractual clauses with the recipient, guaranteeing confidentiality obligations, limitation of processing, restrictions on onward transfers, implementation of appropriate security measures and any other safeguard necessary to protect personal data in accordance with applicable regulations. No international transfer will be carried out without verifiable guarantees of protection.

For transfers that NSL intends to carry out to sponsors, advertisers, non-essential providers, business partners or any third party that does not fall within the exceptions provided in Article 36 of the Law, NSL will previously request the express consent of the Data Subject through the physical or electronic mechanisms established by NSL. Such consent will clearly inform the identity of the receiving third party, the type of data to be transferred and the specific purposes of the transfer. In the event that the Data Subject does not grant such consent, NSL will refrain from carrying out the corresponding transfer.

In the event that NSL requires transferring your Personal Data to any other third party not related to the purposes of this Privacy Notice, we will request your express consent.


VI. Means available to Individuals to exercise rights regarding Personal Data.

In accordance with the provisions of the Law and its Regulations, Individuals have the following rights regarding their Personal Data and Sensitive Personal Data (the “ARCO Rights”): (i) access to them; (ii) rectification when they are inaccurate or incomplete; (iii) cancellation; (iv) revocation; or (v) opposition to the processing of Personal Data of which they are holders so that NSL ceases to use them.

The foregoing is limited to the obligations that NSL must comply with under applicable law.

The exercise of ARCO Rights by Individuals must be carried out through a prior written request addressed to the email ana@newschool.pro as follows.

Individuals interested in exercising any of the ARCO Rights must send to the NSL email indicated in this Privacy Notice a document that must contain at least the following: (i) full name and surnames of the Individual holder of the right to be exercised, full address and email address to which the response will be communicated; (ii) attach documents that duly prove the identity of the Individual, or where appropriate, representation thereof under oath. For this purpose, only a copy of both sides of a valid voter ID and/or a copy of a valid passport will be accepted; and (iii) a detailed, clear and precise description of the Personal Data with respect to which any of the aforementioned rights is to be exercised.

In the case of exercising the right of Rectification, documentation supporting the request must be attached.
NSL will have a period not exceeding 20 (twenty) days counted from the day following the receipt of the corresponding email to respond through the email provided by the Individual.


VII. Retention Period of Personal Data and Sensitive Personal Data; Blocking.

Personal Data provided by Individuals in the possession of NSL will be stored for a period of five (5) years from the date on which they were collected; once said period has elapsed, all Personal Data will be removed from NSL’s database, in order to ensure and preserve the interests of Individuals.

With respect to Sensitive Personal Data that may be provided by Individuals and that are in the possession of NSL, they will be stored for a limited period of one (1) year from the date on which they were collected; once said period has elapsed, all Sensitive Personal Data will be removed from NSL’s database.

Once the purpose for which Personal Data and Sensitive Personal Data were collected has been fulfilled, NSL will retain such data solely for the purpose of determining possible liabilities related to their processing; therefore, they will not be subject to further processing.


VIII. Means to Limit the Use or Disclosure of Personal Data and Sensitive Personal Data

NSL has the necessary physical, technical, administrative and operational security measures for the protection of Personal Data and Sensitive Personal Data that may be provided by Individuals. Likewise, it constantly updates and improves such measures in order to safeguard the right to protection of Personal

Data and Sensitive Personal Data of Individuals in accordance with the Law, its Regulations and Guidelines.

On the other hand, Individuals who wish not to receive or to stop receiving messages, promotions or information via email and/or in printed form and/or by telephone and/or by other means of communication from NSL may request this in writing by sending a request to the email ana@newschool.pro.


IX. Modifications to the Privacy Notice

NSL reserves the right to modify this Privacy Notice, in accordance with the Law, its Regulations and Guidelines, as well as applicable legal provisions in force at any given time, which will be available to Individuals at all times on the website: www.newschool.pro (the “Site”).

NSL will publish such modifications on the Site and will indicate the date of the latest version of the Privacy Notice; therefore, Individuals are advised to periodically visit it in order to be informed of any changes or modifications to the Privacy Notice.

Notices of modification or change to this Privacy Notice will be published on the Site at least 5 (five) business days prior to the effective date of the modified Privacy Notice.

In the event that You do not agree with such modifications, You may send an email to ana@newschool.pro requesting the cancellation of your consent in whole or in part for the processing of your Personal Data.
For any clarification, doubt or request from Individuals regarding this Privacy Notice and/or the handling of their Personal Data, please send an email to ana@newschool.pro


X. Consent of Individuals

The submission of Personal Data by Individuals, access and/or registration through the Site, or the completion and/or submission of forms or questionnaires, registrations or participation in the Platform, implies the granting of express consent by the Individual in favor of NSL, in accordance with the provisions of this Privacy Notice.