VCM Capital

SCHONCLOUD

Aviso de Privacidad

PRIVACY NOTICE

Version 12 | October 2026

Courtesy translation. This document is a translation of the Aviso de Privacidad issued in Spanish. In the event of any discrepancy, the Spanish version shall prevail and is the version that governs for all legal purposes.

1. IDENTITY AND ADDRESS OF THE DATA CONTROLLERS

“VCM Capital” is the trade name under which Grupo VCM operates. Within the Group, two Mexican companies process Personal Data and are each independently responsible for the processing they carry out:

Schon Cloud, S.A.P.I. de C.V. - with address at Calle Canbec Real No. 77, MZ 20 LT 29-01, Int. Mezzanine 3, Col. SM 3, C.P. 77500, Cancún, Quintana Roo, Mexico. Controller for the processing arising from the current Payment Service operations: Clients, counterparty Resort personnel, suppliers, job applicants and website visitors.

VCM Capital, S.A.P.I. de C.V. - with address at Calle Canbec Real No. 77, MZ 20 LT 29-01, Int. Mezzanine 3, Col. SM 3, C.P. 77500, Cancún, Quintana Roo, Mexico. Controller for the processing arising from its receivables portfolio under administration and collection, corresponding to Clients with agreements entered into under the Group’s previous scheme, which remain in force until their conclusion.

Each company is responsible solely for the processing it carries out. No Personal Data are transferred between them, other than as strictly necessary to handle ARCO Rights requests submitted through the single channel set out in Section 8, which operates for both. Where this Notice refers to “VCM” without further specification, it shall be understood to refer to the Controller corresponding to the relationship concerned.

This Notice is issued pursuant to articles 15, 16 and 17 of the Mexican Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, the “LFPDPPP”), its Regulations and the Privacy Notice Guidelines. It applies to all individuals (“Data Subjects”) whose Personal Data VCM processes in the course of its operations, except where a specific notice applies as indicated in each section.

2. CATEGORIES OF DATA SUBJECTS

For purposes of this Notice, the following categories of Data Subjects are recognized:

Clients - individuals who engage the Payment Service with VCM.
Counterparty (Resort) personnel - attorneys-in-fact, representatives, operating contacts and authorized sales agents of the Resorts with which VCM enters into the Commercial Commission Agreement.
Suppliers - individuals who provide services to VCM or who act as contact persons at corporate suppliers.
Job applicants - individuals who apply for openings within Grupo VCM.
Website visitors - individuals who interact with VCM’s institutional website, whether by browsing, completing contact forms or subscribing to communications.
Receivables portfolio Clients - individuals with agreements entered into with VCM Capital, S.A.P.I. de C.V. under the Group’s previous scheme, whose payment obligation remains in force.

3. PERSONAL DATA COLLECTED

3.1 Clients

VCM collects directly from the Client, upon signature of the Service Request: identification data (name, tax identification number, population registry code, official ID, date of birth, nationality), contact data, financial and asset data including card details for the authorized recurring charges, and, where applicable, basic data of the spouse or domestic partner. Details of this processing are set out in the Privacy Notice for Clients, made available upon signature of the Service Request and delivered as Exhibit 4 to the Commercial Commission Agreement.

3.2 Counterparty Resort personnel

VCM collects, through the Resort, identification and corporate contact data of signing attorneys-in-fact, designated operating contacts and sales agents authorized to offer the Payment Service. No financial, asset or sensitive data are collected. Details are set out in the Privacy Notice for Resort Personnel, delivered as an Exhibit to the Agreement.

3.3 Suppliers

VCM collects the tax identification and contact data required to engage, pay and manage the relationship with its suppliers: name or corporate name, tax identification number, tax domicile, contact data of the representative or designated person, and banking details for the payment of fees or invoices.

3.4 Job applicants

VCM collects résumé data from persons applying for openings within the Group: name, contact data, education, professional experience, languages, references and any other information the applicant voluntarily provides when applying.

3.5 Website visitors

VCM may collect data from website visitors through:

Contact forms: name, email address, telephone and the message voluntarily provided by the visitor.
Cookies and tracking technologies: session identifier, IP address, browser type, operating system, pages visited, time spent, and date and time of access. Details are set out in Section 6.

3.6 Receivables portfolio Clients

VCM Capital, S.A.P.I. de C.V. retains, with respect to Clients with agreements entered into under the previous scheme, the identification, contact, financial and asset data collected at the time of contracting, together with the payment history and supporting documentation of the transaction. No new data are collected other than those required for collection management and the updating of payment methods.

3.7 Sensitive data

VCM does not collect or process sensitive Personal Data within the meaning of article 3, section VI of the LFPDPPP in any of the foregoing categories.

4. PURPOSES OF PROCESSING

4.1 Primary purposes by category of Data Subject

VCM processes Personal Data for the following primary purposes:

Clients: to perform the Payment Service, manage collection of the Reimbursement, issue tax receipts, comply with Mexican anti-money-laundering legislation, respond to requests from authorities, and handle complaints, clarifications and cancellation processes.
Resort personnel: to document the execution of the Agreement, maintain operational communication, administer access to the Instant Cash platform and comply with the obligations arising from the Agreement.
Suppliers: engagement, management of the commercial relationship, issuance of payments, tax compliance and handling of claims.
Applicants: to assess the profile against current openings and, where applicable, to assemble the hiring file if the application is successful.
Website visitors: to respond to enquiries submitted through contact forms, operate the website, generate aggregate usage statistics and prevent fraud.
Receivables portfolio Clients: to administer and collect the agreements in force entered into under the previous scheme, handle clarifications and complaints, comply with tax and anti-money-laundering obligations, and respond to requests from authorities.

4.2 Secondary purposes

VCM does not process Personal Data for secondary purposes in any category. In particular, Personal Data are not used for marketing, targeted commercial prospecting or the creation of advertising profiles.

5. TRANSFERS AND DISCLOSURES TO THIRD PARTIES

Except as provided in this section, VCM does not transfer Personal Data to third parties. Where applicable, disclosures are made to the following recipients:

The operator of the Instant Cash platform, acting as Data Processor pursuant to article 50 of the LFPDPPP Regulations, to host the information in the operating system.
The counterparty Resort, with respect to Client Data, limited to the minimum information necessary to coordinate the payment on account of the Membership price and the cancellation processes under the Agreement.
Domestic or foreign tax, regulatory or judicial authorities that formally require such data in the exercise of their powers, pursuant to article 37, sections I, II and VII of the LFPDPPP.
Banks and financial institutions, limited to the data necessary to execute the authorized bank transfers or card charges.

Schon Cloud, S.A.P.I. de C.V. and Schonusa LLC are mirror entities within Grupo VCM that operate independently. No Personal Data are transferred between the two entities in connection with VCM’s operations.

6. USE OF COOKIES AND TRACKING TECHNOLOGIES ON THE WEBSITE

VCM’s institutional website may use the following categories of cookies:

Technical or session cookies: essential for the operation of the website, user authentication and fraud prevention. These do not require prior consent.
Analytics cookies: may be used to generate aggregate, anonymous website usage statistics. In such case, the visitor may refuse them through browser settings or the site’s consent banner.
Advertising cookies: VCM’s website does NOT use cookies for advertising tracking, commercial profiling or sharing with third parties for marketing purposes.

The visitor may disable cookies at any time through browser settings. Disabling technical cookies may prevent the website from functioning correctly.

7. MEANS TO LIMIT USE OR DISCLOSURE

The Data Subject may limit the use or disclosure of their Personal Data by written communication to the channel set out in Section 8 and, in the case of website visitors, through browser cookie settings. Additionally, the Data Subject may register with the Public Registry to Avoid Advertising (REPEP) administered by PROFECO. Since VCM does not engage in targeted commercial prospecting, this limitation operates automatically in practice.

8. ARCO RIGHTS AND WITHDRAWAL OF CONSENT

8.1 Rights of the Data Subject

The Data Subject has the right to Access their Personal Data, to Rectify them where inaccurate, to Cancel them where applicable and to Object to their processing for specific purposes (collectively, “ARCO Rights”). The Data Subject may also withdraw any consent given.

8.2 Single channel

Requests must be addressed to datospersonales@vcmcapital.com, accompanied by:

Full name of the Data Subject and an email address for the response.
A copy of valid official identification.
A clear description of the right exercised and of the Data involved.
Supporting documentation and, where applicable, evidence of representation.

8.3 Time periods

VCM will respond to the request within twenty (20) business days following receipt. The right will be given effect, where applicable, within the following fifteen (15) business days. These periods may be extended once for an equal period.

8.4 Restrictions and retention

The exercise of the right of Cancellation may be restricted where the Data must be retained by express legal provision. In particular, Client Data are retained for a minimum of ten (10) years pursuant to article 18, section IV of the Mexican anti-money-laundering law (LFPIORPI, as amended by Decree published in the Official Gazette of the Federation on 16 July 2025), during which period Cancellation does not proceed; from the tenth year onwards, the Data are deleted in accordance with Grupo VCM’s internal policy, unless another legal retention obligation applies. Data of Resort personnel and suppliers are retained for the term of the contractual relationship and for ten (10) years thereafter pursuant to article 38 of the Mexican Commerce Code. Data of applicants who are not hired are retained for a maximum of twelve (12) months after the process concludes, unless the Data Subject expressly objects. Data of website visitors are retained only for as long as strictly necessary to respond to the enquiry.

9. SECURITY MEASURES

VCM implements reasonable administrative, technical and physical measures to protect Personal Data against damage, loss, alteration, destruction, and unauthorized use, access or processing, pursuant to articles 19 and 20 of the LFPDPPP. These measures include access controls, functional segregation, encryption of sensitive information in transit and at rest and, with respect to the handling of Client card data, compliance with the PCI DSS standard.

In the event of a security breach that significantly affects the rights of the Data Subject, VCM will provide notice within the periods set out in the LFPDPPP.

10. SUPPLEMENTARY SPECIFIC NOTICES

This Notice is the master document of Grupo VCM. For the specific processing of Personal Data under each contractual relationship, the following specific notices additionally apply and prevail over this Notice to the extent applicable:

Privacy Notice for Clients: applicable to the processing of Client Personal Data in connection with the Service Request. Made available upon signature of the Service Request and delivered as Exhibit 4 to the Commercial Commission Agreement.
Privacy Notice for Resort Personnel: applicable to the processing of Resort personnel Data in connection with the Agreement. Delivered as an Exhibit to the Agreement.

11. CHANGES TO THIS PRIVACY NOTICE

VCM reserves the right to amend this Notice. Amendments are published on the institutional website. The date of last update appears at the foot of the document. Data Subjects are encouraged to review the Notice periodically.

COMPLAINTS BEFORE THE AUTHORITY

If the Data Subject considers that their right to the protection of personal data has been infringed by any act or omission of VCM, or suspects any violation of the provisions of the LFPDPPP, they may file the corresponding complaint before the Mexican National Institute for Transparency, Access to Information and Protection of Personal Data (INAI), at www.inai.org.mx.

12. CONTROLLER DETAILS AND CONTACT CHANNEL

Controller for current operations: Schon Cloud, S.A.P.I. de C.V.

Tax ID (RFC): SCL201124LD3

Address: Calle Canbec Real No. 77, MZ 20 LT 29-01, Int. Mezzanine 3, Col. SM 3, C.P. 77500, Cancún, Quintana Roo, Mexico

Controller for the receivables portfolio: VCM Capital, S.A.P.I. de C.V.

Tax ID (RFC): VCM140919GFA