General Terms and Conditions of the Services Agreement entered into by the Provider and the Client

Representations

I. The Provider represents, through its legal representative, that: a) It is a commercial company duly incorporated and registered with the corresponding public registry. b) Its corporate purpose includes, among other things, entering into agreements such as the one set forth in this document. c) Its legal representative has sufficient and necessary authority to enter into the Agreement, the General Terms and Conditions, and the Data Processing Agreement, and that none of such authority has been limited or revoked in any way. d) It is its will to enter into the Agreement, the General Terms and Conditions, and the Data Processing Agreement, and that it is willing to render the Service described in the Agreement, under the terms and conditions set forth in these General Terms and Conditions, as well as in the Agreement and the Data Processing Agreement. e) The funds used under the Agreement, the General Terms and Conditions, and the Data Processing Agreement are of lawful origin and will not be used to carry out unlawful activities such as money laundering and financing of terrorism, as defined under applicable laws and international instruments. f) It is in full compliance with its tax obligations, as well as any other administrative obligation that could prevent it from rendering the Service. g) All documents and information set forth in the Agreement are up to date and accurate. h) It acknowledges the absence of fraud, error, bad faith, or any other defect of consent in its will.

II. The Client represents, through its legal representative, that: a) It is a commercial company incorporated under the laws of the United Mexican States, registered with the Public Registry of Property and Commerce corresponding to its corporate domicile. b) Its corporate purpose includes, among other things, entering into agreements such as the one set forth in this document. c) It is its will to enter into the Agreement and receive the Service. d) The address and email address set forth in the Agreement are accurate. e) It acknowledges the absence of fraud, error, bad faith, or any other defect of consent in its will.

Consent. The Parties agree that the elements executed by them in the Services Agreement and in the Data Processing Agreement form an integral part of these General Terms and Conditions and, therefore, of a single Agreement.

Clauses

Clause First – Glossary. For purposes of this Agreement, the General Terms and Conditions, and the Data Processing Agreement, capitalized terms shall have the meaning described below. 1. Agreement. Means the General Terms and Conditions, the Services Agreement, and the Data Processing Agreement, taken together. 2. General Terms and Conditions. The set of clauses and exhibits, as applicable, setting forth the description of the general contracting conditions, and detailing the terms and characteristics generally applicable to the rendering of the Services; the obligations and rights each Party has under applicable legal provisions and, where applicable, those lawfully agreed by the parties for the proper application of the Agreement. 3. Services Agreement. The set of clauses and exhibits, as applicable, setting forth the legal description of the specific contracting conditions and detailing the terms and characteristics particular to the rendering of the Services; the obligations and rights each Party has under applicable legal provisions and, where applicable, those lawfully agreed by the parties for the proper application of the Agreement. 4. Services. The set of services described in the Services Agreement that the Provider will render to the Client in accordance with the terms and conditions established therein. 5. Data Processing Agreement. The set of clauses governing the Processing of Personal Data carried out in connection with the rendering of the Service, whether such clauses are contained in these General Terms and Conditions or, as applicable, in an independent instrument entered into by the Parties as set forth in that clause. 6. Personal Data. Any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws and under Regulation (EU) 2016/679 (the “GDPR”). 7. Processing. Any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, modification, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction. 8. Controller. For purposes of the Data Processing Agreement, the Client and/or any of the companies within its corporate group, in its capacity as the entity that determines the purposes and means of the Processing of Personal Data. 9. Processor. For purposes of the Data Processing Agreement, the Provider, who processes Personal Data on behalf of and under the documented instructions of the Controller. 10. Sub-processor. Any third party, including affiliates of the Processor, engaged by or on behalf of the Processor to process Personal Data in connection with the Agreement. 11. Personal Data Breach. Any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed. 12. Supervisory Authority. Any independent public authority competent in data protection matters, including those established under Article 51 of the GDPR and national authorities with jurisdiction over the Parties. 13. Data Protection Laws. All applicable legislation on personal data protection, privacy, and information security, including, without limitation, the GDPR and the national legislation applicable to the Client.

Terms not defined herein shall have the meaning attributed to them elsewhere in this document. Terms in the singular shall also include the plural, and terms in the plural shall include the singular.

Clause Second – Purpose and Consideration. Under the Agreement, the Provider undertakes to render the Services to the Client and to assign to it the economic rights related thereto, and the Client undertakes to pay the Provider consideration for the Service, upon delivery by the Provider to the Client of the corresponding invoices bearing the correct information of the Parties and meeting applicable tax requirements (the “Consideration”). The Provider acknowledges that it will inform the Client of any findings and recommendations related to the Service. The Service shall be rendered and delivered, and the Consideration shall be paid, in the manner, at the place, on the dates, and to the bank account set forth in the Services Agreement. Where the Consideration is paid by electronic transfer, the Client’s payment obligation is discharged upon the transfer itself and the issuance of the corresponding electronic proof of payment, if available. Without prejudice to the foregoing, the Parties agree that, as set forth in the Services Agreement, the Client may deliver a sum of money or resources, in the percentage of the Consideration defined in the Services Agreement, as a deposit (the “Deposited Amount”), in order to secure performance of its obligation(s). Such amount shall be applied, without prior demand, to the price the Client must pay as Consideration where the Provider has fully performed all of its obligations. Conversely, upon the Provider’s breach of any of its obligations, the Provider shall return the Deposited Amount within 15 (fifteen) calendar days following the date of the Client’s notice to that effect, and may not withhold the Deposited Amount if the Client so requests. The term of the Deposit shall coincide with the term of the Agreement, as well as any extension or renewal thereof. Notices required under the Deposit shall be given as set forth in the Agreement.

Clause Third – Term. The Agreement shall become effective as of its signing date and shall remain in force for the term set forth in the Services Agreement. Either Party may terminate this Agreement by written notice given at least 30 calendar days in advance. Termination of this Agreement shall entail termination of its respective exhibits, as applicable. The Agreement may be terminated at any time by either Party, upon written notice and without the need for a judicial declaration, upon occurrence of any of the following: a) Repeated breach by either Party (for periods exceeding 30 days) of any obligation set forth in the Agreement. b) The Provider’s failure to assign the intellectual property rights referred to in the Agreement to the Client. c) A ruling by a competent authority finally determining that either Party has breached any legal, regulatory, or administrative provision. d) The Service becomes prevented or restricted by applicable law or by an agreement or ruling issued by a competent authority. e) The Parties initiate, or bankruptcy, insolvency, or similar proceedings are initiated against them, within or outside Mexico, or either Party is declared insolvent, is liquidated, is barred from engaging in commerce, or is permanently shut down. f) A strike proceeding is initiated or materializes against either Party, including, without limitation, the filing, formation, or occurrence of a strike.

Clause Fourth – Contractual Penalty. In the event of delay or partial performance in the rendering of the Services, the Client may apply a moratory contractual penalty of 5% of the total amount of the unperformed obligation, in proportion to the Services not rendered under this Agreement, such proportion to be determined by the Client. Notwithstanding the foregoing, upon any breach by the Provider of the obligations described herein, the Client may elect, without the need for any judicial declaration, either to demand performance of the obligation or to rescind the Agreement plus payment of a compensatory contractual penalty of 10% of the total amount of the unperformed obligation, in proportion to the Services not rendered under this Agreement, as applicable, such proportion to be determined by the Client.

Clause Fifth – Intellectual Property. Where the Service consists of creative services, the Provider undertakes to assume liability to third parties and to answer to the Client for the originality and creativity of the Service and all materials related thereto, and undertakes to hold the Client harmless from any claim, suit, or proceeding brought against it as a result of any infringement of third-party intellectual or industrial property rights, and to pay the damages caused to the Client in connection therewith. The Provider shall assign the entirety of the ownership, without reservation, of the goods that are the subject of the Service, shall guarantee that such ownership is not encumbered in favor of any person, and shall irrevocably waive any economic right it may have or claim to have with respect to the goods that are the subject of the Service, its intellectual property, industrial design, license, permit, or authorization, whether before local administrative authorities or before international intellectual property authorities. The Provider acknowledges and agrees that entering into the Agreement does not grant it any authorization to use the trademarks, trade names, patents, licenses, and other industrial or intellectual property rights of the Client or of its subsidiaries, affiliates, parent companies, or entities within the same corporate group, except as expressly authorized in writing by the Client to the Provider. The Provider expressly acknowledges and agrees that all materials prepared by it under the Agreement shall be deemed “works for hire” and the exclusive property of the Client. That is, all tangible results related to the Service, including, without limitation, works in progress, records, diagrams, notes, drawings, specifications, schematics, documents, designs, improvements, inventions, discoveries, developments, trademarks, trade secrets, customer lists, databases, software, programs, middleware, applications, and solutions conceived, made, or discovered by the Provider, whether individually or in collaboration with others, developed solely and exclusively in connection with the Service.

Clause Sixth – Assignment of Rights. Any assignment or transfer, in whole or in part, of the rights and obligations arising under the Agreement, or the assignment of the Agreement, shall be effective only if made in advance and in writing signed by both Parties, except where the Client assigns to subsidiaries, affiliates, parent companies, or entities within the same corporate group, or to a party with which it has an operating contractual relationship, in which case no consent from the Provider shall be required.

Clause Seventh – Force Majeure. In the event of circumstances of force majeure or acts of God preventing performance of the Parties’ obligations under the Agreement, such obligations shall be suspended and the Parties shall not be liable for their non-performance.

The obligations shall resume, and the Parties shall again be liable for their non-performance, once the circumstance causing the suspension ceases to exist.

Clause Eighth – Amendments. The Client may amend the rights, obligations, and terms and conditions of the Agreement or of the Service, and shall notify the Provider in writing thereof — including, without limitation, by email sent to the contact information indicated in the Services Agreement — at least 30 (thirty) calendar days prior to the date on which such amendments take effect. The Client may additionally publish such amendments on its website for informational and record-keeping purposes. The foregoing shall not apply in urgent situations, including, without limitation, those necessary to prevent abuse, to comply with a legal obligation, or to resolve a security or operational issue, in which case the amendments may take effect immediately, with the Provider being notified as promptly as possible.

If the Provider disagrees with any amendment (except in the urgent cases referred to above), it may state so in writing to the Client within the advance notice period referred to in the preceding paragraph, so that the Parties may negotiate the applicable terms in good faith. If, after a reasonable period, the Parties fail to reach an agreement, either Party may terminate the Agreement as set forth in Clause Third, without giving rise to liability for either Party. The Provider’s continued rendering of the Service after an amendment takes effect shall be deemed tacit acceptance thereof. The foregoing is without prejudice to any public-policy or mandatory provisions applicable under the law of the Provider’s jurisdiction, which shall prevail in the event of conflict.

Clause Ninth – Restriction, Suspension, or Cancellation of the Service and of the Consideration. The Provider may restrict, suspend, or pause rendering of the Service, in whole or in part, and the Client may restrict, suspend, or pause payment of the Consideration, in any of the following cases: a) The Client has a balance owed to the Provider, in whole or in part, past due, provided that 30 days have elapsed since the date of the Provider’s payment demand notice. b) The public image, reputation, or good name of the Parties could be affected. c) At the Client’s request.

Clause Tenth – Survival of Obligations. The Parties agree that, should a notice of termination or rescission of the Agreement be given, they shall remain obligated to perform all obligations outstanding as of the date such notice is given. Accordingly, the Provider shall deliver the Service as it stands as of the date the notice is given, and the Client shall pay any amounts of the Consideration outstanding as of that date. The giving of a notice of termination or rescission of the Agreement shall not affect the validity or enforceability of the obligations to deliver the Service and pay the Consideration, nor of those obligations that, by their nature or by operation of law, must be deferred to a later date; accordingly, the Parties may demand performance of such obligations after termination or rescission of the Agreement.

Clause Eleventh – Entire Agreement. This Agreement constitutes the entire agreement between the Parties with respect to its subject matter, and therefore supersedes and renders ineffective any other agreement, including electronic communications between the Parties, whether prior or subsequent, having the same or a similar subject matter.

Clause Twelfth – Headings. The Parties agree that the clause headings are for identification purposes only and shall not be taken into account for the interpretation of the Agreement.

Clause Thirteenth – Severability. If one or more provisions of the Agreement are found to be unenforceable or invalid to any extent under applicable law, such provision shall be interpreted so as to be enforceable to the greatest extent possible. If the provision is found to be wholly unenforceable, the remainder of the Agreement shall be interpreted as if such provision were excluded therefrom.

Clause Fourteenth – Confidentiality of Information. The Parties agree that, for purposes of the Agreement, all information of the Parties disclosed, obtained, or accessed under this Agreement shall be deemed confidential, including, without limitation, all tangible or intangible information, whether oral or written, electronic, recorded, microfilmed, or in any other medium, concerning, without limitation, products, prices, business plans, marketing or promotion of any product, business practices and/or policies, system programs, software, accounting and financial, legal, and technical information, trademarks, industrial designs, intellectual property, organizational matters, customer information, business contacts, databases, current and potential partners, services rendered, reports, plans, market projections, together with formulas, mechanisms, patterns, methods, techniques, analysis processes, working papers, compilations, comparisons, strategies, studies, and, in general, all such information, whether or not marked as confidential (hereinafter, the “Confidential Information”). Both Parties undertake not to disclose the Confidential Information to third parties, in any manner or by any means, nor to make improper use thereof, nor to use it for purposes other than those arising from the legal relationship established under the Agreement. Likewise, both Parties undertake to give the Confidential Information the same treatment they would give to their own information. Such treatment must involve a reasonable degree of care to prevent improper disclosure or use of the information. The Parties agree that “improper use” shall mean any use that is inconsistent with the purpose and objectives of the Agreement, in accordance with its terms and conditions. The Parties agree that “reasonable degree” shall mean those acts performed by the relevant Party as necessary to safeguard the Parties’ interests with respect to the Confidential Information. Each Party is expressly prohibited from disclosing, duplicating, copying, or otherwise making known, commercializing, operating, exploiting, or entering into any legal act directly or indirectly related to the Confidential Information. Both Parties shall refrain from disclosing the Confidential Information to any of their employees or consultants, except those who have signed an agreement containing stipulations regarding disclosure and use of information similar to those set forth in the Agreement and who must be aware of such information due to the work they perform. The restrictions and obligations of this clause shall remain in effect after termination or cancellation of the Agreement and shall be binding on the Parties, as well as on their authorized successors or assigns, for as long as the Confidential Information retains its confidential character.

Clause Fifteenth – Ownership of the Service. The Provider undertakes to transfer to the Client the ownership, possession, use, enjoyment, and disposition of the Service, fully, in perpetuity, and free of any limitation, encumbrance, or lien whatsoever, free of hidden defects and of any other defect that could diminish its value. The foregoing shall apply only if the Client makes full payment of the Consideration or, as applicable, payment of the partial amounts. In the event of early termination of the Agreement, the Provider shall deliver the Service as it stands, transferring it in the manner and under the terms set forth above. In connection with the foregoing, the Provider undertakes to answer for the damages the Client may suffer as a result of any claim arising from the Client’s use, enjoyment, and disposition of the Service, and to restore to the Client possession of an asset of similar condition should the Client suffer any impairment of its rights over its assets. Likewise, the Provider undertakes to hold the Client harmless from any suit, claim, or proceeding in which the Client’s title to the real rights in the Service could be questioned.

Clause Sixteenth – Liability. The Provider undertakes to comply with each and every obligation under the Agreement, as well as with the specifications and expertise required by the contracted Service, and shall be liable for the damages caused to the Client in the event of breach. The Provider undertakes to ensure that its workers, subcontractors, and/or service providers engaged to render the Service have the knowledge, resources, and all authorizations, licenses, permits, and any other right necessary to render the Service, and to guarantee performance of their obligations vis-à-vis the Client, having entered into agreements with them that offer the same or a greater degree of protection and liability as set forth in the Agreement. By the mere fact of rendering the Service to the Client, such workers, subcontractors, and/or service providers are liable to the Provider for breach of the obligations set forth in the Agreement. In the event of breach of any provision of this Agreement resulting from a breach by the Provider’s employees, subcontractors, and/or service providers, the Client may, as a matter of right, hold the Provider liable for such breach and demand payment of damages suffered by the Client and/or any applicable contractual penalties. Should the Client, for any reason, be unable to obtain compensation from the Provider, the Client may claim directly against the Provider’s subcontractors, employees, or service providers, that the necessary instruments be executed or that the Client be compensated for the breach of obligations in the same manner the Provider would have been required to do. Any limitation of liability that may be agreed between the Parties shall be inoperative in the event of fraud, gross negligence, bad faith, malpractice, or ordinary negligence on the part of the Provider.

Clause Seventeenth – Independence of the Parties. Both Parties state that they are entirely independent of one another, and the Provider acknowledges that neither it nor its employees nor the persons it engages to render the Service have any employment relationship with the Client, and shall accordingly have no right to claim wages or benefits from the Client in any manner, nor shall it or its employees or service providers be entitled to registration with any government or private institution or authority. Accordingly, the Provider acknowledges and agrees that the Client has no, and shall have no, labor or social security obligation whatsoever toward the Provider, its workers, or its service providers, given that the Provider has sufficient resources of its own to meet all of its obligations to its workers, and undertakes to reimburse the Client for any expense or disbursement the Client incurs as a result of or in connection with such relationships. For purposes of the foregoing paragraph, the Provider represents, under oath, that it does not render works or services exclusively or principally for the Client, as it is free to render the same or similar services as those agreed under this Agreement to other individuals and/or legal entities.

Clause Eighteenth – Personal Data. Where, in connection with the rendering of the Services, the Provider processes Personal Data on behalf of the Client, this clause shall constitute the Data Processing Agreement entered into between the Client, acting as Controller, and the Provider, acting as Processor, and shall govern all Processing of Personal Data carried out by the Processor under the Agreement. The Processor shall process Personal Data in accordance with the principles of fairness, transparency, lawfulness, purpose limitation, data minimization or necessity, accuracy, integrity, and confidentiality, as well as in accordance with applicable Data Protection Laws, the Controller’s privacy notice, and the documented instructions issued by the Controller. Acceptance of the Agreement constitutes express, full, and unconditional acceptance of this Data Processing Agreement, which forms an integral part of the Agreement. In the event of conflict between this clause and any other provision of the Agreement regarding the Processing of Personal Data, this clause shall prevail, except for the execution of an independent Data Processing Agreement — which the Provider agrees to negotiate in good faith when so required by the Client, it being understood that the absence of such an agreement shall not exempt the Provider from its obligations under this clause — in which case the terms of such independent agreement shall prevail.

1. General Obligations of the Provider as Processor. a) Lawful processing. Process Personal Data solely in accordance with: (i) documented, lawful, and reasonable instructions, including those contained in this Agreement; and (ii) applicable Data Protection Laws. The Processor shall promptly inform the Controller if, in its opinion, an instruction contravenes applicable Data Protection Laws. b) Purpose limitation: ensure that Personal Data is processed solely for the specific, explicit, and legitimate purposes described in the Agreement and in this clause, and that it is not further processed in a manner incompatible with those purposes. c) Confidentiality: ensure that all persons authorized to process Personal Data (including employees, contractors, agents, or Sub-processors) are subject to written confidentiality obligations or equivalent statutory duties, and have received adequate training in data protection and information security. d) Security of Processing: implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk. e) Subcontracting: not engage or authorize any Sub-processor to process Personal Data without the Controller’s prior written authorization. f) Assistance: provide reasonable assistance, taking into account the nature of the Processing and the information available, to enable: (i) compliance with security, breach notification, impact assessment, and prior consultation obligations; (ii) responses to data subject requests; and (iii) demonstration of compliance with applicable Data Protection Laws. g) Personal Data Breaches: notify any Personal Data Breach without undue delay. h) Return or deletion: upon termination or expiration of the Service, or upon the Controller’s written request, return or delete all Personal Data. i) Audit and compliance: make available to the Controller all information necessary to demonstrate compliance with this Agreement and with applicable Data Protection Laws, and allow audits or inspections. j) Transfers: the Processor shall not transfer, or permit the transfer of, Personal Data of the Controller across international borders — without limitation — unless: (i) the destination is covered by a valid adequacy decision issued by the European Commission or another competent authority; or (ii) the Processor has given the Controller prior written notice identifying the recipient, the destination country, and the purpose of the transfer, has obtained the Controller’s prior written authorization (which the Controller may grant or withhold at its sole discretion), and the transfer is carried out under a recognized legal mechanism, such as the Standard Contractual Clauses approved by the European Commission, Binding Corporate Rules approved by a competent Supervisory Authority, or any other legally recognized mechanism under applicable Data Protection Laws. The Processor shall provide the information reasonably requested by the Controller to assess the level of protection in the destination country. If the mechanism relied upon is invalidated or ceases to apply, the Processor shall immediately notify the Controller and suspend the transfer until a valid mechanism is in place.
2. General Obligations of the Client as Controller. a) Lawful basis and transparency: ensure that the Processing of Personal Data by the Processor is based on a lawful ground under applicable Data Protection Laws, and that all necessary notices, consents, or authorizations have been provided to data subjects. b) Accuracy and minimization: ensure that the Personal Data shared with the Processor is, to the best of its knowledge, accurate, complete, and limited to what is necessary for the purposes of the Service. c) Instructions: provide the Processor with clear, written, and lawful instructions for the Processing, being solely responsible for the legality and appropriateness of such instructions. d) Oversight: supervise and verify the Processor’s compliance with this Agreement, through the review of reports, audits, and certifications.
3. Security of Processing. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risks to the rights and freedoms of individuals, the Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risks. Such measures shall ensure: a) the confidentiality, integrity, availability, and resilience of Personal Data and related systems; b) protection against unauthorized or unlawful access, use, alteration, disclosure, or destruction; c) the ability to restore the availability of and access to Personal Data in a timely manner in the event of a physical or technical incident; d) the implementation of periodic processes for testing, assessing, and evaluating the effectiveness of security controls; and e) general compliance with applicable obligations regarding personal data protection, information security, and cybersecurity. For these purposes, and without limiting the Processor’s general obligations under this Agreement, the Processor shall implement, at a minimum, the following measures: a) access controls and authentication; b) encryption and transmission security; c) physical and environmental security; d) network and infrastructure security; e) systems and application security; f) backups and recovery; g) personnel and confidentiality controls; h) monitoring and incident response; i) security measures applicable to Sub-processors; j) data minimization and retention mechanisms. Additionally, as part of its general security obligations, the Processor shall: a) conduct regular internal and external audits, at least annually; b) provide the Controller, upon written request, with copies of security certifications or third-party audit reports; c) promptly remediate any vulnerability, deficiency, or security finding identified; and d) allow the Controller or its designated auditors to verify compliance. The Processor shall maintain a written corporate information security policy that: a) defines roles and responsibilities; b) is approved by senior management and communicated to relevant personnel; c) is reviewed and updated regularly or upon material changes; and d) is consistent with the Controller’s security policies. The Processor acknowledges that security requirements are constantly evolving and, accordingly, undertakes to continuously assess, adapt, and improve its technical and organizational measures.
4. Sub-processors. The Processor shall not engage, nor allow anyone, to process the Controller’s Personal Data without the Controller’s prior written authorization, which may be granted generally or specifically. Where the Controller authorizes the use of a Sub-processor, the Processor shall: a) ensure that the Sub-processor is bound by a written agreement imposing data protection obligations no less protective than those set forth in this Agreement; b) remain fully liable to the Controller for the Sub-processor’s performance of its obligations; and c) maintain an up-to-date list of authorized Sub-processors, which it shall make available to the Controller upon request. The Processor shall notify the Controller in writing, with reasonable advance notice, of any intended addition or replacement of a Sub-processor. The Controller may object in writing on reasonable data-protection grounds. If the Parties do not reach an agreement within a reasonable period, the Controller may suspend or terminate the affected Services.
5. Personal Data Breach. The Processor shall notify the Controller without undue delay and, in any event, within 24 hours of the occurrence of a Personal Data Breach or of becoming aware of it. The notice shall include sufficient information to enable the Controller to comply with its legal obligations, including, where required, reporting to Supervisory Authorities and affected data subjects. Each notice shall include, to the extent reasonably available: a) a description of the nature of the Breach, including (where possible) the categories and approximate number of data subjects and records affected; b) the name and contact details of the Processor’s data protection or incident-response officer; c) the likely consequences of the Breach; and d) the measures taken or proposed to address it and mitigate its effects. The Processor shall: a) investigate the cause, scope, and impact of the Breach; b) implement remedial measures; c) cooperate with the Controller and follow its reasonable instructions regarding notifications to Supervisory Authorities or data subjects; and d) maintain records of all Breaches and make them available to the Controller upon request. The Processor shall not make, or permit, any public communication regarding a Breach that directly or indirectly refers to the Controller, except with the Controller’s prior written authorization or as required by law.
6. Return or Deletion of Personal Data. Upon termination or expiration of the Agreement, or upon the Controller’s written request at any time, the Processor shall, at the Controller’s election: a) return all Personal Data (and any copies) to the Controller in a structured, commonly used format; or b) securely delete or destroy all Personal Data, ensuring it is permanently unrecoverable. Unless otherwise instructed, the Processor shall complete the return or deletion within 30 (thirty) days of the termination or request. The Processor may only retain Personal Data to the extent and for the time required by applicable law or regulatory obligation, provided that: a) it continues to ensure its confidentiality, integrity, and security; and b) it processes it solely to comply with such legal obligation. Upon completion of the process, the Processor shall provide the Controller with a written certification that all Personal Data (including backups and archived copies) has been returned or permanently deleted. The Processor shall ensure that its Sub-processors also comply with this section.

Clause Nineteenth – Notices and Addresses. Any notice or communication required under this Agreement must be made in writing and delivered personally, by registered mail with return receipt, or by email with confirmation of receipt from the recipient, at the addresses and email addresses set forth in the Services Agreement.

Until the Parties notify a change of their respective addresses and email addresses, all communications, notices, service of process, and other judicial or extrajudicial proceedings carried out at the last addresses and email addresses provided shall be fully effective. Notices given by electronic means shall be deemed valid provided they are given in accordance with the applicable provisions of the Commercial Code in force in the United Mexican States.

Clause Twentieth – Governing Law and Jurisdiction. The Parties agree that, in the event of a dispute arising from the interpretation, performance, or compliance with the Agreement, they shall first submit to mediation, which may be conducted before the Alternative Dispute Resolution Center (“Centro de Justicia Alternativa”) of Mexico City or through private mediation, which may be carried out electronically or in person, or otherwise through the means deemed appropriate under the Code of Civil Procedure for the Federal District, now Mexico City. If the dispute continues, the Parties consent to submit all matters relating to the interpretation, performance, and compliance with this Agreement to the jurisdiction of the competent courts of Mexico City, waiving any other venue that might otherwise correspond to them for any reason.