Comprehensive privacy notice

José Andrés Sánchez Valencia, an individual engaged in business activities, operating under the trade name TSM Advisory Group (hereinafter the "Controller"), with address at Av. Ejército Nacional Mexicano 769, Colonia Granada, Alcaldía Miguel Hidalgo, C.P. 11520, Mexico City, is responsible for the processing of your personal data in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter the "Law") and its Regulations.

For any matter related to the processing of your personal data or the exercise of your ARCO rights, you may contact us by email at asanchez@advisorytsm.com, or at the address stated in the preceding paragraph.

In the course of its activities, TSM Advisory Group acts in two distinct roles with respect to the processing of personal data, as described below:

A. Role as Controller

TSM Advisory Group acts as Controller of the personal data it collects directly from its clients, prospects and users of the advisorytsm.com website, for the purpose of providing its consulting, technology development, automation, artificial intelligence and digital marketing services.

B. Role as Processor

TSM Advisory Group acts as Processor of third-party personal data — including customers, end users or employees of its clients — contained in the systems, platforms, applications or integrations developed or operated by TSM on behalf of its clients. In this role, TSM processes such data exclusively in accordance with the instructions of the contracting client, who acts as Controller of such data under the Law.

As Processor, TSM Advisory Group undertakes to: (i) process the data solely for the purposes instructed by the client; (ii) implement appropriate technical and organizational security measures; (iii) not transfer the data to third parties except on the client's express instruction or by legal mandate; and (iv) delete or return the data at the end of the engagement, as agreed in the corresponding Professional Services Agreement.

A. Data collected from clients and prospects (Controller role)

Within the framework of the commercial and contractual relationship with its clients, the Controller collects and processes the following categories of personal data:

• Identification

  Full name, CURP, RFC, official ID (where applicable).

• Contact

  Email address, phone number, tax or home address.

• Billing and tax

  RFC, tax regime, CFDI use, billing details.

• Banking and payment

  Bank account details for transfers, CLABE interbank number.

• Business

  Company name or legal name, line of business or industry, business problem or need to be solved.

• Browsing (website)

  Name, email address, phone number, company name and description of the problem or requirement, voluntarily entered in the contact form at advisorytsm.com.

The Controller does not collect sensitive personal data within the meaning of Article 3, Section VI of the Law. Should it become necessary to collect this category of data in the future, this Notice will be updated and the express consent of the data subject will be requested.

B. Third-party data processed in the Processor role

In developing, operating and maintaining technology systems for its clients, TSM Advisory Group may have access to third-party personal data (end users, the client's customers, employees or others) residing in such systems. The type of data will depend on the specific system developed and on the instructions of the contracting client. TSM does not determine the purposes or means of processing of such data and acts exclusively in accordance with the client's documented instructions.

A. Necessary purposes (no additional consent required)

The processing of your personal data is necessary for the following purposes, without which it would not be possible to establish or maintain the legal relationship with the Controller:

• Identification and verification of the identity of the client or prospect.
• Execution, formalization and management of the Professional Services Agreement.
• Provision of the contracted services: consulting, software development, automation, artificial intelligence, digital marketing and systems operation.
• Issuance of digital tax receipts (CFDI) and compliance with tax obligations before the SAT.
• Management of payments, collections and billing.
• Operational communications related to the project: progress, deliverables, requests for inputs and contractual notices.
• Handling of contact requests received through the web form or via WhatsApp.
• Compliance with legal and regulatory obligations or orders from a competent authority.

B. Voluntary purposes (consent required)

Additionally, and subject to the data subject's prior consent, the Controller may process your data for the following purposes:

• Use of the client's trade name or legal name as a reference in TSM Advisory Group's internal materials, such as case studies, project portfolio or sales presentations. The client may object to this use at any time by written notice.

Note: The Controller does not send newsletters, mass advertising or commercial email campaigns to its clients. Should such practices be adopted in the future, this Notice will be updated and the corresponding consent will be obtained.

The Controller obtains personal data through the following means:

• Directly from the data subject, through the signing of the Professional Services Agreement and its Annexes.
• Through the contact form available at advisorytsm.com, which collects: name, email address, company name, phone number and description of the requirement or problem to be solved.
• Through direct communications by email or WhatsApp, when the prospect or client initiates contact with TSM.
• Through the clients' systems, platforms or tools, when TSM acts as Processor.

The advisorytsm.com website does not currently use tracking cookies, behavioral analytics or third-party advertising pixels. Should such mechanisms be implemented in the future, this Notice will be updated with the corresponding information and users will be informed through the appropriate means.

A. Technology service providers (sub-processors)

To provide its services, the Controller uses third-party platforms and services that may have access to personal data as sub-processors. These providers are subject to their own privacy policies and, in most cases, to international data transfers to the United States of America and other jurisdictions where their servers operate:

• Google (Workspace / Cloud)

  Purpose of use:

  Corporate email, document storage, collaboration and cloud services.

  Country of operation:

  USA

  International transfer:

  Yes

• Zoho

  Purpose of use:

  CRM system and client relationship management.

  Country of operation:

  USA / India

  International transfer:

  Yes

• Vercel

  Purpose of use:

  Hosting and deployment of web applications.

  Country of operation:

  USA

  International transfer:

  Yes

• Vercel Analytics

  Purpose of use:

  Aggregate measurement of visits to advisorytsm.com, without cookies or individual profiles.

  Country of operation:

  USA

  International transfer:

  Yes

• Railway

  Purpose of use:

  Hosting of applications and databases.

  Country of operation:

  USA

  International transfer:

  Yes

• Microsoft (Azure / 365)

  Purpose of use:

  Productivity tools and cloud services.

  Country of operation:

  USA

  International transfer:

  Yes

• Shopify

  Purpose of use:

  E-commerce platform for clients.

  Country of operation:

  Canada / USA

  International transfer:

  Yes

• Ahrefs

  Purpose of use:

  SEO analysis and positioning.

  Country of operation:

  Singapore / USA

  International transfer:

  Yes

• Dualhook

  Purpose of use:

  Workflow automation and webhooks.

  Country of operation:

  USA

  International transfer:

  Yes

• Resend

  Purpose of use:

  Email delivery of messages received through the contact form at advisorytsm.com.

  Country of operation:

  USA

  International transfer:

  Yes

• WhatsApp (Meta)

  Purpose of use:

  Messaging with prospects and clients.

  Country of operation:

  USA

  International transfer:

  Yes

• Google Analytics

  Purpose of use:

  Web traffic analytics (future implementation).

  Country of operation:

  USA

  International transfer:

  Yes (future)

The international transfers listed above are carried out under Articles 36 and 37 of the Law, insofar as these providers offer adequate levels of protection or are subject to legal instruments that guarantee the protection of the personal data transferred.

B. Other transfers

Apart from the cases above, the Controller will not transfer personal data to third parties without the data subject's prior consent, except in the cases provided for in Article 37 of the Law, which include, among others: transfers to competent authorities by legal mandate, to holding companies or subsidiaries of the same corporate group, or when necessary to prevent harm to the data subject.

Under the Law, you have the right to Access, Rectify, Cancel or Oppose (ARCO rights) the processing of your personal data. You also have the right to revoke at any time the consent you have granted for the processing of your data, to the extent permitted by the Law.

Procedure for exercising ARCO rights

To exercise your ARCO rights or revoke your consent, you must send a request to asanchez@advisorytsm.com, stating:

• Full name and contact details of the data subject.
• A copy of a valid official ID proving your identity or, where applicable, that of your legal representative.
• A clear and precise description of the personal data regarding which you seek to exercise any of the ARCO rights, or the revocation of consent.
• Any document that helps locate the personal data.

The Controller will respond to your request within a maximum of twenty (20) business days from the date of receipt, informing you of the decision adopted. If the request is granted, it will take effect within fifteen (15) business days following that communication. These periods may be extended as provided by the Law.

The email account indicated in this Section is the official and sole channel designated by the Controller for receiving requests to exercise ARCO rights and to revoke consent; the response period will be counted from receipt of the request through that channel. The Controller keeps an internal record of the requests received, stating the date of receipt, the right exercised, the decision adopted and the date it was communicated to the data subject, which is retained as evidence of compliance with the procedure described herein.

Revoking consent or exercising the rights of Cancellation or Opposition may limit or prevent the provision of the contracted services, in which case the Controller will inform the data subject of the specific consequences of such revocation.

The Controller has implemented technical, administrative and physical security measures to protect personal data against damage, loss, alteration, destruction, and unauthorized use, access or processing. These measures include:

• Storage of client files individually and securely, with access restricted to authorized personnel.
• Use of technology platforms with encryption and authentication protocols for data processing.
• Access management differentiated by provider and project, in line with the principles of minimization and necessity.
• Internal and client communications through secure channels.

In the event of a security breach that significantly affects the property or moral rights of data subjects, the Controller will inform them immediately so that they can take the corresponding protective measures.

The personal data of clients and prospects will be retained by the Controller for the following periods:

• Tax and billing data: five (5) years from the corresponding fiscal year, as established by the Federal Tax Code.
• Contract and project data: five (5) years from the termination of the Professional Services Agreement, during which they may be required for legal or audit purposes.
• Data of prospects who do not become clients: up to twelve (12) months from the last contact, after which they will be deleted or anonymized.

Once the retention periods have ended, the Controller will delete or anonymize the personal data in accordance with the internal procedures established for that purpose.

This Privacy Notice may be modified at any time by the Controller in compliance with legislative reforms, internal policies or new data processing practices. Changes will be published in a timely manner at advisorytsm.com, indicating the date of the last update.

When changes are significant or affect previously consented purposes, the Controller will notify data subjects through the registered email address or any other means of communication that allows receipt of the notice to be verified.

Continued use of TSM Advisory Group's services, or the absence of an objection within fifteen (15) business days following notice of the changes, will be deemed tacit acceptance of the changes made, to the extent permitted by the Law.

If you believe that your right to the protection of personal data has been harmed by any act or omission of the Controller, or suspect that the processing of your personal data violates the provisions of the Law, you may file the corresponding complaint with the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), the competent authority on personal data protection under the Federal Law on the Protection of Personal Data Held by Private Parties published on March 20, 2025.

By providing your personal data to TSM Advisory Group — whether by signing the Professional Services Agreement, filling out the contact form at advisorytsm.com, or through any other means of communication — you declare that you have read, understood and accepted the content of this Privacy Notice, and you consent to the processing of your personal data for the necessary purposes described in Section IV.A of this document.

The voluntary purposes described in Section IV.B will require your express consent, which may be granted or revoked at any time by written notice to asanchez@advisorytsm.com.

This Privacy Notice is expressly referenced in the Seventh Clause of TSM Advisory Group's Professional Services Agreement, in which the Client declares that it knows and accepts it as an integral part of the contractual relationship.

If you reside in California, you have the right to know what personal data we collect and to request its deletion under the CCPA. We do not sell personal data.