Privacy Notice

VINOC S.A.P.I. DE C.V. makes this Privacy Notice available to data subjects and recommends reading it carefully before sharing any data or information.

VINOC S.A.P.I. DE C.V. (hereinafter “VINOC”) complies with its obligations regarding the collection, use, disclosure and storage of personal data in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, “LFPDPPP”), its Regulations and other applicable legal provisions, as well as the Guidelines for the Identification of Mobile Telephone Lines (Lineamientos para la Identificación de Líneas Telefónicas Móviles) issued by the Telecommunications Regulatory Commission (Comisión Reguladora de Telecomunicaciones, CRT), published on December 9, 2025, and their corresponding amendments.

This Privacy Notice applies to end users, customers, mobile line holders, legal representatives and any other persons who, voluntarily, expressly or tacitly, provide personal data to VINOC in connection with the provision of telecommunications services, including the registration, validation, activation, retention and, where applicable, cancellation of mobile lines, as well as the processes of Identity Validation, Linking (Vinculación), Unlinking (Desvinculación) and Query of Mobile Telephone Lines.

Identity and address of the controller

VINOC is located at Calle 2 No. 135, Floor 5, Col. Benito Juárez, Querétaro, Qro., C.P. 76120, telephone number 8005120000, and email address atencionprivacidad@vinoc.mx. VINOC will be the controller (responsable) of the processing of the personal data it collects.

Personal data collected

VINOC may collect, as applicable, the following personal data in connection with the provision of its telecommunications services and the processes of Identity Validation, Linking and Unlinking of Mobile Telephone Lines:

• ●​Full name or company name, as applicable.
• ●​Federal Taxpayer Registry number (RFC)
• ●​Unique Population Registry Code (CURP)
• ●​Place and date of birth
• ●​Age
• ●​Address
• ●​Landline and/or mobile telephone number
• ●​Email address
• ●​Identification data associated with mobile lines, such as the assigned telephone number, ICCID, IMSI, line type (prepaid or postpaid), activation date, line status and operator
• ●​Valid official identification (INE, passport or another document permitted by the applicable regulations)
• ●​Photograph or image of the identification document, where applicable
• ●​Tax and billing data
• ●​Country of origin and passport number or, where applicable, CURP for foreign nationals, including, where appropriate, the data contained in the visitor or resident cards containing a CURP issued by the National Institute of Migration (Instituto Nacional de Migración), in the case of foreign individuals.
• ●​Data contained in the official identification and in the documents presented to prove the identity and authority of the legal representative, used only for validation and without keeping a copy of such documents.
• ●​Source consulted and result of the Identity Validation.
• ●​Unique reference number (folio) for each Linking or Unlinking, including date and time.

VINOC does not collect sensitive personal data, except in the cases expressly permitted by law. Where applicable, biometric data derived from the Liveness Check (Prueba de Vida) will be processed exclusively for Identity Validation, without being stored or retained.

Means of obtaining personal data

Personal data may be obtained directly from Data Subjects, Users or legal representatives and, where applicable, will be verified by consulting reliable sources held by competent authorities, through:

• ●​Contracting of telecommunications services
• ●​Processes of registration, enrollment, activation, Identity Validation, Linking, Unlinking and Query of mobile telephone lines
• ●​The Platforms for the Management and Query of Mobile Telephone Lines, as well as other digital platforms and electronic or physical forms
• ●​Telephone or electronic communications
• ●​Identity validation and information verification procedures required by the Guidelines for the Identification of Mobile Telephone Lines (remotely and/or in person)

Purposes of the processing

Personal data will be processed for the following primary and necessary purposes:

• ●​Provide and manage the contracted services
• ●​Identify and validate the identity of the Data Subjects, Users and Legal Representatives of the mobile line
• ●​Comply with the processes of Linking, Unlinking and Query of mobile telephone lines and with regulatory obligations in telecommunications matters
• ●​Activate, maintain, suspend or cancel mobile lines
• ●​Generate the corresponding reference numbers (folios) and notify the results of the Linking and Unlinking processes
• ●​Billing and collection
• ●​Handling of requests, complaints or clarifications
• ●​Compliance with legal obligations and requirements of competent authorities

In addition, as a secondary purpose, VINOC may process only the personal data obtained in the ordinary course of the commercial relationship, with the exception of data collected for the Linking or Unlinking of Mobile Telephone Lines, to send commercial information, newsletters or news related to its services.

Data subjects may state their refusal to the use of their data for secondary purposes by sending an email to atencionprivacidad@vinoc.mx.

Retention of information

Personal data associated with the Linking and Unlinking of mobile telephone lines, whose safekeeping is permitted by the Guidelines, will be retained only for the time necessary to fulfill the purposes set out in this Notice and the applicable legal obligations. Once that period has ended, the data will be deleted, after being blocked where applicable.

VINOC will not retain biometric data, photographs, copies of official identification or any other document of Data Subjects or Users in connection with the operations of VINOC's Mobile Telephone Line Management Platform for the Linking and Unlinking processes. Such items will be processed only temporarily when necessary for Identity Validation and the Liveness Check.

Transfers of personal data

VINOC may transfer personal data, without requiring the data subject's consent, when the transfer is necessary to:

• ●​Comply with legal or regulatory obligations
• ●​Respond to duly grounded and justified requirements of competent authorities
• ●​Share information with telecommunications sector authorities when legally appropriate under the Guidelines for the Identification of Mobile Telephone Lines

Information collected in connection with Linking and Unlinking will be confidential and may not be commercialized, disclosed, shared or used for purposes other than those set out in the Guidelines.

In all other cases, transfers will be made as provided in articles 35 and 36 of the Federal Law on the Protection of Personal Data Held by Private Parties and, where applicable, VINOC will first request the consent of the data subject, who may accept or reject the transfer. Without the data subject's acceptance, the transfer will not be made.

Security measures

VINOC implements administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction or unauthorized use, access or processing, and to guarantee its integrity, authenticity, confidentiality and availability on the Platforms for the Management and Query of Mobile Telephone Lines.

VINOC will immediately notify the Telecommunications Regulatory Commission, the competent authorities and the data subjects and users of any information security incident or breach of personal data.

ARCO rights (Access, Rectification, Cancellation and Opposition)

The data subject or their legal representative may exercise their rights of Access, Rectification, Cancellation or Opposition (ARCO), as well as revoke their consent, by sending a request to atencionprivacidad@vinoc.mx, in accordance with the requirements established by the applicable legislation.

The data subject may also revoke their consent by a request sent to the same email address, without retroactive effect and provided that the processing is not necessary to comply with a legal or contractual obligation.

The request must contain: the name of the data subject and a means to receive notifications; documents proving their identity or, where applicable, the identity and authority of their representative; a clear description of the personal data to which the request relates; the right they wish to exercise; and any element that facilitates locating the data. For rectification requests, the data subject must indicate the changes requested and attach the supporting documentation.

VINOC will communicate its decision within a maximum of twenty days from receipt of the request and, if it is granted, will carry it out within the following fifteen days. These periods may be extended once for an equal period when circumstances justify it.

Limitation of use or disclosure

The data subject may request the limitation of the use or disclosure of their personal data by sending a request to the email address atencionprivacidad@vinoc.mx, stating their name, a means of contact and the use or disclosure they wish to limit. The limitation will not apply when the processing is necessary to comply with legal, regulatory or contractual obligations.

Changes to the Privacy Notice

VINOC reserves the right to modify or update this Privacy Notice when there are legal or regulatory changes or changes in its personal data processing practices. Changes will be communicated by publishing the updated Notice on its official website www.vinoc.mx.

Date of last update: September 2026.