COMPREHENSIVE PRIVACY NOTICE FOR USERS OF THE AMCO SUMMIT APP

Last updated: May 12, 2026

This Privacy Notice is intended for all adult users of our AMCO SUMMIT Mexico 2026 digital platform, including mothers, fathers, guardians, teachers, educational institution staff, chaperones, and guests who register or interact on the platform to manage their access to the event, the photo gallery, and the purchase of items available for purchase through the App, as well as the legal representatives of minors whose personal data is processed through the App.

At AMCO, your privacy is our priority. This Privacy Notice explains in detail how we will use your personal data, as well as the rights you have regarding it. We encourage you to read and understand this document; if you have any questions, please contact our data protection department.

1. Who is responsible for processing your personal data?

Name: AMCO Educación S.A.P.I. de C.V.

Business activity: We are engaged in the development, marketing, and implementation of educational and learning systems for teaching the English language, as well as the organization of academic events and the operation of digital platforms related to these activities.

RFC: AED120131KQ7

Address: Avenida Vallarta 6503 Units B23 and B24, Colonia Ciudad Granja, C.P. 45010, Zapopan, Jalisco, México.

Website: www.amco.me

Data Protection Department

For all matters related to the use of your data or this Privacy Notice, you may contact our team:

Data Protection Officer: Miguel Angel Arévalo Ramírez, M.A.

Phone: 800-888-AMCO (2626).

Email: datospersonales@amco.me

2. How do we obtain your consent?

For this App, this Privacy Notice will be made available from our first contact with the user, including the initial invitation message via WhatsApp and/or during the registration process within the App itself.

When express consent is required, we will request it through checkboxes, confirmation buttons, or other electronic mechanisms enabled within the App.

In the case of facial recognition, biometric data, the processing of personal data of minors, the viewing of images in galleries, data transfers, and promotional purposes, AMCO will request specific, express, and written consent.

If your personal data was obtained indirectly, for example, through the educational institution to which you or your child belongs, this Privacy Notice will be made available to you upon our first contact with you and before you begin using the platform in full.

Personal Data of Minors and Legally Incapacitated Individuals

AMCO processes the personal data of minors through the App. This processing is carried out based on the consent of their parents, or legal guardians, who must accept the authorization mechanisms enabled within the platform.

If necessary, AMCO may request information or documentation to verify legal representation regarding the minor.

Withdrawal of Your Consent

You may withdraw the consent you have given us to use your personal data at any time. To do so, please contact our data protection department and submit the corresponding request using the form provided.

If you revoke your consent for the processing of biometric data, your facial biometric data and, if applicable, that of your children will be permanently deleted. This means that the App will no longer automatically group and identify photos in which you or your children appear. The photos will remain in the event gallery within the App, but they will no longer be searchable or viewable in a personalized manner through facial recognition. Revoking your biometric consent will not affect your access to the App’s other features.

3. How do we collect your personal data?

Directly

We collect your personal data directly from you when:

• You register on the App.
• You verify your identity using access codes.
• You use the photo gallery.
• You make in-app purchases.
• You request support or assistance.
• You register your face or that of your children as part of the facial recognition process.
• You upload, share, or download images on the platform.

Indirectly

The schools and educational institutions that your children attend may transfer personal identification and contact information about you and your children to us, including the child’s full name, the full name of the parent or guardian, phone number, and email address, so that we can send you the registration invitation, grant you access to the App, and correctly link your account to the event and the corresponding profile.

Additionally, during events, photographs may be taken by photographers or vendors authorized by AMCO, which will be incorporated into the platform for processing in accordance with this Privacy Notice.

We may also receive photographs or content generated by other users within the App, which may result in your image or that of your children appearing in event galleries, even if the photograph was not taken directly by AMCO. However, if you share third parties’ personal data with us, such as their photographs, you warrant that you have their consent to do so. Furthermore, you agree to inform them that you have provided us with their personal data and to indicate where they can view this Privacy Notice.

4. What personal data will we use?

In order to properly fulfill our relationship with you through our app, we will need to use the following personal data (if any of this personal data is not necessary, we will not ask for it):

• Identification data.
• Contact information.
• Data related to the event or educational institution.
• Login and authentication data within the App.
• Data regarding physical characteristics.
• Photographs, still images, and, where applicable, video.
• Technical data regarding browsing, App usage, and operation logs.
• Purchase, billing, payment, and transactional data derived from e-commerce.

Sensitive data:

• Facial biometric data collected for facial recognition within the App.

5. How will we use your personal data?

Your personal data may be used for:

• Essential purposes, which are strictly necessary to fulfill our obligations regarding our relationship with you.
• Secondary purposes, which are not strictly necessary; however, unless you object, they help us improve our processes and offer better products and services.

Essential Purposes

1. To enable you to exercise your ARCO rights.
2. To verify your identity.
3. To prevent fraud and identity theft.
4. To contact you.
5. To manage your registration and user account in the App.
6. To verify your access to the event through codes, validations, and digital mechanisms.
7. To manage your digital ticket or access to our events.
8. To link your account to the corresponding event, school, or group.
9. Process facial recognition to automatically identify you in event photographs.
10. Process facial recognition of your children, when authorized by their legal guardian, to automatically identify them in event photographs.
11. Generate personalized galleries with images in which you appear or, where applicable, your children.
12. Enable the viewing of photos within the event gallery, in accordance with the platform’s features.
13. Enable the downloading and sharing of images in accordance with the functionality enabled in the App.
14. Provide you with customer service and support.
15. Manage our internal processes and operations.
16. Organize and store your personal data in our systems and files.
17. Implement security measures to protect your personal data.
18. Manage billing, collections, and payments.
19. Issue invoices and payment receipts to you.
20. Process purchases within the App’s e-commerce platform.
21. Comply with legal, regulatory, and tax obligations.
22. Respond to requests from competent authorities.

Non-essential purposes for which your consent is required

1. To contact you and offer you additional products or services.
2. To evaluate and assess the quality of our products and services.
3. To conduct satisfaction surveys.
4. To send you notices and notifications for marketing, advertising, and promotional purposes via email, text messages, push notifications, WhatsApp, and similar channels.
5. To invite you to participate in AMCO promotions, contests, events, or activities.
6. To use your image, voice, photograph, or video—or those of your children—for promotional and advertising purposes in physical and digital media, social media, on our website, in institutional materials, or in campaigns related to AMCO’s activities.

You may, at any time, object to the use of your data for these non-essential purposes by completing the form we will provide upon your request. Objecting to the use of your personal data for these secondary purposes will not be grounds for denying you our products and services, nor will it result in any form of discrimination in our relationship with you.

6. Audio, Photo, and Video Recording

During events, interactions, and activities related to AMCO SUMMIT, we may take photos, record audio, and capture video of attendees.

We will use this material for:

Essential purposes

• The safety of attendees and the event.
• Operational documentation of the event.
• Integration and operation of the App’s photo gallery.

Secondary purposes

• Promotion and dissemination of AMCO activities in physical and electronic media.
• Publication on social media, the website, and institutional materials.

7. App Navigation

You may find third-party links in our App; these are advertisements and are completely unrelated to us. Therefore, if you decide to click on them and access those sites, please be aware that you are entering an external site and that we are not responsible for how those sites use your personal data.

8. How do we use automated tools and artificial intelligence?

Responsible AI

We are committed to developing and using artificial intelligence (AI) in a responsible and ethical manner, ensuring that we use it to improve your experience and our services.

To achieve this, we have invested in Responsible AI (RAI) programs and processes, as well as in appointing an AI compliance officer within the company. These principles guide the development, implementation, and use of AI in our processes.

Use of AI

AMCO uses automated facial recognition tools to identify users in event photos and generate personalized galleries within the App.

The sole purpose of this processing is to visually identify the user or, where applicable, the authorized minor, within the event photos, display those photos in their personalized gallery, and facilitate the location, viewing, and downloading of the corresponding images.

9. With whom do we share your personal data?

To fulfill our obligations regarding our relationship with you and the operation of the platform, as well as to achieve our business objectives and offer better products and services, we may transfer your personal data to third parties, whether within or outside Mexico. Recipients of your personal data will only receive the information strictly necessary to achieve the relevant purposes.

Transfers for which your consent is not required

Sale of Your Personal Data

Under no circumstances will we sell your personal data.

10. How do we store and protect your personal data?

Retention Period

• Account, login, purchase, billing, and legal compliance data: This data will be retained for as long as necessary for the legal relationship and for the applicable legal retention periods of up to 10 years, in accordance with tax obligations.
• Photographs and event materials within the App: These will be retained for as long as necessary for the operation of the platform. Photographs that have been downloaded by you, by other users, or by the school prior to their removal from the platform are beyond AMCO’s control.
• Biometric facial recognition data: Biometric facial data will be retained for a maximum period of 1 year from the date of registration, unless the data subject or their legal representative requests its deletion in advance, or unless it must be temporarily retained for security reasons or to address liabilities. After this period, to use facial recognition again, you must re-register and provide your consent once more.

Security Measures

We guarantee the protection of your personal data through administrative, physical, and technical security measures, to prevent unauthorized access, alteration, loss, misuse, or damage to your personal data.

11. Learn about your ARCO rights and how to exercise them

Your ARCO rights

You have the right to:

1. Access: find out what personal data we have about you and how we use it.
2. Rectification: correct your personal data if it is incorrect or incomplete.
3. Cancellation: have your personal data removed from our databases.
4. Opposition: object to the use of your personal data for specific purposes.

Procedure for exercising your rights

To exercise your ARCO rights, submit a written request to our data protection department. We will respond within a maximum of 20 business days, and if applicable, we will carry out the requested action within the following 15 business days. We may extend these deadlines once, depending on the circumstances of your case. In the case of personal data of minors, the exercise of rights must be carried out by a person who can prove they have the appropriate legal representation.

If your request is incomplete or contains errors, we will notify you within 5 business days from the day after we receive it, and you will have 10 business days to address our comments. If you do not comply with this, your request will be deemed not to have been submitted; however, if you do comply, the 20-day period for us to respond to you will begin on the day after you have addressed the request.

You may not exercise your right to object in cases where the use of your data is necessary to comply with a legal obligation regarding our relationship.

Provision of Data (Access)

For requests to access your personal data, the information will be provided at our facilities to ensure the security of your information. You will need to verify your identity or that of your legal representative.

If you require a copy of your personal data, one digital copy per year is free of charge, and a physical copy will incur administrative fees authorized by law.

Would you like us to remove a photo of you or your child?

If you believe that a photograph in which you or your child appears should not remain available within the App or on any of our channels, you may request its removal at any time.

To do so, you must contact our data protection department, providing:

• The name of the requester.
• The name of the person in the photograph.
• The event, location, and date the photograph was taken.
• A description of the image or, if applicable, a screenshot or identification of it within the App.
• A document proving your identity and, if applicable, your status as a parent or guardian.

We will review your request and, if appropriate, proceed to remove or block the corresponding photo within a reasonable timeframe, in accordance with applicable regulations.

Complaints to the Data Protection Authority

If you believe we have violated your rights, you may contact the Personal Data Protection Unit of the Secretariat for Anti-Corruption and Good Governance. However, we ask that you first contact our personal data protection department, which is always ready to assist you.

12. How can you limit the use or disclosure of your personal data?

To limit the use or disclosure of your personal data, you can:

• Register with PROFECO’s Public Registry to Prevent Advertising at repep.profeco.gob.mx, to avoid receiving advertising or promotions from companies offering goods or services. For more information, please contact PROFECO directly.

However, regardless of any restrictions you may set regarding the use or disclosure of your data, please note that, in compliance with various applicable legal provisions, we may be legally required to share your personal data with competent authorities responsible for public safety, intelligence, or law enforcement.

13. When may we be released from liability?

In the event that any or all of the following circumstances occur, we may be unable to continue our relationship with you or fulfill it properly; therefore, if this occurs, you will be solely responsible for the resulting consequences, releasing us from any liability that may arise.

• If you decide not to accept or, as the case may be, to revoke your consent to all or part of the essential purposes of this Privacy Notice.
• If you refuse to provide us with any personal data that is necessary and expressly requested for the essential purposes.
• If you provide us with your personal data incorrectly or incompletely.
• If you decide not to accept or, where applicable, revoke your consent to some or all of the essential transfers of personal data.

The foregoing does not imply a waiver of your rights as the data subject, but it does limit our ability to continue the proposed relationship.

14. Changes to this Privacy Notice

We may occasionally update and modify this Privacy Notice; these changes will be available at our office, on our app, and on our website. If, after being informed of the changes, you do not express your objection, you will be deemed to have accepted the updated terms, except in cases where we must use your personal data for new purposes and require your express, written consent.