In accordance with the Federal Law on Protection of Personal Data Held by Private Parties (the "Law"), the Regulations of the Federal Law on Protection of Personal Data Held by Private Parties (the "Regulations"), and the Privacy Notice Guidelines published by the Ministry of Economy in the Official Gazette of the Federation (the "Guidelines"), we request that you read the privacy notice detailed below:

CREMBO FASHION S.A. DE C.V., (the "Company"), located at C. Nezahualcóyotl 145, Centro, Cuauhtémoc, 06080 Mexico City, CDMX, Mexico, as the data controller, is responsible for obtaining and/or collecting your personal data, as well as for its use, protection, storage, or disclosure (the "Processing"). By using our websites and submitting information in our stores or other communication channels, you authorize the collection and use of your personal information. The use of our websites implies acceptance of the general conditions.

Personal Data Collected:

Full name, date of birth, email address, full address, gender, Federal Taxpayer Registry (RFC), confirmation of foreign status, copy of official identification, and bank account number (considered financial or patrimonial data under the Law). Information may be collected in written, electronic, or electromagnetic forms.

Purposes and Uses of Personal Data

Primary Purposes: (i) To fulfill the Company's obligations derived from the legal relationship between the Data Subject and the Company. (ii) To address questions and suggestions. (iii) For invoicing. (iv) To follow up on your requests.

Once the primary purposes of Processing are met, the Company will block, cancel, and delete the data in its possession.

Secondary Purposes: (i) Marketing. (ii) Advertising and commercial prospecting. (iii) To recognize the Data Subject upon entering the Site and offer a personalized experience. (iv) To know the Data Subject's personal Site configuration. (v) To calculate the Site's audience size. (vi) To measure certain traffic parameters. (vii) To track online surveys we launch for commercial evaluations. (viii) To share and use photographs and related messages on the Company's social networks or on the Site. (ix) To conduct satisfaction surveys.

You may express your refusal for the Processing of your personal data for secondary purposes within 5 (five) business days following the receipt of this privacy notice, by submitting a Request (as defined below).

Security of Personal Data

The Company will implement the necessary security measures to ensure the protection of your personal data to prevent its damage, loss, alteration, destruction, or unauthorized use, access, or processing, in accordance with the Law, the Regulations, and the Guidelines. Only personnel designated and authorized by the Company may participate in the Processing of your personal data. Such personnel are prohibited from providing access to unauthorized persons and from using your personal data for purposes other than those established and accepted in this notice.

Your Rights Regarding Your Personal Data

The data subject (the "Data Subject"), by sending a request to info@nyd.mx or to the Company's address (the "Request"), may:

• Express their refusal for the processing of their personal data for secondary purposes.
• Exercise their right to access, rectify, and cancel their personal data, as well as to object to its Processing ("ARCO Rights").
• Limit the use of their data ("Right to Limitation").
• Revoke consent to the Processing of data for the referred purposes ("Right to Revocation").

The Request must contain and include the following:

• The Data Subject's full name and address or any other means by which they wish to receive notifications regarding the Request.
• Documents proving their identity as the Data Subject, by presenting a copy of their official identification, having shown the original for verification.
• A clear and precise description of the Data Subject's personal data for which they seek to exercise any of the rights established in the preceding section.
• Any element or document that facilitates the location of the Data Subject's personal data. In the specific case of a request for rectification of personal data, the Data Subject must indicate, in addition to what is stated in the preceding paragraphs, the modifications to be made and provide documentation to support their request.

The Company will respond through the means indicated by the Data Subject in the Request, within 20 (twenty) business days following its receipt. The Company may retain the Data Subject's personal data exclusively for the purposes of liabilities arising from the Processing.

Transmission and Transfer of Personal Data

We may transfer your Personal Data to the following third parties: (i) To companies within the same group, as well as their subsidiaries, affiliates, controlled entities, or controlling entities of the Company. (ii) To local and federal authorities to comply with current and/or applicable legislation and to comply with requirements from them.

Changes to the Privacy Notice

Due to the continuous development of our websites and the use of new technologies to improve the services we offer, our policies will change over time. We recommend that you review this Privacy Policy from time to time to stay up-to-date on our latest privacy practices. If you are registered as a user on our website, we may notify you of significant changes to our Privacy Policy via the email you have provided. Your continued access and use of our websites imply acceptance of all changes and revisions to our Privacy Policy.

Use of Cookies and Web Beacons

The Company uses tracking technology ("Cookies and Web Beacons") to collect personal information. Cookies and Web Beacons are small pieces of information that are sent by this website (the "Site") and related microsites to your browser, which are stored on the hard drive of the Data Subject's computer (this term is defined later) and are used to determine your preferences when connecting to the Site's services, as well as to track certain behaviors or activities carried out by the Data Subject within the Site.

In some sections of the Site, the Data Subject is required to have Cookies and Web Beacons enabled, as some functionalities require them to work.

Disabling Cookies and Web Beacons: To disable Cookies and Web Beacons, you must follow these instructions:

• On a PC: Open the internet browser, enter the "Tools" menu, go to "Internet Options," choose the "Privacy" tab, move the configuration slider to "Block Cookies and Web Beacons."
• On a Mac: Open the internet application, go to "Preferences," choose the "Security" option, choose "Never" in the "Accept Cookies and Web Beacons" option.

The Data Subject declares that they have read and understood this notice and grant their consent for the Processing of their personal data and their financial or patrimonial data, for both primary and secondary purposes, as well as for the transfer thereof, in the terms herein.

Likewise, they declare that their personal data is accurate, authentic, and complete, and therefore acknowledge that they are solely responsible for the accuracy, truthfulness, and authenticity of their personal data, as well as for the content and use they make of their data. If you have any questions about this privacy notice or any matter related to the Processing of your data under these terms or how to exercise your ARCO Rights, Limitation, and Revocation, you can send an email to info@nyd.mx.

Date of last update to this privacy notice: June 20, 2025