Privacy Notice

1. Introduction

Your privacy and trust are very important to Kuepa de México, S.A. de C.V. and the other entities within its corporate group that operate academic programs under the "Universidad Uk" brand (hereinafter, collectively, the "Universidad Uk Group"). For this reason, we want you to understand clearly how we process and protect your personal data.

Your personal data will be processed in accordance with the applicable data protection laws of the country where you are located or have your habitual residence, including, among others, the Federal Law on Protection of Personal Data Held by Private Parties (Mexico), Law 25,326 on Personal Data Protection (Argentina), Statutory Law 1581 of 2012 (Colombia), Law 29733 and its Regulations (Peru), the General Personal Data Protection Law – LGPD (Brazil), Law 18,331 (Uruguay), Law 81 of 2019 (Panama), the Organic Law on Personal Data Protection – LOPDP (Ecuador), as well as equivalent laws in other Latin American countries where we provide services.

The purpose of this Privacy Notice is to ensure that you have full control and decision-making authority over your personal data.

2. Data Controller and Contact Information

Unless otherwise indicated in a form, contract, or other document, the primary data controller for your personal data shall be:

Kuepa de México, S.A. de C.V.
(hereinafter, the "Company" or the "Controller")

Registered address: Eje Central Lázaro Cárdenas No. 13, 2nd Floor, Colonia Centro, Alcaldía Cuauhtémoc, C.P. 06000, Mexico City, United Mexican States.

In certain countries, other entities of the Universidad Uk Group may act as joint controllers or data processors, as indicated in the local annexes to this Notice or in specific documents presented to you.

For any questions regarding the protection of your personal data or this Notice, you may contact the Personal Data Protection Department at:

• Email: protecciondedatos@kuepa.com

Where required by a country's legislation, the Universidad Uk Group may appoint Data Protection Officers (DPOs), as well as local agents or representatives before the corresponding data protection authority. Updated information on such appointments may be obtained through the contact channels listed above or in the local annexes to this Notice.

3. Personal Data We Collect

The Company will collect personal data from you that is necessary for the proper provision of educational services and other related services (hereinafter, the "Services"), either directly or through its authorized commercial partners and service providers.

Among others, we may process the following categories of personal data:

• Identification and contact data: name, surname, address, phone numbers, email, marital status, nationality, handwritten and/or electronic signature, identity document, CURP and/or RFC or other identifiers as applicable by country.
• Academic and employment data: education level, academic history, institution of origin, occupation, position, department or area, employer information, academic and professional references.
• Economic, financial, and asset data: income and expense information, billing data, payment method data, payment history, scholarship and financial aid information; in certain cases, data related to bank accounts or other payment methods, to the extent necessary for managing charges or refunds.
• Browsing and platform usage data: technical information about your interaction with our websites, virtual platforms, and applications (e.g., device identifiers, IP address, browser type, time zone), as well as data about your participation in classes, assessments, and online activities, where applicable.
• Preference and educational/commercial profile data: academic interests, preference for specific programs or modalities, satisfaction survey responses, and market research related to our Services.

In general, sensitive personal data will not be processed unless strictly necessary and permitted by applicable law (for example, to manage special accommodations, academic adaptations, or legal requirements), in which case the corresponding specific consent will be requested.

4. Purposes of Personal Data Processing

4.1 Necessary purposes (primary)

Your personal data will be processed for the following purposes, which are necessary for the legal relationship with the Universidad Uk Group and for the provision of the Services:

• To identify and validate your identity, as well as to verify the accuracy and validity of the information provided.
• To manage your registration as a prospective student, applicant, enrolled student, graduate, or user of our Services, as applicable.
• To evaluate your application for admission, enrollment, and continued enrollment in the academic programs offered by Universidad Uk.
• To manage your academic record, assessment processes, certification, and the issuance of transcripts, diplomas, and other related documents.
• To manage billing, collections, and, where applicable, the application of scholarships, discounts, and other benefits.
• To implement administrative, operational, and technological processes necessary for the provision of the Services, including technical support and maintenance of educational platforms.
• To comply with legal, regulatory, and contractual obligations applicable to the Universidad Uk Group, including those related to educational, tax, data protection, and other authorities.
• To address inquiries, complaints, information requests, and clarifications related to the Services or this Privacy Notice.

The processing of data for these purposes is essential to maintain the relationship with you and to provide the Services.

4.2 Non-necessary purposes (secondary)

Additionally, and only when you grant us your express and unequivocal consent, we may process your personal data for the following secondary purposes:

• To send commercial, promotional, or informational communications about academic programs, courses, events, scholarships, activities, and complementary services of Universidad Uk.
• To create basic profiles of interests and educational preferences in order to offer you content and communications better suited to your needs (commercial segmentation), without this involving automated decisions with significant legal effects.
• To conduct satisfaction surveys and market research aimed at improving our Services.
• To invite you to participate in activities, campaigns, promotional events, contests, and initiatives related to Universidad Uk.

Granting your consent for these purposes is not a condition for the provision of the Services. You may revoke or limit your consent for secondary purposes at any time, through the mechanisms described in this Notice.

5. Contact Channels and Communications

With your consent, the Universidad Uk Group may contact you for the purposes described in the previous section through the following channels:

• Email.
• Phone calls (including systems assisted by automated technologies).
• SMS messages and instant messaging services, such as WhatsApp or similar applications.
• Direct messages on social media (for example, Facebook, Instagram, or other platforms where Universidad Uk maintains official channels).

Where required by the legislation of your country, we will request specific consent per channel (for example, for phone calls or messages via messaging applications). Likewise, we will respect any registrations you make in public exclusion or "do not call" registries that exist in your country (such as the National "Do Not Call" Registry in Argentina) and will maintain our own internal exclusion lists to ensure that no commercial communications are sent to you if you so request.

At any time, you may request to stop receiving commercial communications through all or some of the channels indicated, by using the opt-out mechanisms included in each communication or by contacting the Personal Data Protection Department.

6. Use of Automated Technologies and Artificial Intelligence

The Universidad Uk Group may use automated systems, including artificial intelligence tools, to support communication management, handle frequently asked questions, and follow up on your information, admission, or service requests.

These tools may participate in message generation, query classification, or initial assistance, but they will not, on their own, make decisions that produce legal effects or significantly affect you in a similar manner—such as definitive admission to or rejection from an academic program—without human intervention.

Where the laws of your country recognize specific rights in relation to automated decisions, you may:

• Request to be assisted by a human person.
• Express your opinion regarding decisions based on automated processing.
• Request, to the extent permitted by applicable law, additional information about the logic involved in such processing.

7. Personal Data Transfers

To fulfill the purposes described in this Notice, your personal data may be transferred, within and outside the country where they are located, to:

• Other entities of the Universidad Uk Group that participate in the provision of educational, administrative, and support Services.
• Service providers acting as data processors, such as CRM services, online education platforms, messaging services, call centers, cloud hosting, analytics, collections, legal advisory, auditing, and other services as necessary.
• Educational, tax, data protection, and other competent authorities, when required by applicable law.

These transfers may involve sending data to countries that may have different data protection regulations. In such cases, the Universidad Uk Group will adopt the appropriate safeguards required by applicable law, which may include, among others:

• Verifying that the destination country has an adequate level of protection recognized by the competent authority.
• Executing contracts that incorporate data protection clauses equivalent to those required in your country of residence.
• Conducting impact assessments and applying additional security measures, where appropriate.

You may object to certain transfers that are not necessary for the provision of the Services, as provided in this Notice and in applicable law.

8. Security Measures

The Universidad Uk Group implements reasonable administrative, technical, and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, in accordance with best practices and the requirements of applicable data protection regulations in each country.

Among other things, we apply access controls, password management policies, encryption in transit and/or at rest where appropriate, and confidentiality agreements with employees, service providers, and commercial partners who have access to personal data.

9. Rights of the Data Subject

Depending on the applicable laws in your country of residence, you may exercise one or more of the following rights with respect to your personal data:

• Access: to know what personal data we process, the origin of such data, the purposes of processing, and the general conditions under which it is carried out.
• Rectification: to request the correction or updating of incomplete, inaccurate, or outdated data.
• Cancellation or erasure: to request, where appropriate, the deletion or blocking of your personal data.
• Objection: to object, on legitimate grounds, to the processing of your personal data, particularly with regard to the sending of commercial communications.
• Portability: in certain countries, to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit them to another controller.
• Restriction of processing or anonymization: where provided by local law, to request that the processing of your data be restricted or that your data be anonymized in certain circumstances.
• Rights regarding automated decisions: to request that decisions based solely on automated processing that produce legal effects or significantly affect you not be adopted, and to obtain human intervention in such decisions, where required by applicable law.

9.1 Procedure for exercising rights

To exercise your rights, you (or your duly accredited legal representative) may submit a request to the Personal Data Protection Department through:

• Email: protecciondedatos@kuepa.com

The request must contain, at minimum:

• Your full name and a means of contact (address or email).
• A document proving your identity or, where applicable, legal representation.
• A clear and precise description of the data with respect to which you wish to exercise your rights.
• Where applicable, a description of the modifications to be made and the supporting documentation (for the right of rectification).
• Any element or document that facilitates the location of your personal data.

The Universidad Uk Group will respond to your request within the time frames established by applicable law. As a general reference, and unless a law establishes a different time frame, we will endeavor to issue a response within a maximum of twenty (20) business days from the receipt of the complete request and, if the request is granted, to make it effective within the following fifteen (15) business days.

In countries where legislation requires shorter time frames or specific requirements, those standards will apply.

9.2 Revocation of consent

You may revoke at any time the consent you have granted for the processing of your personal data for non-necessary purposes, without retroactive effect. To do so, you must submit a request following the same procedure described in the previous section.

To the extent that revocation does not affect existing legal or contractual obligations, the Universidad Uk Group will cease processing your data for the corresponding purposes within the time frames established by applicable law.

10. Limitation on Use or Disclosure of Your Data

In addition to the mechanisms provided for exercising your rights, you may limit the use or disclosure of your personal data by:

• Registering in public exclusion or "do not call" registries existing in your country (for example, the National "Do Not Call" Registry in Argentina, the Public Consumer Registry or the Public User Registry in Mexico), in accordance with applicable consumer protection and user services laws.
• Registering in the Universidad Uk Group's internal exclusion lists, which you may request through the contact channels indicated, in order to stop receiving commercial communications through certain or all channels.

We will process such requests in accordance with the time frames and conditions set forth in the applicable personal data protection and consumer or user defense laws in each country.

11. Database Registries, Officers, and Representatives

Where required by the laws of the data subject's country, the Universidad Uk Group will register its personal data banks or processing activities with the competent authority (for example, the National Database Registry in Colombia, the National Registry for Personal Data Protection in Peru, or the database registry/census managed by the URCDP in Uruguay).

Likewise, where provided by law, the Universidad Uk Group will:

• Appoint a Data Protection Officer (DPO), particularly in cases of large-scale processing or other circumstances defined by applicable law (for example, under the LGPD in Brazil or the LOPDP in Ecuador).
• Appoint local agents or representatives where the primary controller is established outside the data subject's country and the law so requires, such as the special agent required under Ecuadorian law for foreign controllers.

Updated information on these registries, officers, and representatives may be consulted in the local annexes to this Notice or by contacting the Personal Data Protection Department.

12. Filing Complaints with Authorities

Without prejudice to the internal mechanisms described above, you have the right to file complaints with the data protection authority of your country of residence, in accordance with applicable law. By way of example, such authorities include, among others:

• INAI (Mexico)
• AAIP (Argentina)
• SIC (Colombia)
• National Authority for Personal Data Protection, Ministry of Justice and Human Rights (Peru)
• ANPD (Brazil)
• URCDP (Uruguay)
• ANTAI, Personal Data Protection Directorate (Panama)
• Superintendence for Personal Data Protection – SPDP (Ecuador)

Updated contact information for each authority may be found on their official websites.

13. Changes to the Privacy Notice

The Universidad Uk Group reserves the right to modify or update this Privacy Notice at any time, to reflect changes in our practices, the Services, or applicable law.

Modifications will be published on our official website:

https://universidaduk.com

Where required by law, we will inform you of changes through additional means (for example, email, notices on our virtual platforms, or other contact channels you have provided).

Additionally, we may enable country- or region-specific annexes detailing local particularities (such as the competent supervisory authority, national database registries, specific response time frames, or special rules regarding commercial prospecting calls). In the event of a discrepancy between this general Notice and a local annex, the provisions of the annex shall prevail with respect to data subjects located in that country.

This document is a translation provided for informational purposes only. In the event of any discrepancy, the Spanish-language version published at universidaduk.com/aviso-de-privacidad shall prevail.