Privacy Notice

This document constitutes the Privacy Notice of LandStocks, domiciled at Avenida Paseo del Centenario 10310-101 PB, Zona Urbana Río Tijuana, C.P. 22010, Tijuana, Baja California, México, website https://landstocks.net/.

LandStocks is responsible for the use and protection of your personal data, for the purposes set forth in the Federal Law on Protection of Personal Data Held by Private Parties (the "LFPDP"), its Regulations, and the provisions arising from or related to it; accordingly, LandStocks shall hereinafter be referred to in this document as the "Data Controller."

This Privacy Notice applies to all personal data collected by the Data Controller, through its partners, associates, affiliates, subsidiaries, representatives, attorneys-in-fact, employees, agents, and intermediaries with whom it has a direct or indirect legal representation relationship before the general public.

This Privacy Notice is subject to the following terms and conditions:

1. Defined Terms

For purposes of this Privacy Notice, the following terms shall have the definitions found in the applicable law itself, provided that, unless otherwise defined in this Privacy Notice, terms used herein and not defined here shall have the meaning attributed to them in the LFPDP:

"Personal Data" Any information concerning an identified or identifiable natural person.

"ARCO Rights" Means the rights of Access, Rectification, Cancellation, and Objection which, in accordance with the LFPDP and subject to the exceptions established therein and in this Privacy Notice, each Data Subject holds in relation to the Personal Data collected by the Data Controller and/or its Processors, described as follows:

"Right of Access" The right of the Data Subject to know about the Personal Data relating to them held by the Data Controller or its Processors, as well as to whom it has been shared and for what purpose.
"Right to Rectification" Each Data Subject has the right to have their Personal Data rectified when it is inaccurate or incomplete.
"Right to Cancellation" Each Data Subject has the right to request at any time that their Personal Data be deleted, which will occur once the blocking period has elapsed. Blocking involves identifying and retaining the Personal Data once the purpose for which it was collected has been fulfilled, for the purpose of determining possible liabilities in connection with its processing, until the legal or contractual statute of limitations expires. During that period, the Personal Data will not be processed, and once it has elapsed, it will be deleted from the corresponding database or file. Once the corresponding data has been deleted, the Data Controller will notify the Data Subject accordingly. If the Personal Data had previously been transferred and continues to be processed by third parties, the Data Controller will inform the relevant third party of such rectification or cancellation request so that it may also carry it out.
"Right to Object" The Data Subject has the right, at any time, provided there is a legitimate cause, to request that the Data Controller stop processing their Personal Data.

"Processor" Means the natural or legal person who, alone or jointly with others, processes Personal Data on behalf of the Data Controller.

"Data Controller" Means the natural or legal person who decides on the processing of the Data Subject's Personal Data.

"Data Subject" Means the natural person who is the owner of the Personal Data, or who is authorized to provide a third party's Personal Data in accordance with applicable law, and who provides such Personal Data to the Data Controller.

2. Consent of the Data Subject

For purposes of the LFPDP, and in particular its Article 17, the Data Subject states (i) that this Privacy Notice has been made known to them by the Data Controller, (ii) that they have read, understood, and agreed to the terms set out in this Privacy Notice, and accordingly grant their consent to the processing of their Personal Data for purposes of the LFPDP and other applicable legislation. Where the Personal Data collected includes sensitive or financial Personal Data, by signing the corresponding contract — whether in printed format or through electronic means and their corresponding consent-formation processes, including, by way of example but not limitation, the submission of Personal Data through dialogue windows, or the on-screen display and review of terms and conditions — acts constituting the Data Subject's express consent shall be carried out in terms of the second paragraph of Article 8 of the LFPDP and other applicable legislation; and (iii) grants their consent for the Data Controller, as applicable, to contract for or carry out transfers of Personal Data to domestic or foreign third parties, on the understanding that the processing such third parties give to their Personal Data must conform to what is established in this Privacy Notice.

If the Data Subject does not object to the terms of this Privacy Notice within 30 days of it being made available to them, its content will be deemed agreed to and consented, pursuant to the third paragraph of Article 8 of the LFPDP. The Data Subject's consent may be revoked at any time by the Data Subject, without retroactive effect, under the terms and pursuant to the procedures established further below in this Privacy Notice.

Notwithstanding any provision of this Privacy Notice, the Data Subject acknowledges that the Data Controller's or third parties' consent is not required to process Personal Data in any of the cases set forth in Article 10 of the LFPDP.

3. Purpose of the Privacy Notice; Purpose of the Personal Data

This Privacy Notice is intended to establish the terms and conditions under which the Data Controller or its processors (i) will receive and protect the Data Subject's Personal Data, in order to protect their privacy and their right to informational self-determination, in compliance with the LFPDP; (ii) will use the Data Subject's Personal Data; and (iii) will, where applicable, carry out transfers of Personal Data to third parties.

The Data Controller will collect and process the Data Subject's Personal Data — that is, information that can reasonably identify them — through the receipt of documents, whether in printed and/or digital format. The following are examples, by way of illustration and not limitation, of information the Data Controller may collect: name and surname(s); date of birth; home, work, or tax address; personal or work email address; social media handle; personal or work phone number; mobile phone number; credit card, debit card, or bank account number; Federal Taxpayer Registry number (RFC); Unique Population Registry Code (CURP); Mexican Social Security Institute affiliation number; and consumption and browsing preferences when using the telecommunications services we provide, as well as others of a similar nature. Personal Data may be collected when the Data Subject visits the Data Controller's website, or as part of any contract entered into by the Data Subject with the Data Controller. Likewise, the Data Controller may collect data necessary for hiring its personnel or external providers, for purposes that may be established differently in the corresponding contract. The Data Controller undertakes to collect only the information necessary for entering into business dealings, contracts, or engagements with the data subject.

Likewise, the Data Controller may collect data from its customers for purposes of providing its services.

The Data Controller may also collect Personal Data from publicly available sources and other sources available in the market to which the Data Subject may have given consent to share their personal information, or that provided anonymous demographic information associated with a specific geographic area.

The Data Subject's Personal Data is collected and processed by the Data Controller or its Processors for the purpose of allowing the Data Subject to carry out the following activities with the Data Controller:

Entering into preliminary contracts or pre-contracts to reserve the purchase of real estate.
Complying with anti-money-laundering legislation.
Entering into promise-of-purchase-and-sale contracts for real estate.
Collections and fulfillment of contractual obligations.
Providing customer service.
Offering after-sale goods and services.
Providing services related to the real estate; handling complaints and grievances.
Invoicing payments.
Personnel recruitment.
Requesting quotes or information on goods or services from suppliers or service providers.
Contracting suppliers.
Hiring personnel.
Requesting invoices or digital tax receipts.
Issuing print or electronic advertising, including online-marketing or telemarketing communications about products and services.
Creating personal profiles.
Participating in surveys.
Using the various services of its corresponding websites, including downloading content and forms.
Processing payments.
Controlling third-party entry to and exit from facilities.
Office security.
Business agreements; and
Any other activity of a similar nature to those described in the preceding points.

Regarding information technology (I.T.), the Data Controller will use the following personal data, illustratively, per the following aspects:

Data collection when browsing the Data Controller's sites and web pages: Among the automatic data-capture tools used by the Data Controller on its sites and web pages are cookies, web beacons, and links in emails.
Use of Cookies. The proper functioning of the Data Controller's sites and those of its providers requires "cookies" to be enabled in your internet browser. "Cookies" are small data files transferred by the website to your computer's hard drive as you browse the site. Cookies may be session-based or persistent. Session cookies do not remain on your computer after you close your browser session, while persistent cookies remain on computers until deleted or they expire. In most browsers, cookies are accepted automatically by default; you can adjust your browser preferences to accept or reject cookies. Disabling cookies may disable various functions of the Data Controller's websites or cause them to display incorrectly. If you prefer to delete the information from cookies sent by the Data Controller, you may delete the file(s) at the end of each browser session. Relevant information can be found on the websites of the major internet browsers.
Use of Web Beacons (also known as internet tags, pixel tags, and clear GIFs). The Data Controller may use Web beacons on its websites and in its HTML-formatted emails, alone or in combination with cookies, to collect information about the use of the websites and interaction with email. A Web beacon is an electronic image, called a single-pixel (1×1) or GIF, that can recognize information processed on your computer, such as, as with cookies, the time and date the site and its sections are viewed.
Links in the Data Controller's emails. The Data Controller's emails include links that let the Data Controller know whether you activated such a link and visited the destination web page, and this information may be included in your profile. If you prefer that the Data Controller not collect information about your interaction with such links, you may choose to change the format of the Data Controller's communications (for example, receiving the message in text format rather than HTML) or you may disregard the link and not access its content. The Data Controller's emails may include links designed to direct you to relevant sections of the Websites by redirecting you through the Data Controller's servers. This redirection system allows the Data Controller to modify the URL of such links when necessary, and also allows the Data Controller to determine the effectiveness of its online marketing campaigns. Personal Data the Data Controller obtains from its commercial sources may be used together with the Personal Data it collects through its websites. For example, the Data Controller could compare de-identified geographic information acquired from commercial sources with the IP address collected by automatic data-capture tools in order to provide you with information or promotions relevant to your geographic area.
Protection of minors: The Data Controller encourages parents and/or guardians to take an active role in their children's online activities. If the Data Controller believes Personal Data has been provided by a minor in contravention of this Privacy Notice, the Data Controller will promptly delete such Personal Data. If you become aware that such Personal Data has been provided by a minor under 18 years of age, please send an email to: legal@landstocks.net

4. Data Transfers

Having read, understood, and agreed to the terms set out in this Privacy Notice, the Data Subject consents to the Data Controller or any Processor carrying out transfers of Personal Data to domestic or foreign third parties, on the understanding that the processing such third parties give to the Data Subject's Personal Data must conform to what is established in this Privacy Notice.

For purposes of this Section 4, but subject to what is established in its last paragraph, the Data Controller informs the Data Subject that, in order to carry out the services that are part of its corporate purpose, the Data Controller and/or its Processors have entered into or will enter into various business agreements with providers of products and services, both domestically and abroad, to supply, among other services: telecommunications and email; database administration and management; credit-card terminals; electronic invoicing; marketing; transport and installation of products; payroll and social-security benefits administration; personnel hiring; audit services; and others of a similar nature. The Data Subject's authorization granted under this Section 4 empowers the Data Controller and/or its Processors to transmit the Data Subject's Personal Data to such providers, on the understanding that such providers are obligated, under the corresponding contract, to maintain the confidentiality of the Personal Data supplied by the Data Controller and/or its Processors and to observe this Privacy Notice. The Data Controller and/or its Processors may transfer the Data Subject's Personal Data collected to any other company within the same corporate group to which the Data Controller belongs and that operates under the same internal processes and policies, whether located domestically or abroad, for processing for the same purposes described in this Privacy Notice. It may also transfer your Personal Data to other third parties that assist it in fulfilling the contracts or legal relationships it has with the Data Subject.

Your personal information may be transferred, stored, and processed in a country other than the one where it was provided. If this occurs, the information will be transmitted in accordance with the applicable data-protection laws in the destination country. Measures will be taken to protect personal information regardless of the country where it is stored or to which it is transferred. We have appropriate procedures and controls to ensure this protection.

We reserve the right to transmit your Personal Data in the event of selling or transferring all or part of our business or assets. Should such a sale or transfer occur, we will make every effort to encourage the new owner to use the Personal Data in accordance with this Notice. If you do not want your Personal Data to be processed following the transfer, you must contact the new owner.

Notwithstanding the provisions of this Section 4 or elsewhere in this Privacy Notice, the Data Subject acknowledges and agrees that the Data Controller does not require such Data Subject's authorization or confirmation to carry out domestic or international transfers of Personal Data in the cases provided for in Article 37 of the LFPDP or in any other exception case provided for by it or other applicable legislation.

5. Retention and Security of Personal Data

The Data Controller and/or its Processors will retain the Data Subject's Personal Data for as long as necessary to process their requests for information, products and/or services, as well as to maintain accounting, financial, and audit records under the LFPDP and applicable commercial, tax, and administrative legislation.

The Data Subject's Personal Data collected by the Data Controller and/or its Processors will be protected by appropriate administrative, technical, and physical security measures against damage, loss, alteration, destruction, or unauthorized use, access, or processing, in accordance with the LFPDP and its implementing administrative regulations. Notwithstanding the foregoing, the Data Controller does not guarantee that unauthorized third parties cannot gain access to the Data Subjects' or the Data Controller's physical or logical systems, or to electronic documents and files stored in its systems. Accordingly, the Data Controller will in no case be liable for damages arising from such unauthorized access.

6. Personal Data Department / Privacy Office; Address

For any communication regarding our Privacy Notice, please contact:

Legal Department
Avenida Paseo Centenario número 10310, interior 101 APB, Zona Río Tijuana, C.P. 22010, Tijuana, Baja California.
legal@landstocks.net

For purposes of Article 16, section I of the LFPDP, the Data Controller's address is the one established in this Section 6 of this Privacy Notice.

7. Procedure for Exercising ARCO Rights

To exercise ARCO Rights, the Data Subject or their representative must submit, at the Data Controller's address, a request for access, rectification, cancellation, or objection with the following information and documentation:

The Data Subject's name and address or another means for communicating the response to their request;
Documents proving their identity (a simple copy, in printed or electronic format, of their voter ID, passport, or FM-3) or, where applicable, the Data Subject's legal representation (a simple copy, in printed or electronic format, of the simple power of attorney letter with the Data Subject's and the attorney-in-fact's autograph signatures and their corresponding official identifications — voter ID, passport, or FM-3);
A clear and precise description of the Personal Data with respect to which they seek to exercise any of the ARCO Rights; and
Any other element or document that facilitates locating the Data Subject's Personal Data.
For rectification requests, the Data Subject must also indicate the modifications to be made and provide documentation supporting their request.

The Data Controller or its Processors will respond to the Data Subject within a maximum of twenty business days from the date the request for access, rectification, cancellation, or objection was received, with the decision reached, so that, if appropriate, it may be carried out within the fifteen days following the date the response is communicated to the Data Subject. For access requests, the Data Controller or its Processors will proceed with delivery upon prior verification of the identity of the requester or their legal representative, as applicable. The aforementioned periods may only be extended in accordance with the LFPDP.

Delivery of the Personal Data will be free of charge; the Data Subject will only be responsible for justified shipping costs or the cost of reproduction in copies or other formats. If the Data Subject repeats their request within a period of less than twelve months, they must cover the corresponding costs, equivalent to 1.5 days of the Minimum Wage in effect in Mexico City under the LFPDP, unless there are substantial modifications to the Privacy Notice that prompt new inquiries.

For cancellation requests regarding Personal Data, in addition to what is set forth in this Privacy Notice, Article 26 of the LFPDP shall apply, including the exception cases for cancellation of Personal Data set forth therein.

Submitting an objection request regarding the use of Personal Data by its Data Subject will give the Data Controller the authority to object to the use of the Personal Data that, as Data Subject, was provided to the objecting party.

8. Changes to the Privacy Notice

The Data Controller reserves the right to periodically update this Notice to reflect changes in our information practices. It is the Data Subject's responsibility to periodically review the content of the Privacy Notice on the site https://landstocks.net.

The Data Controller will understand that, absent any statement to the contrary, the Data Subject has read, understood, and agreed to the terms set out therein, which constitutes their consent to the changes established in such updates regarding the processing of their Personal Data for purposes of the LFPDP and other applicable legislation.

Frequently Asked Questions

What will we use your personal data for?

The personal data we collect from you will be used for the following purposes, which are necessary for the service you request:

Entering into preliminary contracts or pre-contracts to reserve the purchase of real estate.
Complying with anti-money-laundering legislation.
Entering into promise-of-purchase-and-sale contracts for real estate.
Collections and fulfillment of contractual obligations.
Providing customer service.
Offering after-sale goods and services.
Providing services related to the real estate; handling complaints and grievances.
Invoicing payments.
Personnel recruitment.
Requesting quotes or information on goods or services from suppliers or service providers.
Contracting suppliers.
Hiring personnel.
Requesting invoices or digital tax receipts.
Issuing print or electronic advertising, including online-marketing or telemarketing communications about products and services.
Creating personal profiles.
Participating in surveys.
Using the various services of its corresponding websites, including downloading content and forms.
Processing payments.
Controlling third-party entry to and exit from facilities.
Office security.
Business agreements; and
Any other activity of a similar nature to those described in the preceding points.

If you do not authorize the use of your personal data for the necessary purposes, we will be unable to enter into any contract with you.

Additionally, we will use your personal information for the following secondary purposes, which are not necessary for the requested service but allow us to provide you with better service:

Marketing or advertising.
Commercial prospecting.

If you do not want your personal data processed for these secondary purposes, you may let us know right now through the following channel (email): legal@landstocks.net

Refusing to allow use of your personal data for secondary purposes may not be grounds for denying you the services or products you request or contract with us.

What personal data will we use for these purposes?

To carry out the purposes described in this privacy notice, we will use, by way of illustration and not limitation, the following personal data:

Full name (first and last names)
Marital status
Federal Taxpayer Registry (RFC), and Tax Status Certificate, unless not registered with Mexico's Tax Administration Service (SAT)
Unique Population Registry Code (CURP), unless a foreign national without such code
Place of birth
Date of birth
Age
Sex / Gender
Nationality
Home address and, where applicable, tax address
Home phone number (if you have a landline)
Mobile phone number
Work phone number
Email address
Handwritten signature (required to sign the preliminary contract, promise-of-purchase-and-sale contract, definitive purchase-and-sale contract, and other exhibits)
Photograph (the one appearing on the official ID you provide us as a simple copy)
Fingerprint (the one appearing on the official ID you provide us as a simple copy and, where applicable, the one affixed alongside your signature on preliminary contracts, promise-of-purchase-and-sale contracts, or definitive purchase-and-sale contracts and other exhibits)
Position or role held (solely to identify your economic activity)
Work address (solely to identify your economic activity)
Bank account statement (solely to identify your economic activity)
Cookies regarding website use
User's preferred language
User's region
User's browser type
Searches performed by the user
Advertising viewed by the user
Shopping-page lists and consumption habits

With whom do we share your personal information, and for what purposes?

Please note that, by official mandate, your personal data is shared domestically and, where applicable, abroad, with the competent authorities as required by law.

Likewise, personal data will be used internally by the Data Controller together with its partners, associates, affiliates, subsidiaries, representatives, attorneys-in-fact, employees, agents, and intermediaries, solely to fulfill the purposes of the contracts you enter into with the Data Controller.

How can you access, rectify, or cancel your personal data, or object to its use?

You have the right to know what personal data we hold about you, what we use it for, and the conditions of use we give it (Access).

Likewise, it is your right to request the correction of your personal information if it is outdated, inaccurate, or incomplete (Rectification).

Similarly, it is your right to request that we delete your personal information from our records or databases when you consider it is not being used appropriately (Cancellation).

Finally, you have the right to object to the use of your personal data for specific purposes (Objection).

These rights are known as ARCO rights.

To learn about the procedure and requirements for exercising ARCO rights, send your request to legal@landstocks.net, and within no more than 48 hours you will receive a response indicating the procedure for exercising any of the ARCO rights.

The contact details for the person or department in charge of processing ARCO-rights requests are as follows:

a) Name of the person or personal-data department: Legal Department.
b) Address: Paseo del Centenario 10310-101, Zona Urbana Río Tijuana, C.P. 22010, Tijuana, Baja California, México, and website https://landstocks.net/
c) Email: legal@landstocks.net
d) Phone number in Mexico: (664) 912-0362.
e) Phone number in the United States (USA): +1 (619) 812-2740.

You can revoke your consent to the use of your personal data

You may revoke any consent you have granted us for the processing of your personal data. However, please note that we may not always be able to fulfill your request or discontinue use immediately, since a legal obligation may require us to continue processing your personal data.

Likewise, you should consider that, for certain purposes, revoking your consent will mean we can no longer provide you with the service you requested, or it will end your relationship with us.

To learn about the procedure and requirements for exercising your right of revocation, send your request to legal@landstocks.net, and within no more than 48 hours you will receive a response indicating the procedure for exercising any of the ARCO rights.

How can you limit the use or disclosure of your personal information?

So that you may limit the use and disclosure of your personal information, we provide the email legal@landstocks.net for you to send your request.

How can you learn about changes to this privacy notice?

This privacy notice may be modified, changed, or updated as a result of new legal requirements; our own needs regarding the products or services we offer; our privacy practices; changes in our business model; or other causes.

We are committed to keeping you informed of any changes to this privacy notice, through the following website(s):

www.landstocks.net

Notifications about changes or updates to this privacy notice will be made through a notice posted on the website, notice via email, or a printed notice at the company's branches and customer service centers.

Last updated: July 3, 2025.