PRIVACY POLICY

www.astros.com.mx (hereinafter "astros" "Astros" or "we" or "us") has as one of its objectives the protection of the confidentiality and privacy of the personal information to which it has access. As part of this fundamental obligation, we are committed to protecting and properly using the personal information or data (hereinafter "Personal Data") collected through this website or voluntarily provided by visitors to our website (hereinafter referred to as "Users" or "You").

Our intention is to collect only the Personal Data voluntarily provided by you so that we can offer information and/or services to you. Please review the Privacy Notice to learn more about how we collect, use, share, and protect the Personal Data we have obtained. As a general rule, Astros collects only the Personal Data necessary to fulfill the User's request. When additional Personal Data is requested, you will be notified at the time of collection.

Collection and use of Personal Data subject to processing

1.1 Personal Data subject to processing

We obtain Personal Data about Users when they choose to provide it, for example, to register for certain services. If you choose to register or log in to our website using a third-party single sign-on service that authenticates your identity and connects your social media login information (e.g., LinkedIn, Google, X, or similar) with us, we will collect any Personal Data or content necessary for such registration or login that you have permitted the social media provider to share with us, such as your name and email address.

The other Personal Data we collect will depend on the privacy settings you have selected with your social media provider. Please review the Privacy Notice or Privacy Policy applicable to the service in question. Your Personal Data is not used for any other purpose unless we obtain your consent, or unless required or permitted by applicable law (hereinafter, "Law").

When you register or submit Personal Data to us, we will use this information as described in this document. Your Personal Data will not be used for other purposes unless we obtain your permission, or unless required or permitted by applicable law or other regulations. For example, if you register on our website and provide information about your preferences, we may use this information to personalize your user experience. When you register or log in using a third-party unique user registration, we may also recognize you as the same user across different devices and personalize your user experience.

In some cases where you have registered for certain services, we will temporarily store your email address until we receive confirmation of the information you provided via email (when we send an email to the email address provided as part of your registration).

1.2 The legal bases to which we must adhere to process your Personal Data

We generally collect only the Personal Data necessary to fulfill your request. When additional and optional information is requested, you will be notified at the time of collection.

Mexican law allows us to process your Personal Data, provided we have a legitimate purpose for doing so. It also requires us to inform you of those purposes. Therefore, when we process your Personal Data, we rely on one of the following processing conditions:

— Performance of a contract: When the processing of your Personal Data is necessary to fulfill our obligations under a contract;

— Legal obligation: When we are required to process your Personal Data to comply with a legal obligation, such as maintaining records for tax purposes or providing information to a public body or law enforcement agency;

— Legitimate interest: We will process your Personal Data when it is in our legitimate interest to process a matter entrusted to us in order to advance it, provided that your interest prevails; or

— Your consent: In some cases, pursuant to law, we will ask for your authorization to process your Personal Data, and we will only do so if you agree to us doing so. You may withdraw your consent at any time by contacting us at datosprotegidos@astros.com.mx.

Some examples of the “legitimate interests” mentioned above are:

— To provide information and/or services to visitors to our website or to provide information about job opportunities.

— To prevent fraud or illegal activities and to safeguard our IT system.

— To personalize people's online experience and improve the performance, usability, and effectiveness of our online presence.

— To conduct and analyze our marketing activities

1.3 Automatic Collection of Personal Data

In some cases, we and our service providers use cookies, web beacons, and other technologies to automatically collect certain types of information when you visit our website, as well as through emails we may exchange. Collecting this information will allow us to better understand and improve the performance, usability, and effectiveness of our website and measure the effectiveness of our marketing activities.

1.3.1 IP Addresses

An IP address is a number assigned to your computer each time you access the Internet. It allows computers and servers to recognize and communicate with each other. The IP addresses from which visitors appear to originate may be logged for computer security and system diagnostic purposes. This information may also be used in aggregate form to analyze website trends and performance.

1.3.2 Cookies

Cookies are typically placed on your computer or internet-enabled device each time you visit us online. This allows the website to remember your computer or device and serves a number of purposes. A notification banner may appear on our website asking for your consent to use cookies. If you do not consent, your computer or internet-enabled device will not be tracked for marketing-related activities. A secondary type of cookie called "user input cookies" may still be required for its operation.

These cookies will not be blocked by using this notification banner. Your selection will be saved for a period of 90 days. If you wish to revoke your selection, you can do so by deleting the cookies in your browser.

Although most browsers automatically accept cookies, you can choose whether or not to accept cookies through your browser settings (often found in your browser's tools or preferences menu). You can also delete cookies from your device at any time. However, please note that if you do not accept cookies, you may not be able to fully enjoy some of our website's features.

Below is a summary of the categories of cookies collected on our website and how your consent may affect your experience with certain features while browsing our website:

– Targeting Cookies: These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

– Functionality Cookies: These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages. If you do not allow these cookies, some or all of these services may not function properly.

– Performance cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies, we will not be able to know when you have visited our site, so its performance cannot be monitored.

– Strictly necessary cookies: These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

You can find more information about managing cookies in your browser's help file or on sites such as www.allaboutcookies.org.

Below is a list of the types of cookies used on our website:

Purpose

Description

Type and expiration

Performance (users browser)

Our website is built using the most common internet platforms. These include cookies that help resolve compatibility issues (for example, by identifying your browser type) and improve performance (for example, by making content load faster). Session is deleted when you close you browser.

Security Cookies

If you register to access a restricted area, our cookies ensure that your device is logged in for the duration of your visit. You will need your username and password to access restricted areas.

Session expires when you close your browser

Site preferences

Our cookies may also remember your site preferences (for example, language) or try to enhance your experience (for example, by personalizing a greeting or content). This will apply to areas you have specifically registered to access or created an account.

Session will be deleted when you close your browser

Analytics

We use several third-party analytics tools to help us understand how visitors use our website. These allow us to improve the quality and content of Astros for our visitors. Aggregate statistical data includes items such as total visits or page views, and referrals to our websites. For more details on our use of Google Analytics, see below.

Persistent, but will be automatically deleted after two years if you stop visiting our website.

Comments from visitors to the site.

We use a third-party survey tool to invite a percentage of visitors to participate and provide feedback. Cookies are used to prevent visitors from being invited multiple times.

The first cookie (1) is set if the visitor is not invited to participate in the survey and is used to ensure that visitors are not invited after their first visit to the page.

The second cookie (2) is set if the visitor is invited to participate in the survey and is used to ensure that the visitor is not invited again for a period of 90 days.

1 Session will be deleted when you close your browser

2 Persistent, but will be automatically deleted after 90 days or upon submission of the survey invitation.

Share in social networks.

We use third-party social media widgets or buttons to provide you with additional functionality for sharing content from our web pages on social media and via email. Using these widgets or buttons may place a cookie on your device to facilitate your use of their service, ensure that your interaction with our web pages is displayed (for example, the social share count cache is updated), and record information about your online and website activities. We recommend that you review each provider's privacy information before using any such service.

Persistent, but will be automatically deleted after two years if you stop visiting our website.

Other third-party tools and widgets will occasionally be used on our individual websites to provide additional functionality. Using these tools or widgets typically places a cookie on your device to facilitate your use of their service and ensure that your interaction with our websites is displayed correctly.

Cookies themselves do not tell us your email address or personally identify you. In our analytics reports, we will obtain other identifiers, including IP addresses, but this is for the purpose of identifying the number of unique visitors to our websites and the geographic origin of visitor trends, and not to identify individual visitors.

By browsing our website, you agree that we may place these cookies on your computer or internet-enabled device.

1.3.3 Google Analytics

We use Google Analytics. You can find more information about our use of Google Analytics at: http://www.google.com/analytics/learn/privacy.html To offer website visitors more choices about how their data is collected by Google Analytics, Google has developed the Google Analytics Opt-out Browser Add-on.

The add-on communicates with the Google Analytics JavaScript tag (ga.js) to indicate that information about the website visit should not be sent to Google Analytics. The Google Analytics Opt-out Browser Add-on does not prevent information from being sent to the website itself or to other web analytics services.

1.3.4 Web beacons

A web beacon is a small image file on a web page that can be used to collect certain information from your computer, such as an IP address, the time the content was viewed, browser type, and the existence of cookies previously set by the same server.

We only use web beacons in accordance with the law. We or our service providers may use web beacons to track the effectiveness of third-party websites that provide us with recruitment or marketing services or to collect aggregate visitor statistics and manage cookies.

You have the option to disable the graphic processing of some web beacons by rejecting their associated cookies. The web beacon may still record an anonymous visit from your IP address, but the cookie information will not be recorded.

In some of our newsletters and other communications, we may confirm a recipient's email address via links embedded within the messages. We collect this information to gauge user interest and improve future user experiences.

1.3.5 Localization Tools

We will collect and use the geographic location of your computer or mobile device. This location data is collected to provide you with information about services we believe may be of interest to you based on your geographic location and to improve our location-based products and services.

1.4 Applications and social networks widgets

Our website will generally include features that allow sharing through third-party social media applications, such as the Facebook Like button and the WhatsApp, LinkedIn, or YouTube widget. These social media applications will collect and use information about your use of our website (see details about the "Sharing on Social Media" cookies above).

Any Personal Data you provide through such social media applications will often be collected and used by other members of that social media application, and such interactions are governed by the privacy policies of the companies providing the application. We have no control over or responsibility for these companies or their use of your Personal Data. Besides, our website may host blogs, forums, crowd sourcing applications and other services (jointly, ‘social networks functions’).

The purpose of social media features is to facilitate the sharing of knowledge and content. Any Personal Data you provide on any of our social media sites will typically be shared with other users of that social media site (unless otherwise indicated at the point of collection), over whom we often have limited or no control.

1.5 Children

We understand the importance of protecting the privacy of minors, especially in an online environment. In particular, our sites are not intentionally designed for or directed at minors under the age of 17 (seventeen). Our policy is never to collect or maintain information about anyone under the age of 17 (seventeen), except as part of a contract to provide professional services.

Share and Transfer personal data

2.1 Transfer within our network

We share your Personal Data with other member firms in our network when necessary or desirable to comply with our legal and regulatory obligations worldwide. Other parts of our network also use your Personal Data to provide complementary services to us and you, for example, conducting client dispute and anti-money laundering checks, assisting with client engagement services, and otherwise as needed to continue running our business.

2.2 Transfer to third parties

We do not share Personal Data with third parties except when necessary for our legitimate professional and business needs, to carry out your requests, and/or as required or permitted by applicable law or regulations. This includes:

— Our service providers: We transfer your Personal Data to our service providers, such as our IT systems providers, our server/hosting providers, our payroll providers, consultants (such as legal advisors), and other providers of goods and services. We work with these providers to process your Personal Data on our behalf. We will only transfer Personal Data to them when they comply with our strict data processing and security standards. We only share Personal Data strictly necessary to allow them to provide us with their services.

In addition, We may transfer certain Personal Data outside of Mexico to third-party companies that work with us or on our behalf for the purposes described in the Privacy Policy. If we do this, your Personal Data will continue to be protected by contracts we have in place with those organizations outside of Mexico, which contain standard data protection clauses that comply with the law. We will not transfer the Personal Data you provide to third parties for their own direct marketing use.

— Courts, tribunals, regulatory bodies, and law enforcement agencies: We will disclose confidential information to respond to requests from courts, tribunals, government agencies, or law enforcement agencies, or when necessary or prudent to comply with applicable laws, court or tribunal orders and rules, or government and professional regulations.

— Audits: Disclosure of Personal Data may also be necessary for security or data privacy audits, and/or to investigate or respond to a complaint or security threat.

3.Options

In general, you should not be required to submit any Personal Data to us, but we will ask you to provide certain Personal Data to receive additional information about our services and events.

We will also ask for your permission for certain uses of your Personal Data, and you may accept or decline those uses. If you opt in to certain services or communications, such as an email newsletter, you may unsubscribe at any time by following the instructions included in each communication.

If you decide to unsubscribe from any service or communication, we will try to delete your Personal Data promptly, although we may need additional information before processing your request. You may also opt out of cookies if you choose to object or decline cookies in accordance with the law.

As described above under "Cookies," if you wish to prevent cookies from tracking you while browsing our site, you can reset your browser to refuse cookies or to indicate when cookies are being sent. However, please note that some parts of our site may not function properly if you choose to refuse cookies.

4. Your rights

If we use your personal data, you have the following rights:

— Right of Access: You have the right to access this data. This is called a "data subject access request." If we agree that we are required to provide you with Personal Data, we will provide it to you free of charge using the process described in the Privacy Notice.

— Right to Rectification: If the Personal Data we hold about you is incorrect, you have the right to ask us to correct any inaccuracies in your Personal Data.

— Right to Object: You have the right to object to the processing of your Personal Data if we no longer have a reason to use it.

— Right to Delete: You may also have the right to have your Personal Data deleted if we retain it for too long, or to restrict its processing in certain circumstances.

You can request or exercise these rights by contacting us at datosprotegidos@astros.com.mx, and we will make all reasonable and practical efforts to comply with your request, provided it is consistent with the law and professional standards.

Once we receive your ARCO rights request, we will send you our "Unique Form for the Exercise of ARCO Rights." To follow up on the request, we may ask for proof of identity and sufficient information about your interactions with us to locate your Personal Data. Please read the Privacy Notice for this purpose.

5. Security and Integrity of Personal Data

We have reasonable security policies and procedures in place to protect Personal Data against unauthorized loss, misuse, alteration, or destruction. However, despite our best efforts, security cannot be absolutely guaranteed against all threats. To the extent possible, access to your Personal Data is limited to those who have a need to know. Individuals who have access to Personal Data are required to maintain the confidentiality of such information.

We also make reasonable efforts to retain Personal Data only (i) for as long as the information is necessary to fulfill individual requests, (ii) for as long as necessary to comply with legal, regulatory, internal business, or policy requirements, and (iii) until Users request deletion. The period for which data is retained will depend on the specific nature and circumstances under which the Personal Data was collected.

6. Links to other sites

Please be aware that our website may contain links to other sites, including those maintained by other member firms, which are not governed by this privacy policy but by other privacy policies that may differ slightly. We encourage you to review the privacy policy and/or Privacy Notice of each website you visit before disclosing any Personal Data.

By registering on our website and browsing to another website related to us while still logged in, you consent to the use of your Personal Data in accordance with the Privacy Policy of our website you are visiting.

7. Amendments to this Privacy Policy

We may modify this privacy policy from time to time to reflect our current privacy practices. When we make changes to this policy, we will revise the "updated" date at the top of this page. Any changes to the processing of your Personal Data described in this Privacy Policy that affect you will be communicated to you through an appropriate channel, depending on how we normally communicate with you.

8. Questions about this policy and how it is applied.

We are committed to protecting the online privacy of your Personal Data. If you have questions or comments about our management of your Personal Data, please contact us at datosprotegidos@astros.com.mx . You can also use this address to communicate any concerns you may have regarding compliance with our Privacy Policy.

If you are not satisfied with the response you receive, you can raise your complaint with the Privacy Officer by sending an email to datosprotegidos@astros.com.mx. We will acknowledge receipt of your email within 14 business days and will try to resolve your issue within 30 business days of receipt. If your request is complex or we have a high volume of requests, we will try to resolve it within 90 business days from the date the issue was raised. We may accept your complaint (and in that case, apply one of the measures outlined in the "Your Rights" section above), or we may reject your complaint for legitimate reasons. Please check for additional in our Privacy Notice.

In any case, you always have the right to file a complaint with the competent authority, the regulator responsible for the protection of personal data in Mexico under applicable law.