Terms and Conditions

I. Data Controller

Stay on Social, S.A. de C.V. (“SOS”), with its registered address at Blvd. Manuel Ávila Camacho No. 137, Suite 302, Colonia Polanco I Sección, Miguel Hidalgo Borough, Zip Code 11510, Mexico City, Mexico, is the controller of the personal data provided through its Institutional Whistleblowing System (the “System”), in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), its Regulations, and other applicable laws.

SOS recognizes the importance of protecting the privacy of individuals who use the System and will process their personal data in accordance with the principles of lawfulness, consent, information, quality, purpose limitation, loyalty, proportionality, and accountability.

II. Personal Data Collected

Depending on the nature of the report, SOS may collect the following personal data from the reporting individual (“Whistleblower”):

Full name;
Mobile or office telephone number;
Company of employment;
Job title or position;
Work location (office, city, and state);
Business and/or personal email address; and
Preferred contact hours.

Additionally, during the course of any internal investigation, SOS may collect personal data relating to third parties, including the individuals reported, witnesses, or any other person whose information is necessary for the review and investigation of the reported facts.

SOS will endeavor to collect and process only the personal data that is strictly necessary to fulfill the purposes described in this Privacy Notice.

III. Purposes of Processing

Personal data will be processed solely for the following primary purposes, which are necessary for the operation of the Institutional Whistleblowing System:

a) To identify and register the Whistleblower, when the Whistleblower elects to disclose their identity.
b) To receive, document, assess, and investigate reported facts.
c) To manage and follow up on reports submitted through the System.
d) To contact the Whistleblower when additional information, clarification, or follow-up is required.
e) To determine whether violations of the Code of Ethics, internal policies, contractual obligations, or applicable laws have occurred.
f) To implement any corrective, disciplinary, contractual, or legal measures deemed appropriate.
g) To comply with applicable legal, regulatory, or governmental requirements.

SOS will not process personal data collected through the System for marketing, promotional, or any other secondary purposes.

IV. Confidentiality

SOS shall implement reasonable measures to preserve the confidentiality of the Whistleblower’s identity and the information contained in each report.

Access to such information shall be limited exclusively to authorized personnel involved in receiving, reviewing, investigating, and resolving reports.

Where disclosure is required by law or is necessary for the proper conduct of an investigation, SOS shall disclose only the information strictly necessary to the persons or authorities legally entitled to receive it.

The System may allow anonymous reports. In such cases, SOS will process only the personal data voluntarily provided by the reporting individual.

V. Consent

By voluntarily providing personal data through the System, the data subject acknowledges and consents to the processing of such personal data in accordance with this Privacy Notice.

The data subject represents that they have the legal capacity required to provide their personal data.

Should it become necessary to process personal data relating to minors or individuals subject to legal guardianship or representation, SOS shall do so only upon obtaining the legally required consent from the appropriate parent, guardian, or legal representative.

VI. Security Measures

SOS maintains reasonable administrative, technical, and physical safeguards designed to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, or destruction.

Access to investigation files and related documentation shall be restricted to authorized personnel and retained only for as long as necessary to fulfill the purposes described in this Privacy Notice.

VII. Transfer of Personal Data

SOS may transfer personal data without requiring additional consent where permitted under applicable law, including transfers to:

SOS affiliates, subsidiaries, or related companies when necessary for the investigation or resolution of a report;
External legal counsel, auditors, consultants, or specialized service providers participating in the investigation, all of whom shall be bound by confidentiality obligations; and
Judicial, administrative, or governmental authorities when disclosure is required by applicable law or pursuant to a lawful request.

Except as described above, SOS will not disclose or transfer personal data to third parties without the data subject’s consent.

VIII. Data Retention

Personal data will be retained only for the period necessary to fulfill the purposes set forth herein, address any administrative or judicial proceedings arising from a report, and comply with applicable legal obligations.

Upon expiration of the applicable retention period, personal data will be securely deleted or anonymized, as appropriate.

IX. Data Subject Rights

Data subjects may exercise the following rights at any time:

Right of access;
Right to rectification;
Right to cancellation (where legally applicable);
Right to object to processing;
Right to revoke consent, where legally permissible; and
Right to request the restriction of the use or disclosure of their personal data.

SOS may deny or limit the exercise of these rights where required by law, where doing so could compromise an ongoing investigation, or under any other circumstance permitted by applicable law.

Requests should be submitted by email to info@stayonsocial.com and must include:

Full name of the data subject;
Email address or mailing address for correspondence;
Documentation proving identity or legal authority, where applicable;
A clear description of the request; and
Supporting documentation, if requesting rectification.

SOS will respond within the timeframes established by applicable law.

X. Restriction of Use and Disclosure

Data subjects may request that SOS limit the use or disclosure of their personal data by submitting a request to info@stayonsocial.com.

Each request will be evaluated in light of applicable legal obligations and the nature of any ongoing investigation.

XI. Cookies and Similar Technologies

If the System operates through an online platform, SOS may use cookies or similar technologies solely for system functionality, cybersecurity, and platform administration purposes.

Such technologies will not be used for advertising, behavioral profiling, or marketing purposes.

XII. Amendments to this Privacy Notice

SOS reserves the right to amend or update this Privacy Notice at any time to reflect changes in applicable laws, regulations, internal policies, or operational requirements.

Any amendments will be published through the Institutional Whistleblowing System and, where required by law, communicated to the data subject via the email address provided.

Last Updated: July 7, 2026