Privacy Notice

This English translation is provided for convenience. The Spanish version is the governing text and shall prevail in case of any discrepancy: Aviso de Privacidad Integral (español).

Version 11.1 · Effective date: July 27, 2026 · Last updated: September 8, 2026 (attached ticket retention: 30 → 90 calendar days) · Language: English (courtesy translation — the Spanish version shall prevail)

1. Identity and address of the data controller

SIE PARK, S.A. de C.V. ("SIE PARK"), with address at Av. Molière 328, Polanco II Sección, Alcaldía Miguel Hidalgo, C.P. 11530, Mexico City, is responsible for the processing of the personal data you provide through the siepark.net website and the contact channels indicated in this notice, in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) in force and other applicable provisions.

SIE PARK has a Personal Data Department, located at the address indicated in this section, which handles privacy matters and processes requests from data subjects:

privacidad@siepark.net

2. Scope of this notice

This website carries out two main processing activities through forms: the property proposal request and the invoice request. Additionally, SIE PARK may receive data through its contact channels — email, telephone and WhatsApp — and process technical data necessary for the security and operation of the site.

This website does not offer, quote or contract valet parking services, and does not collect data through video surveillance, access control, vehicle license plate reading, incident records, monthly-parking or parking-user systems, nor data of employees or job candidates. Such processing activities, if any, are governed by independent notices outside this document.

3. Personal data collected

3.1 Property proposal form

Data of the requesting person or representative: full name, position, company or organization where applicable, capacity in which the request is made (company or organization, individual owner, or authorized representative of an individual owner), email address and telephone number.

Information about the organization and the property: property type, model of interest, organization type, city, address or area of the property, approximate surface area, approximate number of parking spaces, number of locations, estimated decision date, current status of the property, estimated construction start date, period available for temporary operation, permit status of the development, vehicle access points, available services, special handover conditions, main problem or need, and additional comments.

Where the property belongs to a legal entity, this information refers to an asset of the organization and does not constitute personal data.

Individual owners. If you submit the request as an individual owner, or as the authorized representative of one, the property information is linked to your assets and constitutes patrimonial data. In that case, the processing is carried out with your express consent, collected through a specific checkbox in the form, pursuant to Article 7, fifth paragraph, of the LFPDPPP, and solely to evaluate the property and prepare a proposal for you.

3.2 Invoice request form

Transaction and tax data: parking facility or location, ticket date, ticket number, total amount, RFC (tax ID), name or business name, tax ZIP code, tax regime, CFDI use, payment method, form of payment, delivery email address and its confirmation, and comments or clarifications.

Ticket or proof of payment (required). SIE PARK does not issue the tax receipt from the website: the request is validated and referred to the Invoicing area, which issues the CFDI using the company's accounting system. Therefore, the ticket image is the only means to prove that the transaction exists and corresponds to the person requesting the invoice, and its upload is necessary to process the request.

We ask you to attach only your ticket or the strictly necessary part of the proof of payment, and not to include photographs of cards, full bank statements, full card numbers, security codes, passwords, CLABE numbers, balances, unrelated bank transactions or identity documents. If we receive information we do not need, it is deleted.

Tax Status Certificate (Constancia de Situación Fiscal — optional). It is not necessary: the four data points used to issue the CFDI — RFC, name or business name, tax regime and tax ZIP code — are entered directly in the form. If you decide to attach it, SIE PARK uses only those four data points and deletes the file within 72 hours of its verification, through an automated process that keeps an execution log.

3.3 Technical and security data

When the forms are submitted, technical data is processed, such as date and time of submission, browser type, operating system, device type and technical signals that distinguish legitimate traffic from automated activity.

SIE PARK does not keep your IP address in its own records and does not associate it with the evidence of your consent. Infrastructure and security providers may process it temporarily to deliver their service, in accordance with their own policies.

When you authorize it in the cookie preferences panel, pseudonymous cookie identifiers, approximate location and browsing events are additionally processed for statistical purposes.

3.4 Sensitive data

SIE PARK does not request sensitive personal data through this website. We ask you not to provide it in open fields or attached documents. If received unsolicited and not necessary, it is deleted in accordance with internal procedures.

4. Purposes of the processing

4.1 Property proposal — primary purposes

Receive and handle your request and identify the requesting person or representative.

Identify and evaluate the property and analyze its feasibility.

Contact you and, where necessary, coordinate a technical visit.

Prepare and present a lease, revenue-share or operation proposal.

Follow up on the potential business relationship arising from your request.

4.2 Invoice request — primary purposes

Identify the transaction and validate the ticket or payment.

Validate the tax data, issue and deliver the CFDI, and handle clarifications or corrections.

Comply with tax, accounting and legal obligations and keep the strictly necessary evidence.

4.3 Contact channels

Handle communications you initiate by email (contacto@siepark.net and facturacion@siepark.net), telephone or WhatsApp, and follow up on your request.

On WhatsApp, your telephone number, profile name or identifier, message content and any files you decide to send are processed. Conversations are kept on a dedicated company device, with encrypted backup, and are not exported to other systems. We ask you not to send sensitive data, banking data or identity documents through that channel.

4.4 Security and operation

Verify the legitimacy of requests and protect the forms against automation, fraud, abuse, bulk submissions and malicious files — including antimalware analysis of the files you attach — as well as maintain the technical operation of the site.

4.5 Optional analytics purpose

When you previously authorize it in the cookie preferences panel, SIE PARK generates statistics on the use, navigation and performance of the site. Refusal does not prevent you from using the forms or accessing any feature of the site, and you may change your choice at any time from the same panel.

No purpose in this notice is advertising, marketing or commercial prospecting.

5. Legal basis of the processing and consent

Where the processing is based on your consent, you may revoke it as described in section 9.

6. Data processors and transfers

SIE PARK relies on providers that process data on its behalf and under its instructions (data processors):

Pursuant to Article 2, section XX, of the LFPDPPP, the communication of data to a data processor does not constitute a transfer and does not require your consent. All attachments are stored in a private repository, never public, and are accessed through short-lived signed links.

The communication of tax receipts to the Tax Administration Service (SAT) is a transfer required by tax provisions and may be carried out without your consent, pursuant to Article 36, section I.

Transfers clause. Apart from the above, SIE PARK does not transfer your personal data to third parties. It does not sell or share it for purposes other than those described in this notice. If in the future it intended to carry out any transfer requiring your consent, it would obtain it beforehand through a specific clause.

7. Security measures

SIE PARK maintains reasonable administrative, technical and physical measures proportional to the nature of the data, the purposes of the processing and the risks involved, pursuant to Article 18. These include: private, encrypted storage of attached files, access through short-lived signed links, antimalware analysis prior to any delivery with quarantine of suspicious files, anti-automation verification on the forms, restricted named access by area, and automated deletion of files within the periods of section 8, with a log of each execution.

Personnel involved in any phase of the processing are subject to a duty of confidentiality pursuant to Article 20.

In the event of a security breach significantly affecting your property or moral rights, SIE PARK will notify you immediately, pursuant to Article 19.

8. Retention periods

Once the periods have elapsed, data is deleted, subject to prior blocking where applicable, pursuant to Article 10.

9. ARCO rights and how to exercise them

You have the right to access your personal data and know the conditions of its processing; to rectify it when inaccurate, incomplete or outdated; to cancel it, which gives rise to a blocking period and subsequent deletion, unless a legal retention obligation subsists; and to object to its processing on legitimate grounds or when it is subject to automated decisions that significantly affect you.

How to exercise them. Send your request to the Personal Data Department at privacidad@siepark.net. Pursuant to Article 28 of the LFPDPPP, the request must contain and be accompanied by:

I. Your name and address, or any other means to receive the response; II. Documents proving your identity or, where applicable, the authority and identity of your representative; III. A clear and precise description of the personal data regarding which you seek to exercise any of the ARCO rights, except in the case of the right of access; IV. A description of the ARCO right you intend to exercise or of what you request, and V. Any other element or document that facilitates locating the personal data.

In the case of rectification, you must also indicate the changes to be made and provide documentation supporting your request.

Time limits. SIE PARK will notify you of its determination within a maximum of 20 business days from receipt of the request and, if applicable, will implement it within the following 15 business days. Both periods may be extended once, for an equal period, when circumstances justify it, which will be communicated to you.

Cost. Exercising these rights is free of charge. Only reproduction, copying or shipping costs may be charged. If you provide the means to reproduce the data, it will be delivered at no cost.

Refusal. SIE PARK may refuse the exercise of these rights in the cases of Article 33 — among others, when identity is not proven, the data is not in its possession, third-party rights would be harmed, or a legal impediment exists — always informing you of the reason through the same means as your request. In particular, data incorporated into an already issued CFDI cannot be cancelled while the tax obligation to retain it subsists.

If you disagree with the response, or do not receive one, you may turn to the Secretaría Anticorrupción y Buen Gobierno within the periods provided by the LFPDPPP.

10. Revocation of consent

Where the processing is based on your consent, you may revoke it at any time, without retroactive effects, by writing to privacidad@siepark.net. Revocation does not apply to data whose processing is necessary for SIE PARK to comply with tax or legal obligations.

For analytics, you may revoke your authorization directly in the cookie preferences panel, without reloading the page.

11. Limitation of use or disclosure

You may request the limitation of the use or disclosure of your data by writing to privacidad@siepark.net.

SIE PARK does not use the personal data collected on this website for advertising, marketing, commercial prospecting, profiling or communications other than handling and following up on the request you submitted. The informational content displayed on the site's pages is not personalized with your data and does not imply its use for advertising purposes.

12. Cookies and technologies

Technical and security cookies. Necessary for the operation and protection of the site; they cannot be disabled.

Anti-automation verification (Cloudflare Turnstile). Runs technical checks and obtains signals about the visitor's browser or environment to distinguish legitimate traffic from automated activity, in order to verify the legitimacy of requests and prevent fraud, abuse, bulk submissions and malicious files.

Google Analytics 4. It loads only after you accept it in the cookie preferences panel: without acceptance, no communication with Google takes place. It operates with IP address anonymization and without advertising signals. If you refuse or change your choice, measurement is deactivated immediately, without reloading the page. SIE PARK does not send Google Analytics your RFC, name, email, ticket numbers, documents or content entered in the forms. The 14-month retention applies to user and event data.

You may open the preferences panel at any time from the site footer.

13. Changes to this privacy notice

SIE PARK may modify this notice to address legislative developments or internal policies. Any change will be published on this same page, indicating the version and the date of the last update. We recommend consulting it periodically.

End of the Privacy Notice, version 11.0. In case of any discrepancy, the Spanish version shall prevail.