Privacy Notice

Data Controller Information

SPUTNIK DIGITAL S.A.P.I. DE C.V. operates BNN. Address: Calle de Rosaleda No. 34, Colonia Lomas Altas, Alcaldía Miguel Hidalgo, C.P. 11950, Mexico City, Mexico.

Information Collected by SPUTNIK

Personal data is obtained when:

• The user registers at www.bnn.mx.
• The user participates in contests and promotions.
• Information is sent by email.
• Through social media.
• Job applications.
• Service offerings.
• Engagement of services.

SPUTNIK also obtains data through publicly available sources while respecting the reasonable expectation of privacy.

Data Categories by Data Subject Type

Candidates

Occupation, age, sex, RFC (Federal Taxpayer Registry), CURP (Unique Population Registry Code), driver's license, education records, languages, work experience, references, availability to travel, curriculum vitae. Documentation: birth certificate, official ID, proof of studies, proof of address.

Clients

Name or corporate name, address, CURP, RFC, SAT tax registration certificate, bank account statement, contacts, phone numbers, email addresses. Documentation: official ID, business references.

Website and Social Media Users

Full name, nationality, age, date and place of birth, banking details (semifinalists/finalists), social media profile, photographs, email address.

Restriction. We do not collect sensitive data revealing racial or ethnic origin, health status, genetic information, religious beliefs, union membership, or sexual orientation.

Primary Purpose

Express consent granted pursuant to Article 8 of Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

Candidates

• Contact for follow-up and evaluation of selection feasibility.
• Physical or digital file kept by Human Resources for up to 5 years.

Clients and Prospects

• Phone or email contact to follow up on requests.
• Registration and updates within our internal system.
• Physical or electronic file kept for the duration of the business relationship and 10 years thereafter.
• Electronic invoicing and credit notes.
• Transactions with credit institutions.

Website Users

• Email contact for comments and requests.
• Access to social media.
• Registration for tournaments, promotions, and activities.
• Database retained for 5 years from the date of collection.

Secondary Purpose

Data is also used for commercial purposes: statistics, personalized advertising, and market research. Disclosure is made only pursuant to legal mandate and to competent authorities.

Specific Secondary Purposes

• Communications, newsletters, and event invitations.
• Information about changes and new products or services.
• Internal reports on site usage.
• Mass email marketing campaigns.
• Security updates.
• Candidates: sharing of data with other job boards, in line with the customary exchange among personnel recruiters.

Withdrawal of Consent

Request via email to derechos.arco@ocesa.mx, specifying the purposes being rejected.

Privacy and Security of Your Information

Use of IP Addresses

Used for threat analysis and demographic information. It is never used to identify data subjects.

Data Subject's Responsibility

The data subject agrees that the data provided is truthful, current, and correct, and undertakes to hold SPUTNIK harmless from claims arising from errors in the information provided.

Jurisdiction

Processing is carried out in accordance with Mexican law.

Security Measures

SPUTNIK implements reasonable security measures, both online and offline.

Third-Party Sites

Hyperlinks, banners, and tools may lead to third-party sites not covered by this notice. Users should check the corresponding privacy notices.

Data Transfer

In accordance with Article 36 of the LFPDPPP.

Security Breaches

In the event of a breach significantly affecting data subjects' rights, notification will be sent by email immediately. SPUTNIK disclaims liability if the breach is not attributable to it.

Access, Rectification, Cancellation, and Opposition — ARCO Rights

ARCO rights (Access, Rectification, Cancellation, and Opposition) are the rights granted to data subjects under the LFPDPPP.

The procedure is initiated through the form: legalocesa.mx

Required Information

• Full name.
• Registered email address.
• Site of registration.
• Electronic copy of an identity document (voter ID, passport, or professional license card).
• Clear description of the data over which rights are being exercised.
• Indicate the requested modifications or limitations.

Timeframes

• Response within 20 business days of receipt.
• Implementation within the following 15 business days.

Invalid Requests

Requests will not proceed when:

1. The requester is not the data subject, or the representative is not properly accredited.
2. The data does not exist in SPUTNIK's database.
3. A third party's rights would be harmed.
4. There is a legal impediment or a ruling from a competent authority.
5. The request has already been made previously.

Opposition

Users may object to the processing of their data or to receiving information via email. Cancellation is carried out automatically through the unsubscribe link in emails; the data will be removed from the database.

Changes to This Privacy Notice

SPUTNIK reserves the right to modify this notice due to legislative developments, internal policies, or new requirements. Changes will be published at bnn.mx .