Comprehensive Privacy Notice

01Identity and address of the data controller

RHINO SYSTEMS, S.A. DE C.V., hereinafter “Rhino Systems,” with its address at Aguascalientes 175, Floor 2, Office 202, Colonia Hipódromo Condesa, Cuauhtémoc Borough, Postal Code 06100, Mexico City, Mexico, is responsible for the processing, use, protection and safekeeping of personal data collected from users, visitors, prospects, potential clients and other individuals who interact with Rhino Systems through its website, electronic forms, email, digital channels, events, demonstrations, commercial communications or other contact channels.

Rhino Systems processes personal data in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations and other applicable legal and administrative provisions.

This Privacy Notice informs data subjects about the personal data we may collect, how we use and protect it, and the mechanisms available to exercise their rights.

02Personal data we may collect

Depending on your interaction with Rhino Systems, we may collect the following categories of personal data:

Identification data

• First and last names.
• Company or institution you belong to.
• Position, job title or professional role.
• Country or city of residence or professional activity.

Contact data

• Email address.
• Telephone number.
• Mobile telephone number.
• Information voluntarily provided through forms, messages, email or other contact channels.

Professional and commercial data

• Company or institution where you work.
• Position or area of responsibility.
• Sector or industry.
• Products, services or solutions of interest.
• Needs, projects, initiatives or requirements about which you request information.
• History of communications and commercial interactions with Rhino Systems.

Technical and browsing data

When you visit our website, we may automatically collect certain information, including:

• IP address.
• Device type.
• Operating system.
• Browser type and version.
• Session identifiers.
• Access date and time.
• Pages or sections visited.
• Browsing time.
• Source or channel used to access the site.
• Interactions within the site.
• Information obtained through cookies and similar technologies.

Rhino Systems does not intentionally request or collect sensitive, financial or asset-related personal data through its public website.

If a particular interaction requires the processing of such information, the data subject will be informed in advance and the appropriate consent will be obtained when required by applicable law.

03Primary and necessary purposes of processing

Collected personal data may be used for the following necessary purposes related to your interaction or commercial or legal relationship with Rhino Systems:

1. Identify and contact the person requesting information.
2. Respond to requests, questions, comments or requirements received through the website, email, telephone or other communication channels.
3. Provide information about Rhino Systems, its related companies, products, services and capabilities.
4. Respond to requests related to products and services, including:
   • Microsoft Dynamics 365 services.
   • Salesforce services.
   • Rhino Systems Financial Framework.
   • RhinoBot.
   • Rhino Labs.
   • Core banking services.
   • Other products or professional services offered by Rhino Systems.
5. Analyze a need, project or initiative presented by a prospect or client.
6. Prepare and follow up on meetings, demonstrations, commercial proposals, estimates, quotations, proofs of concept or proofs of value.
7. Establish, manage and follow up on commercial or contractual relationships.
8. Record and manage prospects, opportunities, clients and interactions in our sales management and CRM systems.
9. Follow up on commercial communications requested by the data subject.
10. Provide service and follow-up before, during and after service delivery.
11. Verify a person's identity when necessary to protect the security of our systems, information or commercial relationships.
12. Maintain the security, availability and integrity of our sites, systems, applications and technology infrastructure.
13. Prevent fraudulent, abusive or unlawful activities, or activities that violate our terms and policies.
14. Maintain administrative and commercial records related to our operations.
15. Comply with legal, contractual, tax, administrative and regulatory obligations, or requirements from competent authorities.
16. Exercise or defend Rhino Systems' rights when necessary.

04Secondary purposes

With your consent, Rhino Systems may use certain personal data for additional purposes that are not essential to establish or maintain a legal or commercial relationship, including:

1. Send information about Rhino Systems' products, services and capabilities.
2. Send newsletters, publications, studies, articles, technical documents, invitations and other professional content.
3. Provide information about new products, services, solutions or capabilities.
4. Invite you to webinars, seminars, conferences, demonstrations, events and activities organized or sponsored by Rhino Systems.
5. Conduct satisfaction, quality or perception surveys.
6. Perform statistical and behavioral analyses to improve our content, products, services and digital experience.
7. Conduct marketing, advertising and sales prospecting activities.

Refusing to allow the processing of your personal data for these secondary purposes will not affect service delivery, the handling of your requests or any existing legal or commercial relationship with Rhino Systems.

Where applicable, electronic forms used by Rhino Systems will allow you to expressly consent to receiving these communications, and the corresponding boxes will not be preselected.

Data subjects may subsequently withdraw their consent at any time in accordance with the procedure established in this Privacy Notice.

05Cookies and similar technologies

The Rhino Systems website may use cookies, tags, identifiers and similar technologies to recognize certain browsing-related data and improve site functionality.

These technologies may be used to:

• Maintain the site's technical operation and security.
• Remember preferences.
• Obtain statistical information about site usage.
• Analyze performance and browsing.
• Identify errors or technical issues.
• Improve content and user experience.
• Measure campaign or traffic source performance.
• Perform marketing functions when authorized by the user.

Rhino Systems may use its own or third-party tools to perform these functions.

Strictly necessary cookies may be used to enable the site's operation and security.

When nonessential cookies or technologies involving the processing of personal data are used, users may manage their preferences through the cookie consent mechanism available on the site.

Users may also configure their browsers to block, delete or receive alerts about certain cookies. Disabling certain technologies may affect some site features.

06Data processors

Rhino Systems may rely on third parties that provide services necessary for its operations and process personal data on behalf of and under the instructions of Rhino Systems, including:

• Hosting and technology infrastructure services.
• Cloud platforms.
• CRM systems.
• Communication and email platforms.
• Productivity and collaboration tools.
• Cybersecurity services.
• Analytics platforms.
• Backup and storage services.
• Automation tools.
• Technology providers involved in site operations.

These providers must process data only in accordance with the instructions and purposes defined by Rhino Systems and will be subject to applicable confidentiality, security and data protection obligations.

07Transfers of personal data

Where necessary and in accordance with applicable law, Rhino Systems may transfer personal data to the following categories of recipients:

Related companies

Parent companies, subsidiaries, affiliates, related companies or companies under common control with Rhino Systems that operate under compatible internal data protection processes and policies, when the transfer is necessary to assist the data subject, provide a service, develop a project or manage the corresponding relationship.

These companies may be located in Mexico or other countries where Rhino Systems and its related companies operate.

Authorities

Administrative, judicial, tax, regulatory or other authorities when the transfer is provided for by law, required by a competent authority or necessary for the recognition, exercise or defense of a right.

Third parties connected to a legal relationship

Third parties when the transfer is necessary to maintain or fulfill a legal relationship between Rhino Systems and the data subject, or in any other circumstances permitted by applicable law.

When Rhino Systems intends to make a transfer that requires the data subject's consent and is not covered by a legal exception, it will request such consent in accordance with applicable provisions.

Where appropriate, Rhino Systems will communicate to the data recipient the conditions and purposes governing the processing.

08Rights of Access, Rectification, Cancellation and Opposition

Data subjects may exercise their rights of Access, Rectification, Cancellation and Opposition, known as ARCO rights, at any time.

Right of Access

Allows data subjects to learn what personal data Rhino Systems holds about them and the general conditions of its processing.

Right of Rectification

Allows data subjects to request the correction or updating of inaccurate, incomplete or outdated personal data.

Right of Cancellation

Allows data subjects to request the cancellation of personal data when legally appropriate.

Where applicable, cancellation will be subject to a blocking period during which the data may be retained exclusively to address liabilities arising from its processing.

Right of Opposition

Allows data subjects to request that certain personal data no longer be processed when there are legitimate grounds and it is legally appropriate.

09Procedure for exercising ARCO rights

Rhino Systems has designated its Personal Data Department to receive and process requests related to the exercise of ARCO rights.

Requests must be sent to:

The request must include:

1. Name of the data subject.
2. Address, email or another means of receiving notifications.
3. Documents establishing the data subject's identity or, where applicable, the identity and authority of their legal representative.
4. A clear and precise description of the personal data for which a right is to be exercised, except when the request concerns only the right of access.
5. Identification of the ARCO right to be exercised and a description of the request.
6. Any other information or document that helps locate the personal data.

When requesting rectification, the requested changes must be specified and, where applicable, supporting documents must be attached.

Rhino Systems will communicate its determination within a maximum of 20 days from the date it receives the request.

If the request is granted, the determination will be implemented within 15 days of the date the response is communicated.

These periods may be extended once for an equal period when circumstances justify it under applicable law.

The exercise of ARCO rights is free of charge. Costs may arise only for reproduction, copies or delivery of information in cases permitted by law.

10Withdrawal of consent

When the processing of personal data is based on the data subject's consent, that consent may be withdrawn at any time without retroactive effect.

To request withdrawal, send a request to:

The request must identify the data subject and clearly specify the processing for which consent is to be withdrawn.

Withdrawal will not apply when Rhino Systems must continue processing certain data to comply with a legal or contractual obligation or for another reason permitted by applicable law.

11Restriction of the use or disclosure of personal data

Data subjects may request restrictions on the use or disclosure of their personal data at any time, particularly for marketing, advertising, commercial communications or prospecting purposes.

To do so, they may:

• Use the unsubscribe mechanism available in commercial emails sent by Rhino Systems.
• Change their preferences when the system in use allows it.
• Send a request to privacidad@rhino.systems.

Rhino Systems will process the request in accordance with applicable law and stop using the data for the corresponding purposes when legally appropriate.

12Retention of personal data

Rhino Systems will retain personal data only for the time reasonably necessary to fulfill the purposes for which it was collected and for any additional periods required to:

• Comply with legal obligations.
• Address contractual liabilities.
• Comply with regulatory, tax or administrative requirements.
• Resolve disputes.
• Exercise or defend rights.

Once the data is no longer necessary for the corresponding purposes and the applicable statutory retention periods have expired, it will be deleted or first subjected to the applicable blocking period.

13Security and confidentiality

Rhino Systems establishes and maintains reasonable administrative, technical and physical measures to protect personal data against damage, loss, alteration, destruction, unauthorized use, access or processing.

Individuals involved in processing personal data must keep that information confidential, including after their relationship with Rhino Systems ends, where applicable.

However, no electronic transmission or storage system can be considered completely invulnerable. Rhino Systems reviews and updates its security measures taking into account the nature of the information, existing risks and available technologies.

14Personal data of minors

The products and services offered through this site are primarily intended for companies, institutions and professionals and are not designed to intentionally collect personal information from minors.

Rhino Systems asks minors not to provide personal information through the site without the involvement and consent of their parent, guardian or legal representative when required.

If Rhino Systems identifies that it has received a minor's personal data without the appropriate authorization, it will take reasonable steps to cancel that data when legally appropriate.

15Third-party sites and services

Our site may contain links to or integrations with sites, platforms, applications or services operated by third parties.

Personal data processing performed directly by those third parties will be subject to their own privacy notices, terms and policies.

Rhino Systems recommends reviewing those documents before providing personal information to third parties.

16Changes to this Privacy Notice

Rhino Systems may modify or update this Privacy Notice when necessary to reflect:

• Legislative or regulatory changes.
• New provisions issued by competent authorities.
• Changes to our products or services.
• Changes to the personal data processed.
• New purposes.
• Changes to our processes, systems or privacy practices.
• Changes to the conditions governing data transfers.

The current version of this Privacy Notice will always be available at:

https://rhino.systems/aviso-de-privacidad

When a change introduces new purposes requiring consent, or any change for which the law requires renewed authorization from the data subject, Rhino Systems will obtain the corresponding consent before beginning such processing.

The last updated date will appear at the beginning of this document.

17Competent authority

If data subjects believe their right to personal data protection has been violated, they may use the mechanisms provided under applicable law before the Secretaría Anticorrupción y Buen Gobierno, the competent federal authority for the protection of personal data held by private parties, without prejudice to any other rights or actions available under the law.

18Consent

When applicable law permits tacit consent, consent will be understood to have been granted if, after this Privacy Notice has been made available, the data subject provides personal data without expressing opposition to the corresponding processing.

For processing that legally requires express consent, Rhino Systems will implement the mechanisms necessary to obtain it.

Any financial or asset-related data that may need to be processed will require express consent when mandated by applicable law.

Any sensitive personal data that it becomes essential to process will be subject to the special consent requirements established by law.

19Data controller contact details

Last updated: September 4, 2026