Comprehensive Privacy Notice

1. Identity and address of the data controller

Prueba Real Ficticia, who provides real estate services under the trade name Prueba Real Ficticia, with address at Por capturar en Configuración, is the controller responsible for the processing of personal data collected through this website, its contact forms and the communication channels linked to his services.

Contact details:

• Email: soportecrm@gbpi.com.mx
• Phone and WhatsApp:

Personal data is processed in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on March 20, 2025, last amended on November 14, 2025, and other applicable provisions.

2. Personal data we collect

The personal data we may collect depends on the type of interaction and the service requested.

A. Inquiries through the website

When a person requests information through our forms or contact channels, we may collect:

• First and last name.
• Email address.
• Phone and WhatsApp number.
• Preferred language.
• Type of transaction of interest: purchase, sale, rental or property management.
• Location, budget, property features and commercial preferences.
• Content of messages, inquiries and requests.

Likewise, depending on the tools used on the site, technical browsing data may be processed, such as IP address, device type, browser, pages visited, cookies and analytics identifiers.

B. Provision of real estate services

When the data subject decides to move forward with a commercial or contractual relationship or a real estate transaction, we may request, as applicable:

• Nationality, date of birth and identification data.
• Official ID and documents proving identity.
• CURP, RFC (tax ID), address and tax data.
• Information on ownership and legal documentation of properties.
• Asset and financial data related to the transaction.
• Banking information needed to make or document payments.
• Information on legal representatives, attorneys-in-fact and beneficial owners.
• Contractual, notarial and tax documentation, and any other required by applicable law.

The processing of financial or asset data will be subject to the express consent requirements set forth in applicable law, except for the corresponding legal exceptions.

Sensitive data: We do not request sensitive personal data through the general forms of the website. If a specific transaction requires processing data legally considered sensitive, the data subject will be informed beforehand and the corresponding consent will be obtained.

3. Necessary purposes of processing

Depending on the relationship with the data subject, personal data will be used for the following purposes directly related to our services:

1. Responding to inquiries, information requests and communications received.
2. Identifying the real estate needs of clients and prospects.
3. Providing information on properties, developments, sales, rentals and requested services.
4. Scheduling visits, meetings, tours, calls and appointments.
5. Preparing commercial proposals, quotes and documentation related to real estate transactions.
6. Carrying out the contracted real estate brokerage, marketing and management activities.
7. Managing the relationship with owners, buyers, sellers, landlords, tenants and representatives.
8. Following up on negotiations, contracts, payments and obligations arising from the services provided.
9. Compiling, verifying and keeping files when necessary or legally required.
10. Complying with tax, administrative and contractual obligations and, where applicable, those set forth in anti-money laundering legislation.
11. Handling clarifications, personal data rights requests and disputes related to our services.
12. Protecting the security and integrity of our systems and preventing unauthorized access or use.

Processing will be limited to the data that is necessary, adequate and relevant for each purpose.

4. Secondary or optional purposes

With the authorization of the data subject, we may also use their contact details and preferences to:

• Send real estate newsletters.
• Report on new properties, developments, presales and investment opportunities not specifically requested.
• Share promotions, marketing campaigns and event invitations.
• Send advertising communications by email, phone or WhatsApp.
• Analyze commercial preferences to personalize promotional communications.

Accepting these purposes is voluntary. Refusing them will not prevent us from responding to an inquiry or from contracting or receiving the requested real estate services.

Data subjects may refuse these purposes through the consent options available on our forms or later by writing to soportecrm@gbpi.com.mx, stating that they wish to stop receiving promotional communications.

5. Consent to processing

Consent will be obtained according to the nature of the data and the purposes of processing, using express mechanisms when legally required.

When a secondary purpose requires consent, a separate option will be offered to accept or refuse it.

When a legal exception to consent applies, processing will be limited to the cases authorized by law.

The data subject may revoke their consent through the procedure described in this notice, without retroactive effect and without prejudice to the legal or contractual obligations that must be fulfilled.

6. Transfer of personal data

To manage real estate transactions, certain personal data may be disclosed to domestic or foreign third parties when there is a legal basis for doing so and only to the extent necessary for the corresponding purpose.

Possible recipients include:

• Owners, buyers, sellers, landlords or tenants involved in a transaction requested by the data subject.
• Real estate brokers and partner agencies that must take part in a transaction.
• Notaries, financial institutions, trustees, legal professionals and other participants needed to formalize a transaction.
• Administrative, tax, judicial or anti-money laundering authorities, when there is a legal obligation or request.

When a transfer falls under one of the legal exceptions, it may be made without requesting additional consent. In all other cases, the corresponding consent will be obtained.

For transfers that require consent, the data subject may express acceptance or refusal through the mechanisms presented before the transfer is made.

We do not sell personal databases or transfer information to third parties for their own advertising without a legal basis and the corresponding consent.

7. Technology providers and international processing

To manage our services, communications and business processes, we may use technology providers offering hosting, email, storage, real estate management, CRM, messaging, analytics or automation services.

Some of these providers may operate or store information outside Mexico, particularly in the United States.

When such providers act as processors on our behalf, we will seek to establish the corresponding contractual obligations and protective measures, limiting the use of the information to the contracted services.

Access by authorized advisors or collaborators to Prueba Real Ficticia systems will be subject to their roles, permissions and confidentiality obligations.

8. ARCO rights

The data subject, directly or through an accredited legal representative, may at any time exercise their rights of:

• Access: to know what personal data we process and the conditions of processing.
• Rectification: to request the correction of inaccurate, incomplete or outdated information.
• Cancellation: to request that their data be deleted when legally appropriate.
• Objection: to object to certain processing in the cases provided by law.

To exercise these rights, a request must be sent to soportecrm@gbpi.com.mx with the subject line: Solicitud de Derechos ARCO (ARCO Rights Request).

The request must include:

1. Name of the data subject and a means to receive notifications.
2. Evidence of identity or, where applicable, of legal representation.
3. A clear description of the personal data involved, except when access is requested.
4. The right to be exercised and an explanation of the request.
5. Additional documents that help locate or rectify the information, where applicable.

When identity must be verified with documents, an appropriate means to send them securely will be indicated.

The decision will be communicated within a maximum of 20 days from receipt of the request and, if it is granted, it will take effect within the following 15 days after the response is communicated.

These periods may be extended only once for an equal period when legally justified.

Exercising ARCO rights is free of charge, without prejudice to reproduction or shipping costs expressly permitted by law.

Cancellation or objection may be limited when there is a legal retention obligation, a current contractual relationship or another cause provided by law.

9. Revocation of consent and limitation of use or disclosure

The data subject may at any time request to:

• Revoke previously granted consent, when legally appropriate.
• Stop receiving advertising communications.
• Limit the use of their data for secondary purposes.
• Request information on the options available to restrict certain communications or transfers.

These requests may be sent to soportecrm@gbpi.com.mx, stating the name of the data subject, a means of contact and the specific request.

The outcome of the request will be reported and, where applicable, the date from which the limitation will apply.

Revocation will not affect processing already carried out nor prevent processing that must continue to comply with legal obligations.

10. Cookies and tracking technologies

Our website may use cookies and similar technologies to:

• Enable technical and security functions.
• Keep browsing preferences.
• Obtain general visit and performance statistics.
• Measure the performance of content or advertising campaigns, when such tools are enabled.

The use of non-essential cookies will depend on the tools actually implemented and the corresponding consent options.

Users may manage or delete cookies from their browser settings and, when the site offers a preferences manager, through the options it provides.

Disabling certain technical cookies may affect the operation of some services of the site.

11. Retention of personal data

Personal data will be kept for as long as necessary to fulfill the stated purposes and the applicable legal or contractual obligations.

In particular:

• Inquiry and prospect data will be kept as long as necessary to maintain the commercial relationship or follow up on the request, without prejudice to valid cancellation or objection requests.
• Data used exclusively for advertising will no longer be used for those purposes when the data subject withdraws authorization or requests the corresponding limitation.
• Contractual, tax and real estate files will be subject to the corresponding retention periods.
• Documentation related to Vulnerable Activities under the LFPIORPI (Mexican anti-money laundering law) will be kept for the applicable legal period, which in the corresponding cases is a minimum of 10 years, with the particularities and possible extensions established by law.

Once the applicable retention and blocking periods have ended, the data will be deleted in accordance with the law and the established security procedures.

12. Security and confidentiality measures

Reasonable administrative, technical and physical measures, proportional to the risks of processing, will be established to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access or processing.

Access to the information will be limited to the persons who need it to perform authorized functions.

Collaborators, advisors and providers involved in processing must observe the confidentiality and data protection obligations corresponding to their participation.

13. Changes to the privacy notice

This notice may be updated when there are legal, administrative, technological or operational changes affecting the processing of personal data.

Changes will be announced by publishing the updated version in the Privacy Notice section of the Prueba Real Ficticia website, indicating its update date.

When a change involves new purposes or processing requiring consent, it will be obtained in accordance with applicable law.

14. Competent authority

The Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance) is the competent authority for the protection of personal data held by private parties under the current legal framework.

Anyone who considers their right to personal data protection has been violated may go to that authority through the legally established procedures.

15. Contact for privacy matters

For questions about this notice, the exercise of ARCO rights, the revocation of consent or the limitation of the use of personal data, please contact:

Prueba Real Ficticia · Prueba Real Ficticia · Por capturar en Configuración · Email: soportecrm@gbpi.com.mx · Phone: