1.  Identity and address of the data controller

SustainLuum, with its address at Lago Alberto 319, Floor 6, Granada, C.P. 11520, Miguel Hidalgo, Mexico City, Mexico, is responsible for processing and protecting the personal data collected through the website www.sustainluum.com, in accordance with the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP) and other applicable provisions.

For any matter related to this Privacy Notice or the processing of your personal data, you may contact SustainLuum’s Privacy Officer at: difunde@sustainluum.com

2. Personal data we collect

We may collect the following personal data through the website:

Contact Form and Newsletter Subscription

Name, email address, subject or title of the message, information voluntarily included in the message and, where applicable, organization, position or other contact details voluntarily provided.

Technical Data

When you access the website, the server may generate minimal technical logs, such as: IP address, date and time of access, browser and operating system type, pages or resources accessed, and technical information necessary for the operation and security of the website.

SustainLuum does not use this data to create profiles, deliver personalized advertising or analyze the individual behavior of website users.

3. Sensitive personal data

SustainLuum does not request sensitive, financial or asset-related personal data through its website.

Please do not include sensitive personal data in the message field. If we receive this type of information without having requested it and it is not necessary to respond to your communication, we will securely delete it.

4. Purposes of processing

Personal data collected through the website will be used for the following necessary purposes:

• Receive, address and respond to inquiries, requests for information and messages.
• Follow up on contact requests, meetings, quotations, proposals or potential professional services.
• Maintain communications related to the request submitted by the data subject.
• Manage newsletter subscriptions when expressly requested by the data subject.
• Send SustainLuum newsletters, publications, invitations, news and content to subscribers.
• Maintain the operation, functionality and security of the website.
• Prevent unauthorized access, security incidents or misuse of the website.
• Respond to requests related to ARCO rights, withdrawal of consent or restrictions on the use of personal data.
• Comply with legal obligations and respond to duly substantiated and reasoned requests from competent authorities.

Viewing, opening or downloading newsletters and publications available in PDF format on the website does not create additional processing purposes, apart from ordinary server access logs.

5. Voluntary newsletter subscription

Newsletter subscription is voluntary.

In the contact form, newsletter subscription must be offered through a separate, optional checkbox that is unchecked by default. Subscribing is not required to send a message or receive a response from SustainLuum.

The data subject may unsubscribe from the newsletter at any time using the unsubscribe mechanism included in the communications or by sending an email to difunde@sustainluum.com with the subject line “Unsubscribe from newsletter”.

6. Limiting the use or disclosure of personal data

The data subject may request at any time that SustainLuum limit the use or disclosure of their personal data, particularly to stop receiving newsletters, publications, invitations or informational communications.

The request must be sent to difunde@sustainluum.com with the subject line “Restriction on the use of personal data”, stating the data subject’s name, email address and the communications they no longer wish to receive.

7. Personal data transfers

SustainLuum does not sell, rent, trade or transfer personal data to third parties when the data subject’s consent would be required.

Personal data may only be disclosed to competent authorities when required by law, court order or a duly substantiated and reasoned request, in the cases permitted by applicable law.

For the technical operation of the website and email services, SustainLuum may engage service providers that process personal data solely on behalf of and under SustainLuum’s instructions, in their capacity as data processors. Such processing does not constitute a transfer of personal data under the LFPDPPP.

8. Retention of personal data

Personal data will be retained only for as long as necessary to fulfill the purposes described in this Notice and, thereafter, for the periods required to address legal or contractual liabilities.

Subscription data will be retained until the data subject requests cancellation of the newsletter subscription.

When personal data is no longer necessary, it will be blocked and subsequently securely deleted in accordance with applicable provisions.

9. ARCO rights

The data subject or their legal representative may exercise the following rights at any time:

• Access, to learn what personal data SustainLuum retains and the conditions under which it is processed.
• Rectification, to request the correction or updating of inaccurate or incomplete personal data.
• Cancellation, to request the deletion of personal data when it is no longer necessary.
• Objection, to request that processing cease for a legitimate reason.

To exercise any of these rights, a request must be sent to difunde@sustainluum.com with the subject line “ARCO Rights Request”, including:

1. Name of the data subject.
2. Email address or other means of receiving notifications.
3. A document that proves the data subject’s identity. Information that is not necessary for this purpose may be redacted.
4. Where applicable, documents proving the identity and legal authority of the representative.
5. A clear description of the right the data subject wishes to exercise.
6. A description of the personal data related to the request.
7. Any information or document that facilitates locating the personal data.
8. For rectification requests, the requested changes and supporting documentation.

SustainLuum will communicate its determination within a maximum of twenty business days from receipt of the request. If the request is granted, SustainLuum will implement its determination within the following fifteen business days. These periods may be extended once for an equal period when justified by the circumstances.

The exercise of ARCO rights is free of charge. SustainLuum may only request payment of reproduction, delivery or copying costs, where applicable.

Personal data requested through the right of access will preferably be delivered electronically to the email address specified by the data subject.

10. Withdrawal of consent

The data subject may withdraw the consent granted for the processing of their personal data by sending an email to difunde@sustainluum.com with the subject line “Withdrawal of Consent”, including the information necessary to identify the personal data and the processing for which withdrawal is requested.

Withdrawal of consent will not have retroactive effect. In some cases, SustainLuum may retain certain personal data when necessary to comply with a legal obligation or address liabilities arising from a legal relationship.

11. Security measures and confidentiality

SustainLuum maintains reasonable administrative, technical and physical safeguards to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access or processing.

Persons involved in processing personal data must maintain confidentiality, even after their relationship with SustainLuum has ended.

12. Cookies and similar technologies

The website uses only technical cookies that are necessary for its operation and to remember preferences related to displaying the cookie notice.

SustainLuum does not use: analytics or audience measurement cookies, advertising or remarketing cookies, browsing profiling technologies, Google Analytics, Google reCAPTCHA, Meta Pixel or similar tracking tools.

Technical cookies may store a session identifier or the preference that records that the user has already viewed the notice. They are not used to identify the user for commercial purposes.

Users may configure their browser to block or delete cookies. Disabling strictly necessary cookies may affect some basic website functions.

Links to social media and other external websites are provided solely as a means of access. Upon leaving SustainLuum’s domain, the processing of personal data will be subject to the privacy notices and policies of the relevant external website.

13. Changes to this Privacy Notice

SustainLuum may amend this Privacy Notice as a result of legal changes, new provisions, changes to its processes or the addition of new website functions.

The current version and its date of update will be available at:

https://sustainluum.com/privacy-notice/?lang=en

When an amendment introduces new purposes that require consent, SustainLuum will obtain the corresponding consent again.

14. Competent authority

If the data subject believes that their right to personal data protection has been violated, they may file a complaint with the competent authority under the LFPDPPP in force.

Last updated: June 2026.