Privacy Notice

1. Data controller and address

221B, S.A.P.I. de C.V., operating under the Cumbra brand, is responsible for processing the personal data it collects for the purposes described in this notice, in accordance with Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares).

Our address is:

For privacy matters: cumbra@cumbra.mx.

2. Data we may process

When you contact us, we may receive your name, email address, phone number if you provide it, company or professional activity, the content of your inquiry and any information you choose to share during follow-up.

For general inquiries, we do not request sensitive personal data, banking information or identification documents. Please avoid including information that is not needed to address your inquiry.

As you browse, the hosting infrastructure may process technical data, such as your IP address, browser, date and time of access and requested pages, to deliver the website, maintain its operation and security, and generate visitor statistics. The embedded map operates as described in section 5.

3. How we use your data

The necessary purposes are:

• Answering your questions and sending you the information you request about Cumbra and its projects.
• Coordinating meetings and following up on conversations or proposals you initiate with us.
• Handling privacy requests and complying with applicable legal obligations.
• Operating the website and preventing incidents that affect its availability or security.
• Understanding general use of the website and improving its operation.

This notice does not provide for automatically subscribing you to advertising campaigns. If an additional use requiring consent is proposed, we will inform you and obtain your consent before proceeding.

This notice covers the corporate website and the handling of inquiries. Entering into a real estate transaction, an investment or another service may require specific data and privacy notices, which must be made available to you at that time.

4. Service providers and data transfers

We use hosting and email services to operate the website and handle communications. These providers may process information as part of delivering those services, subject to applicable obligations.

We may disclose data to authorities when there is a valid legal obligation or request. For any other transfer requiring your consent, we will inform you of the recipient and purpose and obtain your consent in advance.

The linked project websites and social media pages have their own privacy notices. We recommend reviewing them when you leave this website.

5. Google Maps and browsing technologies

The Contact section includes a Google Maps map. When the map loads, your browser connects to Google, which may receive your IP address, browser and device information and other technical data, and use cookies or other technologies in accordance with its settings and policies.

Please review the Google Privacy Policy. You can manage or block cookies in your browser; some map features may be affected.

The platform hosting this website provides visitor statistics to help understand its use and improve its operation. Cumbra has not added other analytics tools or advertising pixels. Google Maps processes information as described in this section.

6. Your rights and how to exercise them

You may request access to, rectification or cancellation of your data, or object to its processing. These are known as ARCO rights under Mexican law. You may also request withdrawal of consent or limit the use or disclosure of your data, where applicable.

Send your request to cumbra@cumbra.mx with the subject line “Privacidad” (Privacy), or submit it in writing at our address. Please include:

• Your name and a means of contacting you with our response.
• The right you wish to exercise or the request you wish to make.
• A clear description of the data involved, except for access requests, and any information that may help locate it.
• Evidence of your identity and, where applicable, legal representation. To correct data, specify the correction and provide the relevant supporting information.

For ARCO requests, we will communicate our decision within 20 business days of receiving your request. If the request is granted, it will be implemented within 15 business days after we communicate the decision. Where justified, these periods may each be extended once for an equal period, in accordance with applicable law.

Once your identity has been verified, access may be provided through an electronic copy sent by the means agreed with you, or through another legally permitted method.

Withdrawal of consent does not have retroactive effect. Certain legal obligations may require us to retain specific data or continue processing it. We will inform you of any limitation applicable to your request and the procedure for handling it.

7. Retention and protection

Data will be retained for as long as necessary to fulfill the purposes for which it was collected and applicable legal obligations or liabilities. When it is no longer needed, it will be blocked or deleted, as appropriate.

Data must be processed confidentially, with administrative, technical and physical measures appropriate to the nature of the information and the applicable risks, to protect it against loss, alteration, destruction or unauthorized access.

8. Changes to this notice

Updates will be published on this page with their revision date. When a change requires additional communication or renewed consent, we will act in accordance with applicable law.

If you have any questions about this notice, please write to cumbra@cumbra.mx.