Privacy Notice.

DRONEMEX collects the Contact and Identification data set out below, primarily through the digital platform https://dronemex.co/, by email, as well as personally and directly from its clients, pilots or prospective clients via digital forms or identity verification tools. Data is also collected indirectly through various sources permitted by law.

• First and last names of the client, pilot or persons related to the execution of the mission.
• Email address.
• Tax and contact address.
• Phone numbers.

• Full name.
• Business or corporate name.
• Corporate documents (Articles of incorporation, powers of attorney, RFC).
• Nationality.
• Photograph and video (for digital identity verification).
• Federal Taxpayer Registry number (RFC).
• Tax Status Certificate.
• Proof of address.
• Unique Population Registry Code (CURP).
• Data contained in the voter ID (INE) or current Passport.
• Professional Technical Data: RPAS Pilot License (AFAC), Aircraft Registration Folio, Civil Liability Insurance Policy and Flight Logs.

DRONEMEX collects financial and patrimonial personal data for the purpose of providing the requested intermediation and payment-processing services, namely the formalization of missions and subscription billing:

• Bank accounts (CLABE) for the disbursement of funds to pilots.
• Credit and/or debit card number (securely processed by Stripe).
• Tax information for invoicing.
• Transaction and payment history within the platform.

In addition to the data mentioned above, for the purposes set out in this notice we will use the following personal data deemed sensitive, which require special protection and will only be used when the service requires it — that is, where the service must analyze data whose processing may affect the most intimate sphere of the data subject, or whose improper use may give rise to discrimination or pose a serious risk to the data subject.

• Biometric Data: Facial recognition images ("selfies" or video) for digital identity validation through automated systems, in order to prevent fraud and identity theft.

DRONEMEX obtains free, specific and informed consent to collect this data. Because it is sensitive data, consent is obtained expressly through digital authentication mechanisms on the platform at the moment the verification process (KYC) begins.

The data you provide for the contracted services or products is processed only by the Controller or, where applicable, its data processors. The only purposes of this data are:

• Performance of the contracted services or products.
• Continuous improvement.
• Marketing.

• Drafting, signing and formalization of digital contracts and missions.
• Identity verification through optical character recognition (OCR) and biometric technologies.
• Validation of the technical and legal capacity of pilots (AFAC Licenses and Insurance).
• Management of payments and transfers through third-party processors (Stripe).
• Communication to address matters related to the service or active missions.
• Issuance of electronic invoicing and compliance with tax laws.
• Prevention and detection of abuse, fraud and identity theft.
• Ensuring the truthfulness of technical information provided by users.
• Personalizing the services or products provided.
• Responding promptly to company inquiries and coordinating internally.

Additionally, we will use your information for purposes that are not strictly necessary but allow us to provide better service:

• Keeping internal company order through digital pilot and client files.
• Conducting service-quality surveys.
• Improving the technical features of the platform.
• Marketing: Sending promotions, offers and service updates from DRONEMEX.

The data subject may opt out of the secondary purposes by sending an email to contact@dronemex.co.

DRONEMEX, as well as its data processors, does not transfer personal data to third parties except where a justified cause established by law exists, or in the following cases necessary for the service:

• Stripe, Inc. — For payment processing and digital identity validation.
• OCR providers — For automated extraction of data from official documents.

DRONEMEX collects personal data based on the principles set out in the Federal Law on the Protection of Personal Data Held by Private Parties, which safeguards the right to the protection of personal data and its proper processing.

The Controller is responsible for the traceability of the data, identifying who accessed it and the processing performed. In the event of security breaches, you will be notified immediately by email so that you may take appropriate measures.

DRONEMEX is committed to protecting the security of the personal data you provide, complying with all required legal acts and protecting against improper use or unauthorized disclosure.

We have security measures that include restricted access to your files and continuous monitoring of our database. We have internal policies for the management and processing of personal data, considering its lifecycle: collection, use and subsequent deletion.

You have the right to Access your personal data, Rectify it when inaccurate or incomplete, Cancel it when you consider it is not being processed in accordance with the law, or Oppose its processing for specific purposes, provided it is not required to comply with a legal obligation (the "ARCO Rights").

You may also revoke the consent granted to the Controller for the processing of your personal data, provided it is not required for the existence, maintenance and performance of your legal relationship with the Controller and/or security matters.

Any request for revocation of consent or exercise of ARCO Rights must contain:

• Name and address of the data subject, or another means of communicating a response.
• Documents proving identity, or where applicable, the representation of the data subject.
• A clear and precise description of the personal data with respect to which you seek to exercise your right. In the case of rectification, you must indicate the modifications to be made and provide supporting documents.
• Any other element or document that facilitates the location of the personal data.

• By certified mail with return receipt to the Controller's address.
• By email to contact@dronemex.co, provided the data subject can be reliably identified through authentication mechanisms. Receipt will be acknowledged by email indicating the date of receipt.

The Controller shall respond within 20 business days from receipt of the request.

If the information is insufficient, the Controller shall require the data subject, within the following 5 business days, to provide the necessary elements. The data subject shall have 10 business days to respond.

If applicable, the Controller shall implement the determination reached within 15 business days.

• Registration in the Public Registry to Avoid Advertising (REPEP), maintained by PROFECO — www.profeco.gob.mx
• Sending an email to contact@dronemex.co stating your refusal to continue receiving advertising from the Controller and its processors.

This notice may undergo modifications, changes or updates at any time due to new legal requirements or service needs. Notifications of modifications will be made via the email you have provided or published at https://dronemex.co/legal/privacy.

Any questions may be directed to the email contact@dronemex.co.