Privacy Notice

INTEGRAL PRIVACY NOTICE Last updated: 2026-04-17 I. IDENTITY AND ADDRESS OF THE DATA CONTROLLER WezOps LLC, operating commercially under the brand "Nómaton" (hereinafter, "Nómaton" or the "Controller"), with registered address at 447 Broadway, 2nd Floor Suite #2566, New York, New York 10013, United States of America, is the legal entity responsible for the processing of your personal data. For any matter related to this Privacy Notice, you may contact our personal data protection department at: - Email: privacy@nomaton.mx II. PERSONAL DATA COLLECTED For the purposes set forth in this Privacy Notice, we may collect the following categories of personal data: a) Identification data: full name, date of birth, gender, marital status, nationality, CURP (Unique Population Registry Code), RFC (Federal Taxpayer Registry), photograph. b) Contact data: home address, telephone number, email address. c) Employment data: position, department, hire date, contract type, work schedule, salary, seniority, employee number. d) Tax data: RFC, tax regime, tax address. e) Social security data: Social Security Number (NSS), IMSS registration, affiliation movements (registrations, deregistrations, salary modifications). f) Financial data: interbank CLABE, bank name, account number for payroll deposit. g) Patrimonial data: integrated daily salary (SBC), earnings, deductions, withheld ISR, IMSS contributions, INFONAVIT, savings fund. h) Sensitive data: health data (solely medical disability certificates issued by IMSS for payroll calculation and compliance with employer obligations). We inform you that the processing of your sensitive personal data requires your express consent, which you may grant upon accepting this Privacy Notice. III. PRIMARY PURPOSES OF PROCESSING (NECESSARY) Your personal data will be processed for the following primary purposes, which are necessary for the maintenance of the employment relationship and the fulfillment of legal obligations: 1. Processing and calculation of ordinary and extraordinary payroll (Christmas bonus, profit sharing, settlement pay, severance pay). 2. Calculation and withholding of Income Tax (ISR) pursuant to Article 96 of the Income Tax Law. 3. Calculation and payment of employer-employee contributions to the Mexican Social Security Institute (IMSS) pursuant to the Social Security Law. 4. Generation of Digital Tax Receipts (CFDI) for payroll pursuant to Article 29 of the Federal Tax Code. 5. Processing of affiliation movements with IMSS (registrations, deregistrations, salary modifications) pursuant to Article 15 of the Social Security Law. 6. Calculation of contributions to the National Workers' Housing Fund Institute (INFONAVIT) pursuant to the INFONAVIT Law. 7. Generation of bank payment files for payroll disbursement. 8. Compliance with tax, labor, and social security obligations established in applicable Mexican legislation. 9. Retention of employment records pursuant to Article 804 of the Federal Labor Law and tax records pursuant to Article 30 of the Federal Tax Code. IV. SECONDARY PURPOSES OF PROCESSING (NOT NECESSARY) Additionally, your personal data may be used for the following purposes that are not necessary for the employment relationship, but allow us to improve our services: 1. Preparation of aggregate statistical analyses, without including identifiable personal data. 2. Continuous improvement of the Nómaton platform and its services. 3. Communications regarding service updates, new features, and payroll best practices. 4. Generation of anonymized, aggregated workforce analytics across the platform, including but not limited to: salary benchmarking by industry, region, and role; workforce demographic trends; turnover and retention rate analysis; compensation band distributions; and compliance metric benchmarking. These analytics use only statistical aggregates derived from de-identified data and never include information that could identify any individual employee or specific employer. WezOps LLC and authorized tenant administrators may access these aggregated insights through the platform dashboard. If you do not wish your personal data to be processed for these secondary purposes, you may express your refusal through the following mechanisms: - Sending an email to privacy@nomaton.mx with the subject line "Limitation of secondary purposes." - Through the settings available in the employee portal on the Nómaton platform. Your refusal to the use of your personal data for these purposes cannot be grounds for denying you the services you request or contract with us. V. ARCO RIGHTS (ACCESS, RECTIFICATION, CANCELLATION, AND OPPOSITION) You have the right to know what personal data we hold about you, the purposes for which we use it, and the conditions of use (Access). Likewise, it is your right to request the correction of your personal information if it is outdated, inaccurate, or incomplete (Rectification); to have it deleted from our records or databases when you consider it is not being used properly (Cancellation); and to oppose the use of your personal data for specific purposes (Opposition). To exercise any of the ARCO rights, you must submit a request through the following means: - Email to: privacy@nomaton.mx - Through the ARCO rights module available in the employee portal on the Nómaton platform. Your request must contain at least: 1. Full name of the data subject and address or other means to communicate the response. 2. Documents proving your identity (valid government-issued identification) or, where applicable, legal representation of the data subject. 3. Clear and precise description of the personal data for which you seek to exercise any of the ARCO rights. 4. Any other element or document that facilitates the location of the personal data. Response timeframes: - Response to your request: 20 (twenty) business days from the date the request was received. - Delivery of personal data (in case of access): 15 (fifteen) business days following the communication of the affirmative response. The exercise of ARCO rights is free of charge, pursuant to Article 24 of the LFPDPPP. Only costs related to shipping, reproduction, or certified copies may be incurred. VI. REVOCATION OF CONSENT You may revoke the consent that you may have granted us for the processing of your personal data. However, it is important to note that we may not be able to fulfill your request or immediately cease processing in all cases, as we may need to continue processing your data due to legal or contractual obligations. To revoke your consent, you must submit your request through: - Email to: privacy@nomaton.mx - Through the employee portal on the Nómaton platform. Consequences of revocation: Revocation of consent for the processing of personal data linked to primary purposes will prevent payroll processing and the fulfillment of corresponding labor and tax obligations. VII. PERSONAL DATA TRANSFERS We inform you that your personal data is transferred to the following entities for the purposes described below: Domestic transfers: 1. Authorized Certification Provider (PAC): for stamping payroll CFDI. Legal basis: Article 29 of the Federal Tax Code. 2. Mexican Social Security Institute (IMSS): for processing affiliation movements (registrations, deregistrations, salary modifications). Legal basis: Article 15 of the Social Security Law. 3. National Workers' Housing Fund Institute (INFONAVIT): for compliance with housing-related obligations. Legal basis: INFONAVIT Law. 4. Banking institutions: for payroll disbursement through payment files. Legal basis: contractual relationship entered into for the benefit of the data subject. International transfers: 1. Database servers located in the United States of America (cloud infrastructure provider, East US 2 region). Legal basis: Article 37, Section VII of the LFPDPPP (transfer necessary for the fulfillment of an obligation contracted in the interest of the data subject by the controller). The transfers described above do not require your consent pursuant to Article 37 of the LFPDPPP, as they are transfers necessary for the fulfillment of legal and/or contractual obligations. Aggregated data: Anonymized, aggregated data derived from Employee Data may be combined with data from other platform tenants to produce industry benchmarks and workforce analytics. This Aggregated Data cannot be used to re-identify any individual employee or employer. WezOps applies a minimum anonymity threshold (k >= 5) to ensure no individual or small group can be distinguished within any published aggregate. VIII. CHANGES TO THIS PRIVACY NOTICE This Privacy Notice may be modified, changed, or updated due to new legal requirements, our own needs regarding the services we offer, our privacy practices, or other causes. We are committed to keeping you informed of any changes to this Privacy Notice through: - Email sent to the address registered in your user profile. - Prominent notice within the Nómaton platform. Previous versions of this Privacy Notice will remain available for consultation within the platform. IX. CONSENT By providing your personal data through the Nómaton platform, you consent to the processing thereof under the terms described in this Privacy Notice. For the processing of sensitive personal data (health data related to medical disabilities), express consent will be requested at the time of your onboarding to the platform. X. SUPERVISORY AUTHORITY If you believe that your right to personal data protection has been violated by any conduct or omission on our part, or you presume any violation of the provisions of the Federal Law on Protection of Personal Data Held by Private Parties, its Regulations, and other applicable provisions, you may file a complaint with the National Institute for Transparency, Access to Information, and Personal Data Protection (INAI). For more information, we suggest visiting their official website: www.inai.org.mx