Privacy
notice.

1. Identity of the data controller

GMAR Labs (hereinafter “GMAR Labs” or “the controller”) is responsible for processing the personal data you provide to us, in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) published in the Official Gazette of the Federation (Diario Oficial de la Federación) on March 20, 2025 (hereinafter “the Law”), its Regulations and other applicable rules. For any matter related to this notice, you can contact us at contacto@gmarlabs.com or by phone at +52 322 241 2132.

2. Personal data we process

We collect the data you provide to us directly through the contact form, the GMAR Score test, email, phone or WhatsApp:

• Identification and contact data: name, email address and phone number.
• Business data: trade name, line of business and any information you share in your message.
• Answers and score obtained in the GMAR Score test.
• If you hire our services: billing data and any data needed to provide the service.

We do not request sensitive personal data. Please do not include it in your messages. Our services are intended for adults; we do not knowingly collect data from minors.

3. Purposes of processing

Primary purposes, necessary to handle your request and the business relationship:

• Handling and responding to your requests for information, audits or quotes.
• Sending you the result of your GMAR Score test and the corresponding recommendations.
• Following up on your request.
• Providing the contracted services, as well as invoicing, collecting payment and complying with legal obligations.

Secondary purposes, which are not necessary for the business relationship:

• Sending you information, news and promotions about our services.
• Preparing internal statistics to improve our services.

If you do not want your data to be used for secondary purposes, send an email to contacto@gmarlabs.com with the subject “Finalidades secundarias” (secondary purposes). You may do so now or at any later time; if you have provided your data, you have five business days to state your refusal before we use it for those purposes. Your refusal will not be a reason to stop handling your request or the services you hire.

4. Transfers and remittances

GMAR Labs does not sell, rent or trade your personal data. Your data will not be transferred to third parties without your consent, except in the cases provided for by law, such as requests from a competent authority.

To operate, your data is hosted with providers that supply us with web hosting and email services, who act on behalf of GMAR Labs and under confidentiality obligations. If you contact us via WhatsApp, the communication takes place through that platform and is also subject to its own terms.

5. ARCO rights

You have the right to access your personal data, rectify it if it is inaccurate or incomplete, cancel it when you consider it is not required for any of the stated purposes, or object to its processing for specific purposes.

To exercise these rights, send your request to contacto@gmarlabs.com stating:

• Your full name and a means to send you our response.
• A document proving your identity or, where applicable, your legal representation.
• A clear description of the data and the right you wish to exercise.
• Any information that helps locate your data.

We will respond within a maximum of 20 business days from receipt of your complete request. If your request is granted, we will carry it out within the 15 business days following our response.

6. Withdrawal of consent and limitation of use

You may withdraw the consent you have given for the processing of your data at any time, or request that its use or disclosure be limited, through the same procedure described in the previous section. In some cases it will not be possible to process the withdrawal immediately when there is a legal obligation or a current contractual relationship.

7. Cookies and similar technologies

This site does not use advertising or tracking cookies. It only uses a technical session cookie, essential to protect form submissions, which is deleted when you close your browser or when the session expires.

8. Retention and security

We keep your data only for as long as necessary to fulfill the purposes described and the periods established by applicable legal provisions. We apply administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing.

9. Changes to this notice

This notice may be modified due to legal changes, changes in our services or in our privacy practices. Any modification will be published on this same page with its update date.

10. Authority

If you believe your right to the protection of personal data has been violated, you may go to the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the authority responsible for the protection of personal data held by private parties under the Law.

Consent

By providing your data through this site, or by submitting the form or the GMAR Score test, you acknowledge that you have read this privacy notice and consent to the processing of your data in accordance with it.