PRIVACY NOTICE MYSCENTJOURNEY

Based on the Federal Law on the Protection of Personal Data Held by Private Parties, published on July 5, 2010, in the Official Federal Gazette, MYSCENTJOURNEY (the "Responsible Party"), with the email address: legal@myscentjourney.com, is responsible for collecting your personal data (the "Data Subject").

The processing of personal data that the Data Subject voluntarily and expressly provides to the Responsible Party will be for the following purposes, depending on the specific situation: identification, contact; registration in various databases based on its nature, such as contact, service provider, and/or user of the MYSCENTJOURNEY platform and/or the website www.myscentjourney.com; to verify the Data Subject's information; registration in the internal database of the platform; sending physical or electronic correspondence; statistical purposes; study, analysis, and market research purposes; as well as any other purpose analogous to those established here.

PURPOSES TO WHICH THE PROCESSING OF PERSONAL DATA WILL BE SUBJECT.

The processing of the Data Subject's personal data, unless the Data Subject provides otherwise, through the process described in this Privacy Notice, will be for the following purposes:

1. To allow customers to register their profiles and/or access the platform, as well as to provide the services that our clients or users may require, facilitate, follow up on, and confirm them, and/or carry out any business purpose related to the programs, purchases, or services requested;
2. To promptly inform our clients or users about any changes or modifications to our programs, products, and services;
3. To execute any rights and obligations arising from legal relationships with our clients or users;
4. For the development of new programs, events, products, and services;
5. To comply with applicable laws and regulations, governmental requirements, requirements for compliance with laws and/or valid court orders;
6. To facilitate accounting, billing, auditing, credit checks, or other payment mechanisms;
7. To improve relationships with clients or users;
8. To improve the hiring and sale of all kinds of products or services related to the platform and/or any of its users and/or registered users created or to be created to provide benefits to them;
9. To conduct market research, studies, consulting, and statistical analysis to improve the quality of our programs, products, and services offered on the platform;
10. To carry out marketing, raffles, and other promotions;

To carry out any other supplementary or auxiliary activities related to the operation of the platform and services, including but not limited to the above, as well as those purposes established in the Terms and Conditions Policies, your personal data may also have, among others, the following purposes:

1. To address legal requirements from competent authorities, including but not limited to, any requirements to comply with or assist in the prevention or detection of imminent criminal acts or for the apprehension or prosecution of criminals.
2. To inform you about the range of new programs, products, and services related to the platform, as well as benefits, discounts, promotions, market studies, raffles, notifications about changes in conditions, and generally all advertising related to the programs, products, and services offered through the MYSCENTJOURNEY platform and/or the website.
3. Analysis of programs, promotions, product and/or service reviews/comments.
4. To comply with our terms and conditions applicable to our programs, products, and services.
5. Promotion, advertising, sales, information, and notices related to the MYSCENTJOURNEY platform.

Likewise, the lack of opposition to the processing of personal data by clients and/or users and/or registered users of the MYSCENTJOURNEY platform will be understood as tacit consent by these participants to the processing of the personal data to which they are the Data Subjects by the Responsible Party, to whom the personal information collected by the Responsible Party may be transferred for the purposes established in this Privacy Notice and in accordance with the Terms and Conditions Policy.

This Privacy Notice applies to all information collected by the Responsible Party directly or through third parties with whom it has or will enter into a contractual relationship; to those who consult the contents of the MYSCENTJOURNEY platform and/or website, share content on these platforms, upload information and/or data to register them as clients, users, registered users, and/or provide them with personalized services, always considering the high levels of security required by law.

In the collection and processing of your personal data, the Responsible Party commits to complying with the principles of legality, consent, information, quality, purpose, fairness, proportionality, and accountability, as established in Article 6 of the Federal Law on the Protection of Personal Data Held by Private Parties.

PERSONAL DATA TRANSFER

The Responsible Party may transfer data for the following purposes:

1. To address legal requirements from competent authorities, including but not limited to, any requirements to prevent or detect imminent criminal acts or for the apprehension or prosecution of criminals.
2. Third-party service providers for research, data analysis, sending any type of information focused on the needs of the Data Subject, as well as providing other services necessary or required by the Data Subject.
3. Third parties providing research services, information analysis services that allow the Responsible Party to improve their programs, products, and services, and/or protect their rights.
4. Third parties, as a result of a corporate restructuring, including mergers, consolidations, sales, liquidation, or transfer of assets.
5. When the transfer is necessary or legally required for the safeguarding of a public interest or is required in any other way or requested by government authorities, or for the procurement or administration of justice, as well as in cases where the transfer of information is required by competent authorities of the countries where the Responsible Party conducts operations through the MYSCENTJOURNEY platform and/or website.
6. When the transfer is necessary in connection with a legal process in which the Responsible Party, its affiliates, subsidiaries, parent companies, and companies under common control, or any company within the corporate group to which it belongs, whether national or foreign, are a party.
7. When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the Responsible Party and the Data Subject.
8. To financial, banking, and credit institutions for informational, promotional, advertising, and commercial purposes.
9. In the cases established in the Terms and Conditions Policy of the MYSCENTJOURNEY platform.
10. Third parties who market products and/or provide services related to the MYSCENTJOURNEY platform and/or website, or who advertise on it.
11. Other transmissions provided in the aforementioned Law and its Regulations, as well as in any international treaty in which Mexico is a party.

Third parties and entities receiving personal data assume the same obligations and/or responsibilities as the Responsible Party, in accordance with what is described in this Privacy Notice.

The Data Subject who submits any request to establish a legal relationship with the Responsible Party and/or to become a user and/or registered user of the MYSCENTJOURNEY platform and/or website, and who provides their personal data by any means, agrees to the transfer of their personal data under the terms described in this Privacy Notice and the Terms and Conditions Policy of the MYSCENTJOURNEY platform.

The information gathered from the Data Subject includes personal data that is collected lawfully in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties, with their consent and for the purpose of allowing the Responsible Party to incorporate the information into the MYSCENTJOURNEY platform database; of the Data Subject, clients, users, and/or registered users on the MYSCENTJOURNEY platform and/or the website for identification purposes, to offer services and/or products through the platform, to interact on the platform; and to communicate to the Data Subject via traditional, electronic, or any other means of communication the following:

1. Envío de boletines de noticias,
2. Información de productos,
3. Información de eventos y servicios,
4. Comunicarle de cambios en los mismos,
5. envío de promociones,
6. informarle sobre nuevos productos,
7. invitación a concursos y/o eventos.
8. fines estadísticos,
9. fines comerciales,
10. fines de mercadeo,
11. fines publicitarios,
12. evaluar la calidad del servicio que se brinda y/o de los productos que se ofrecen y/o publicitan en la plataforma y/o página de internet.

INFORMATION TO BE COLLECTED.

The Responsible Party may obtain the Data Subject's personal data through various means, including:

In person: When the Data Subject provides their personal data and/or directly at the address or events organized.

Directly: When the Data Subject provides their personal data via email, telephone, through the MYSCENTJOURNEY platform and/or the website, or by any other electronic, optical, sound, visual, or any other present or future technology.

Indirectly: By any other means permitted by the Law.

Personal Data may be transferred and processed within and outside of Mexico by parties other than the Responsible Party, for the purposes previously detailed. In this regard, Personal Data may be shared with other entities to offer the client, user, and/or registered user new services and/or products through the MYSCENTJOURNEY platform and/or the website.

For the purposes outlined above, the personal data that the Responsible Party may collect and obtain from the Data Subject may consist, including but not limited to: first name(s), last name, paternal last name, maternal last name, date of birth, place of birth, nationality, language(s), personal and/or office address and/or tax address, landline and/or mobile phone number, email, gender, marital status, occupation, federal taxpayer registration, unique population registry code, professional career, university or school graduated from, professional license number, username, profile photo, email address, and phone number associated with the Data Subject's profiles on social media platforms like Instagram, Facebook, Google, and Twitter, comments and opinions shared on the MYSCENTJOURNEY platform (including photos and other content that may contain personal data if the Data Subject chooses to share such content with the Responsible Party via their social media profiles linked to the platform), location data for advertising purposes, credit or debit card number, bank institution name, credit or debit card validity, branch number, bank account number, CLABE interbank key for deposit transactions, among others.

The Responsible Party will not collect Sensitive Personal Data such as racial or ethnic origin, present or future health status, genetic information, religious, philosophical, or moral beliefs, union affiliation, political opinions, or sexual preference.

It is understood that you have given your consent to the transfer of your Personal Data if you do not express opposition to its transfer.

MEANS FOR EXERCISING THE DATA SUBJECT'S RIGHTS.

The Data Subject may exercise their rights to access, rectification, cancellation, opposition, limitation of use, disclosure, or revocation, by submitting a written request containing the following information:

1. The full name of the Data Subject, address, and email address to communicate the response to their request.
2. The documents and/or any other information that may be requested to verify the identity and, if applicable, the legal representation of the Data Subject.
3. A clear and precise description of the personal data regarding which the Data Subject seeks to exercise any of the rights mentioned above.
4. Any other element or document that facilitates the location of the personal data.
5. In the case of rectification requests, the Data Subject must specify the changes to be made and provide the supporting documentation.

The Data Subject's consent for the processing of their personal data by the Responsible Party may be revoked at any time without retroactive effect, as indicated above.

The Data Subject has the right to limit the use or disclosure of their personal data for the purposes previously outlined. If you wish to stop receiving communications from the Responsible Party, send your request to the email: legal@myscentjourney.com, through which you will be excluded, within 15 days from the receipt of the communication, from any non-essential processing of your personal data, after verifying your identity or, if applicable, that of your legal representative, which will be processed without the need for any additional requirements and will not require a follow-up response.

The Data Subject has the right to access the Personal Data they have provided to the Responsible Party and the details of its processing, as well as to rectify it if it is inaccurate or incomplete; cancel its use when they believe it is no longer necessary for the purposes stated in this Privacy Notice, is being used for non-consented purposes, or to oppose its processing for specific purposes. At all times, the Data Subject may revoke their consent for the Responsible Party to process their Personal Data in order to stop using it.

The mechanisms implemented to exercise these rights, in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties, are: (i) by submitting the respective request to the person responsible for handling Personal Data, by sending an email to: legal@myscentjourney.com, which must be confirmed by phone to ensure its proper reception.

The Responsible Party will respond to your request by email within a maximum of 15 business days from the date of receipt. If the request is accepted, the Responsible Party will implement the changes within the following 15 business days after the response is communicated.

The platform is not intended for minors. However, access is not restricted to adults as it does not present any content prohibited for minors under 18 years of age. The forms and/or questionnaires are not intended to collect information about minors.

If the Responsible Party has collected information about a minor, the minor's legal representative may contact the Responsible Party in the terms outlined above to exercise their rights of access, rectification, cancellation, and opposition regarding the information.

The Data Subject's Personal Data will be kept in strict confidentiality, in accordance with the security, administrative, technical, and physical measures that the Responsible Party implements in its security policies and procedures, prohibiting its unlawful disclosure and limiting its use to third parties, as specified for the purposes outlined in this Privacy Notice.

RESPONSIBLE PARTY'S RIGHTS AND OBLIGATIONS

The Responsible Party has the right to make modifications or updates to the text of this Privacy Notice at any time, to comply with the Law, its Regulations, or the Responsible Party's requirements. These modifications will be available on the website www.myscentjourney.com or will be sent to the last email address provided by the Data Subject.

The Responsible Party will store personal data on secure servers and will take reasonable precautions to protect the data and prevent unauthorized access. To this end, the Responsible Party will safeguard the information according to reasonable security standards and procedures.

The Responsible Party will take the necessary measures to ensure that the Privacy Notice provided to the Data Subject is respected at all times by them or by third parties with whom they have a legal relationship.

Any employee of the Responsible Party who, in the course of their work, may have access to your personal information, has agreed to keep it in strict confidentiality in accordance with this Privacy Notice and the Terms and Conditions of Use.

However, the Responsible Party has no control over the risks associated with the functioning of the Internet and warns about potential risks in terms of confidentiality of data transmitted through this network. Access to the information on the platform may be interrupted due to high-priority events or reasons beyond the reasonable control of the Responsible Party, or due to circumstances outside their responsibility.

USE OF COOKIES

Cookies cannot be used to identify you. However, they record information related to (i) the usage your computer makes of the Site (pages visited, date and time of your visit, etc.), which the Responsible Party may use for future visits, or (ii) the number of times promotional content is shown on third-party sites or applications, or (iii) the opening and reading of electronic communications the Responsible Party may send you with your consent.

The Responsible Party may collect information by installing a cookie or a beacon on your computer through the Site or to count the number of clicks on items that the Responsible Party sends you. The Responsible Party may also memorize connection preferences, login, and information related to the use of online services. Depending on the configuration you choose for your terminal, which can be changed at any time, the cookies installed by the Responsible Party through the Site allow:

1. To determine statistics and volumes related to traffic and usage of various components of the Site (sections and content visited, and routes used), which helps improve the relevance and ease of use of the services and/or products offered on the website and platform;
2. To provide services and browsing tailored and directed to you;
3. To count clicks on online service items.

Some services that the Responsible Party offers online can only be used through functional cookies.

The Responsible Party may also purchase advertising spaces to promote its products using promotional content distributed through third-party sites or applications, which may contain cookies. Depending on the configuration you choose for your terminal, which can be changed at any time, these cookies may be installed on your terminal to:

1. To count the number of views and activations of our promotional content distributed through third-party sites or applications; identify such content and sites or applications; and determine the number of users who clicked on each content;
2. To send advertisements when you browse third-party websites or social networks;
3. To establish statistics.

LANGUAGE AND JURISDICTION

This Privacy Notice was originally written in Spanish and may be translated into other languages. However, in the case of any conflict, controversy, or doubt regarding the correct interpretation of this Privacy Notice, the Spanish version will prevail over any translations into other languages.

This Privacy Notice has been issued in compliance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties and its Regulations. This Privacy Notice is solely for the information of our customers, users, and/or registered users who have provided us with their personal data and may not be considered a contract or agreement and does not create any obligation on the part of the Responsible Party.

DATA DELETION POLICIES

1. Purpose

   This document sets out our policy for responding to requests for data deletion under data protection law.

   This document explains the rights of the interested party regarding data deletion and the responsibilities of MyScentJourney in responding to such requests.

2. Individual Rights

   A person has the right to erase their data, also known as "the right to be forgotten." The principle underlying this right is to allow a person to request the deletion of their personal data when there is no obligation or reason for its continued processing.

3. When does the right to erasure apply?

   According to data protection laws, individuals have the right to have their personal data erased and to avoid processing under specific circumstances:

• When personal data is no longer necessary in relation to the purpose for which it was originally collected/processed;
• When the individual withdraws consent;
• When the data subject objects to the processing and there is no other legal basis for the processing activity;
• When personal data has been processed unlawfully;
• When personal data must be deleted to comply with a legal obligation.

4. What information does MyScentJourney retain?

The MyScentJourney online system stores data about individuals to create a user profile for our community. We store the name, email address, gender, date of birth, and the images in the publication shared (if they become a reviewer), which is stored on our secure servers for an indefinite period. This data is stored and used in accordance with our Privacy Policy, which can be found in the same document.

According to the terms and conditions of the platform, you may request to delete all personal and identifiable information from the MyScentJourney platform.

Steps to request the deletion of profile and personal data

1.- Send an email to eduardo@myscentjourney.com with the subject "Data Deletion Request".

2.- In the body, include the reason why you wish to delete your data, the email, and username you use on the MyScentJourney Platform.

3.- You will receive confirmation within a maximum of 72 hours with the details of the deleted information.

After that, your profile and personal information will be deleted.

The data may still remain in the system's backup files, which will be deleted periodically.

The information can be deleted from our site upon request.

We are committed to completing the deletion within one month (90 calendar days) and will send you a confirmation once the information has been fully deleted. Whenever possible, we will try to complete the request before the deadline.

This document will be interpreted exclusively in terms of the Federal Law on Protection of Personal Data Held by Private Parties and its Regulations. The date of the last update of this privacy notice:August 2023