Privacy Notice

1. Data Controller

The data controller for your personal data is Covest Proptech, S.A. de C.V., with domicile in Mexico.

For any matter related to this privacy notice, you may contact us by email: privacidad@covest.mx.

2. Personal Data We Collect

For the purposes described in this notice, Covest collects the following categories of personal data:

• Identification data: full name, date of birth, nationality, official identification document.
• Contact data: email address, phone number.
• Financial and asset data: information on investment capacity, risk profile, interest in specific real estate.

3. Purposes of Processing

Your personal data will be used for the following primary purposes, which give rise to and are necessary for the legal relationship between you and Covest:

• Managing and following up on your contact or information request.
• Evaluating your profile as a potential investor in fractional real estate.
• Presenting investment opportunities in specific properties from the Covest portfolio.
• Fulfilling applicable legal and regulatory obligations, including those derived from the Federal Law for the Prevention and Identification of Proceeds of Illicit Activities.
• Administering the relationship with you should you decide to formalize an investment through a Fideicomiso established with Banco Covalto.

4. Sensitive Personal Data and Express Consent

The financial and asset data we collect are considered sensitive data under the LFPDPPP, as their improper disclosure could cause financial harm.

In accordance with Article 9 of the LFPDPPP, processing these data requires your express consent. By checking the consent box on our forms or by directly providing us with your financial data, you grant such consent in an affirmative, free, specific, and informed manner.

You may revoke your consent at any time following the procedure described in the ARCO rights section.

5. Personal Data Transfers

Covest may share your personal data only with the following entities and for the stated purposes, without requiring your consent pursuant to Article 37 of the LFPDPPP:

• Banco Covalto, S.A., Institución de Banca Múltiple: in its capacity as fiduciary institution, for the establishment and administration of the Fideicomiso through which fractional investment is structured.
• Government and regulatory authorities: when required by law, regulation, court order, or resolution of competent authority.
• Technology service providers: providers acting as data processors for the operation of Covest’s digital platform, subject to confidentiality obligations.
• Web3Forms (Notionforms Inc.): web form service provider used to receive and transmit contact and investment interest requests submitted through covest.mx. Data transferred: name, email, phone number, and contact message. Web3Forms acts as data processor pursuant to its own privacy policies.

6. ARCO Rights and Exercise Mechanisms

You have the right to Access, Rectify, Cancel, or Oppose (ARCO rights) the processing of your personal data, pursuant to Articles 22 through 36 of the LFPDPPP.

To exercise your ARCO rights, you must send a request by email to privacidad@covest.mx with the following elements:

• Full name and valid official identification.
• Clear and precise description of the data for which you wish to exercise your rights.
• Any document that facilitates locating your data.

Covest will respond to your request within a maximum of 20 business days from receipt. If your request is approved, changes will be implemented within 15 business days following the communication of the response. Both periods may be extended once for an equal period when justified by circumstances.

7. Revocation of Consent and Limitation of Use

You may revoke the consent you have granted for the processing of your personal data at any time. To do so, send a request to privacidad@covest.mx indicating the scope of the revocation.

Please note that in some cases, revoking consent may mean that it is not possible to continue providing the requested service or relationship.

You may also object to the processing of your data for secondary or direct marketing purposes by requesting at the same email address.

8. Use of Cookies and Tracking Technologies

Covest’s digital platform (covest.mx) uses cookies and similar technologies to improve user experience, analyze site traffic, and personalize content.

Analytics cookies collect information in aggregate form and do not allow personal identification. Preference cookies save your browsing settings.

You may configure your browser to reject cookies or to receive a notification when cookies are sent. However, some site features may not be available if you reject cookies.

9. Security Measures

Covest implements technical, administrative, and physical security measures to protect your personal data against damage, loss, alteration, destruction, unauthorized use, access, or disclosure.

Access to your personal data is restricted to employees and providers who need it to fulfill the purposes described in this notice, and they are subject to confidentiality obligations.

10. Changes to the Privacy Notice

Covest reserves the right to update or modify this privacy notice at any time, whether to comply with legislative changes, internal policies, or new business practices.

Any modification to this notice will be communicated by publication on our website covest.mx/privacy. The date of the last update will be indicated at the beginning of the notice. We recommend reviewing this page periodically.

11. Contact and Data Controller Information

For any inquiry, exercise of ARCO rights, revocation of consent, or clarification related to this privacy notice, you may contact Covest Proptech, S.A. de C.V. through:

• Email: privacidad@covest.mx
• Website: covest.mx