Privacy Notice

Version 10.1 · Effective date: July 16, 2026 · Last updated: July 16, 2026 · Language: English (translation)

1. Identity and address of the Data Controller

SIE PARK, S.A. de C.V. ("SIE PARK"), with its address at Av. Molière 328, Polanco II Sección, Alcaldía Miguel Hidalgo, C.P. 11530, Mexico City, is the party responsible (the "Data Controller") for processing the personal data you provide through siepark.net and through the contact channels indicated in this notice, in accordance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and other applicable provisions.

For privacy matters and the exercise of your rights: contacto@siepark.net.

2. Scope of processing

This website carries out two main form-based processing activities: the request for a proposal for an asset and the invoice request. In addition, SIE PARK may receive data through its contact channels (email and telephone) and automatically obtain certain technical and browsing data necessary for the security and operation of the site and, where you authorize it, for statistical measurement.

This website does not collect data through video surveillance, nor does it collect data on employees, job applicants, monthly-pass holders, or access control; any such processing, where it exists, is governed by separate privacy notices outside the scope of this document.

3. Personal data we collect

3.1 Request-for-a-proposal form

Representative or applicant data: name, company or organization (where applicable), job title, email address, and telephone number.

Organization and asset information: asset type, model of interest, organization type, city, address or area of the asset, approximate surface area, number of parking spaces, number of locations, estimated decision date, current status of the asset, main issue or need, and additional comments.

Individual (natural-person) owners. If you take part as an individual owner (or as an authorized representative of one), and the asset information is linked to your personal estate, that information may constitute financial/patrimonial data. In that case, processing is carried out with your express consent, obtained through a specific checkbox on the form, and solely to evaluate the asset and prepare the proposal.

3.2 Invoice-request form

Transaction and tax data: parking facility or location, ticket date, ticket number, total amount, Federal Taxpayer Registry number (RFC), name or business name, tax postal code, tax regime, CFDI use, payment method, payment form, delivery email address (and its confirmation), and comments or clarifications.

Documents you may attach. Optionally, your Tax Status Certificate (Constancia de Situación Fiscal); and, only where necessary to identify the transaction, your ticket or proof of payment. Regarding the Certificate: although for invoicing we use only four data points (RFC, name or business name, tax regime, and tax postal code), the file you attach is received, transmitted, scanned, and stored temporarily in its entirety until those data are extracted and verified, after which it is deleted in accordance with our retention periods.

3.3 Technical and browsing data

The website processes technical and browsing data such as: IP address, date and time of access, browser type, operating system, device type, cookie identifiers, approximate location, browsing events, cookie preferences, and technical signals used to protect the forms against automation, fraud, or abuse. The verified detail of this data, cookies, and technologies is kept in the website's technical inventory.

3.4 Sensitive data

SIE PARK does not request sensitive personal data through this website. Please do not provide it in the open fields or in attached documents, nor attach banking data (cards, bank statements, CLABE account numbers, balances). Where such data is received unsolicited and is not necessary for the relevant purpose, it will be deleted in accordance with our internal procedures.

4. Purposes of processing

4.1 Request for a proposal (primary purposes)

• Receiving and handling your request and identifying the representative or applicant.
• Identifying and evaluating the asset and assessing its viability.
• Contacting you and, where necessary, arranging a technical site visit.
• Preparing and presenting a lease, participation, or operating proposal.
• Following up on any resulting business relationship.

4.2 Invoice request (primary purposes)

• Identifying the transaction and validating the ticket or the payment.
• Validating the tax data, issuing and delivering the CFDI, and handling clarifications.
• Complying with applicable tax, accounting, and legal obligations and retaining strictly necessary supporting records.

4.3 Handling of contact channels

Handling the communications you initiate by email (contacto@siepark.net and facturacion@siepark.net) or telephone, and following up on your request.

4.4 Security and operation

Verifying the legitimacy of requests and protecting the forms against automation, fraud, abuse, mass submissions, and malicious files, as well as maintaining the technical operation of the site.

4.5 Optional analytics purpose

Where the visitor authorizes it through the website's cookie-preferences panel, generating statistics on the use, browsing, and performance of the site. Declining this purpose does not prevent you from using the forms or accessing the site's essential functions.

5. Legal basis and consent

Proposal (organization representatives): the data subject's consent (Article 7 of the LFPDPPP), unless a legal exception applies.

Proposal (individual owners — patrimonial data): express consent, pursuant to Article 7, fifth paragraph, of the LFPDPPP, obtained through a specific checkbox.

Invoice request: processing to comply with tax provisions and obligations arising from the legal relationship between the applicant and SIE PARK, pursuant to Article 9, sections I and IV, of the LFPDPPP; no consent is required.

Contact channels (email, telephone): the data subject's consent upon initiating the communication (Article 7).

Technical, security, and Cloudflare Turnstile data: processed because it is necessary for the security and operation of the site, without requiring consent, as it falls within the exceptions of Article 9 of the LFPDPPP.

Google Analytics 4: the visitor's prior consent, given in the cookie-preferences panel (Article 7).

6. Transfers and processors

SIE PARK relies on providers that process data on its behalf and under its instructions (processors), in categories such as: hosting and infrastructure, database, encrypted document storage, anti-bot verification, anti-malware file scanning, automated email delivery, corporate email, analytics, and the issuance or stamping of tax receipts (PAC). Some operate outside Mexico, mainly in the United States, and others in Mexico. Disclosing data to these processors is an onward disclosure (remisión, i.e., processing by a processor on the controller's behalf) and does not require your consent.

The disclosure of tax receipts to the Mexican Tax Administration Service (SAT), through the PAC, is a transfer required by tax provisions that may be carried out without your consent (Article 36, section I, of the LFPDPPP). SIE PARK does not sell your personal data or share it with third parties for purposes other than those described in this notice.

7. Security measures

SIE PARK maintains reasonable administrative, technical, and physical safeguards, proportionate to the nature of the data, the purposes of processing, and the risks involved, in order to protect it against damage, loss, alteration, destruction, and unauthorized use, access, or processing. In the event of a breach that significantly affects your rights, SIE PARK will notify you as required by law.

8. ARCO rights and how to exercise them

You have the right to: Access your data and learn the conditions of its processing; Rectify it when inaccurate or incomplete; Cancel it, that is, request its deletion when you consider it is no longer necessary for the purposes, has ceased to be necessary, you have withdrawn your consent, or for any other cause provided by law (cancellation gives rise to a blocking period followed by deletion, unless a legal retention obligation exists); and Object to processing for specific purposes or on legitimate grounds.

How to exercise them. Send your request to contacto@siepark.net. Under Article 28 of the LFPDPPP, the request must include: (I) your name and address or another means to communicate the response; (II) documents establishing your identity or, where applicable, legal representation; (III) a clear and precise description of the data in respect of which you seek to exercise the right; and (IV) any element or document that helps locate the data. For Rectification, also indicate the changes and provide supporting documentation.

Time limits, delivery, and cost. SIE PARK will communicate its decision within a maximum of 20 business days and, if granted, will give it effect within the following 15 business days; these periods may be extended once, for an equal period, where circumstances justify it, which will be communicated to you. The response will be delivered through the same contact means or the one you indicate. Exercising these rights is free of charge; only justified costs of shipping or of reproduction in copies or other formats may be charged.

9. Withdrawal of consent

Where processing is based on your consent, you may withdraw it at any time by writing to contacto@siepark.net. Withdrawal does not apply to data whose processing is necessary for SIE PARK to comply with its tax or legal obligations.

10. Limiting the use or disclosure of your data

You may request that the use or disclosure of your data be limited by writing to the same email address. This website does not carry out advertising.

11. Cookies and tracking technologies

Technical and security cookies. Necessary for the operation of the site; they cannot be disabled.

Cloudflare Turnstile. It runs technical checks and obtains signals about the visitor's browser or environment to distinguish legitimate traffic from automated activity, in order to verify the legitimacy of requests and prevent automation, abuse, fraud, mass submissions, malicious files, and attacks against the forms.

Google Analytics 4. Subject to your prior choice in the cookie-preferences panel, SIE PARK may use Google Analytics 4 to obtain aggregate analytics data and pseudonymous identifiers regarding visits, sessions, browsing, performance, and interaction with the site. This tool may use pseudonymous identifiers, approximate location information, and technical browser or device data. SIE PARK does not send RFC numbers, names, emails, invoice numbers, documents, or form content to Google Analytics. Google Analytics loads only after your acceptance; you may decline it or change your choice at any time from the panel. The 14-month retention applies to user and event data, and not necessarily to aggregated reports.

12. Changes to this Privacy Notice

SIE PARK may amend this Privacy Notice to address legislative developments or internal policies. Any change will be published on this same page, indicating the version and the date of the latest update.