COMPREHENSIVE PRIVACY NOTICE

At drapiar IT, we recognize that information and personal data constitute vital assets that must be processed with responsibility, security, transparency, and respect. Therefore, all personal data processing carried out byBPM & Low-Code Orchestration | drapiar IT complies strictly with the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and applicable legal provisions, upholding the principles of legality, purpose, loyalty, consent, quality, proportionality, transparency, and accountability.

1. Controller Identity and Address

DRAPIAR IT, Sociedad por Acciones Simplificada de Capital Variable, holder of Tax ID (RFC) DIT240201SD6, commercially known as drapiar IT, located at Avenida Américas No. 1254, Office 1, Floor 10, Colonia Country Club, C.P. 44610, Guadalajara, Jalisco, Mexico, is responsible for collecting, processing, safeguarding, and, where applicable, transferring the personal data it collects directly from data subjects.

For any inquiries regarding privacy, personal data protection, exercising ARCO rights, consent revocation, or limiting the use or disclosure of information, you may contact us at:

• Email: consultoria@drapiarit.com
• Website: www.drapiar-it.com
• Privacy Officer: Privacy and Personal Data Protection Area ofBPM & Low-Code Orchestration | drapiar IT

2. Personal Data We May Collect

Depending on your relationship withBPM & Low-Code Orchestration | drapiar IT, we may collect and process, among others, the following categories of personal data:

Identification & Contact Data: First name, last name, company name, position, job title, email address, telephone number, mailing address, signature, and other data necessary to establish communication or maintain a commercial, professional, or contractual relationship.

Professional & Employment Data: Company of employment, job position, area of responsibility, professional background, and representation details within an organization. In recruitment processes, resume data, work history, academic background, certifications, references, and information voluntarily provided by applicants may additionally be processed.

Tax & Billing Data: Tax ID (RFC), legal business name, tax regime, registered tax address, tax status certificate, and billing/invoicing information necessary to comply with accounting, tax, and administrative obligations.

Financial or Assets Data: When essential to establish or execute a commercial or legal relationship, banking information, payment history, and necessary financial data may be processed. Where required by law, explicit written consent will be requested through corresponding channels.

Technical & Browsing Data: When interacting with our websites, applications, digital forms, or portals, we may collect: IP address, browser type, operating system, device identifiers, technical access logs, date and time of connection, pages visited, referral sources, cookies, and technical security logs.

Information Provided Through Digital Solutions: When interacting directly with virtual assistants, chatbots, AI agents, forms, or software platforms operated directly byBPM & Low-Code Orchestration | drapiar IT, we process the information voluntarily provided to service your request and deliver corresponding capabilities.

3. Sensitive Personal Data

drapiar IT does not ordinarily request sensitive personal data through its website or general commercial activities. Should a specific project, employment relationship, or legal obligation require processing sensitive data,BPM & Low-Code Orchestration | drapiar IT will apply enhanced security safeguards and obtain explicit written consent where legally mandated. Processing will remain strictly limited to legitimate, necessary, and proportionate purposes.

4. Primary Processing Purposes

Personal data may be processed for the following necessary purposes to establish, maintain, and fulfill commercial, technical, or contractual relationships:

• Identifying and contacting clients, prospects, suppliers, partners, and corporate representatives.
• Attending to inquiries received via websites, forms, email, phone, events, social media, or authorized channels.
• Analyzing business requirements and operational scope.
• Conducting technical diagnostics and process audits.
• Preparing technical demonstrations, proof-of-concept projects, proposals, and quotes.
• Managing commercial opportunities.
• Formalizing contracts, purchase orders, non-disclosure agreements (NDAs), and legal instruments.
• Designing, building, configuring, deploying, integrating, operating, maintaining, and supporting tech solutions.
• Providing technical consulting, training, implementation support, and SLA services.
• Managing relationships with clients, vendors, technology partners, and corporate allies.
• Managing billing, collection, payments, and accounting compliance.
• Administering user access to platforms, applications, or cloud infrastructure.
• Delivering customer support and project tracking communications.
• Maintaining operational and administrative records.
• Preventing fraud, unauthorized access, and cybersecurity incidents.
• ProtectingBPM & Low-Code Orchestration | drapiar IT's digital infrastructure and assets.
• Fulfilling legal, administrative, tax, and contractual obligations.
• Complying with valid legal mandates from competent authorities.
• Managing privacy and data protection rights requests.
• Ensuring availability, integrity, continuity, and security of our systems and services.

5. Secondary Processing Purposes

Additionally, where permitted by law, contact data may be utilized for:

• Sending commercial updates regardingBPM & Low-Code Orchestration | drapiar IT solutions and services.
• Announcing new technological capabilities, software products, and features.
• Sharing specialized content on artificial intelligence, hyperautomation, and digital transformation.
• Sending executive newsletters, technical Whitepapers, and industry reports.
• Inviting data subjects to webinars, technology conferences, and corporate events.
• Conducting marketing, positioning, and promotional campaigns.
• Performing market research and statistical analytics.
• Measuring client satisfaction and user experience.

These secondary purposes are not required to maintain a commercial or contractual relationship withBPM & Low-Code Orchestration | drapiar IT. You may opt out at any time by emailing consultoria@drapiarit.com without affecting contracted services or ongoing engagements.

6. Artificial Intelligence, Automation & Tech Processing

Due to the nature of our technological services, processes may utilize technologies including: Artificial Intelligence, Generative AI, AI Agents, Large Language Models (LLMs), Robotic Process Automation (RPA), Hyperautomation, Intelligent Document Processing (IDP), Optical Character Recognition (OCR), Data Analytics, Low-Code Platforms, APIs, Integration Systems, and Cloud Infrastructure.

WhenBPM & Low-Code Orchestration | drapiar IT acts as data controller for processing conducted through these technologies, activities are strictly governed by this Privacy Notice and enforced with corresponding data protection safeguards.

Where automated processing could produce legal effects or significantly impact individual rights, data subjects may exercise applicable legal rights under governing laws.

The adoption of artificial intelligence, algorithms, or automated systems does not reduce or eliminateBPM & Low-Code Orchestration | drapiar IT's commitments to confidentiality, security, and data protection.

7.BPM & Low-Code Orchestration | drapiar IT as Data Processor for Clients

Certain projects may requireBPM & Low-Code Orchestration | drapiar IT to access, store, process, integrate, or transmit data belonging to client organizations. In these instances,BPM & Low-Code Orchestration | drapiar IT acts as a **Data Processor** on behalf of the client (Data Controller).

When acting as a Processor,BPM & Low-Code Orchestration | drapiar IT processes data exclusively in accordance with: Documented client instructions, Applicable service contracts, Non-disclosure agreements (NDAs), Data Processing Agreements (DPAs), Established security measures, Authorized technical scopes, and Applicable privacy laws.

The client remains responsible for determining processing purposes and providing notice to data subjects.BPM & Low-Code Orchestration | drapiar IT acquires no ownership rights over client data.

8. Technology Providers and Sub-Processors

To deliver our solutions,BPM & Low-Code Orchestration | drapiar IT relies on specialized technology providers for cloud infrastructure, hosting, data storage, cybersecurity, AI models, automation, CRM, databases, and communications tools. All sub-processors are bound by strict contractual, technical, organizational, and confidentiality obligations.

9. Domestic and International Data Transfers

drapiar IT may perform domestic or international data transfers when necessary to: Fulfill contractual agreements, Deliver requested services, Comply with statutory obligations, Respond to legal mandates from authorities, Protect legal rights, or Execute necessary operations with authorized technology sub-processors under applicable law.

Where prior consent is required for a transfer, appropriate mechanisms will be implemented. Refusal of consent for non-essential transfers will not impair primary service delivery.

10. Cookies and Similar Technologies

drapiar IT digital portals use cookies, web beacons, and tags to: Ensure technical website operation, Safeguard session security, Remember language and user preferences, Analyze traffic patterns anonymously, Measure site performance, and Enhance user experience.

Non-essential cookies remain subject to user consent and can be updated at any time via the Cookie Settings banner or browser settings.

11. Security and Information Protection

Information security is vital toBPM & Low-Code Orchestration | drapiar IT operations. We maintain administrative, physical, and technical controls proportional to risk to protect personal data against: Loss, Damage, Alteration, Destruction, Misuse, Unauthorized Access, Disclosure, or Processing.

12. Data Retention, Blocking, and Erasure

Personal data is retained only for periods necessary to fulfill processing purposes, maintain contractual ties, meet legal or tax requirements, and manage potential legal liabilities. Upon expiration of applicable periods, data is safely blocked, erased, or anonymized.

13. ARCO Rights (Access, Rectification, Cancellation, Opposition)

Data subjects hold the right to exercise ARCO Rights:

• Access: Learn what personal data we hold and its processing conditions.
• Rectification: Request correction of inaccurate or incomplete data.
• Cancellation: Request erasure of data records when legally applicable.
• Opposition: Object to processing for specific secondary purposes.

Submit ARCO requests to consultoria@drapiarit.com including: Full name, contact details, identity verification documents, clear description of data involved, and specific ARCO right exercised.

14. Revocation of Consent

Consent may be revoked at any time by emailing consultoria@drapiarit.com. Revocation operates prospectively without retroactive impact, subject to statutory retention requirements.

15. Limitation of Use or Disclosure

To limit the use of your data for promotional communications, contact consultoria@drapiarit.com or use automated unsubscribe links in executive communications.

16. Minors

drapiar IT services target commercial enterprises and adults. We do not knowingly collect personal data from minors. If identified, appropriate steps are taken to remove such records.

17. Third-Party Platforms and Social Media

Information shared on third-party platforms remains subject to respective privacy policies.BPM & Low-Code Orchestration | drapiar IT is responsible solely for data directly collected under its control.

18. Modifications to this Privacy Notice

Updates reflecting legal, technical, or operational changes will be posted on www.drapiar-it.com. Material changes requiring consent will be communicated accordingly.

19. Competent Authority

Data subjects believing their data protection rights have been infringed may appeal to competent data protection authorities under applicable law.

20. Consent

By providing personal data toBPM & Low-Code Orchestration | drapiar IT after reviewing this notice, you acknowledge having been informed of processing terms and purposes.