Comprehensive Privacy Notice

Platform: Nimboo SalesKit · Version 3.1 · Effective as of October 14, 2026

1. Party responsible for processing your personal data

NIMBOO VISUAL INTERNATIONAL S.A.S. DE C.V., a Sociedad por Acciones Simplificada de Capital Variable (simplified variable-capital stock company) incorporated under the laws of the United Mexican States, with Federal Taxpayer Registry (RFC) number NVI231205TN1, domiciled in Benito Juárez, Quintana Roo, Mexico, doing business as Nimboo (hereinafter, "Nimboo" or "the Controller"), is responsible for the use and protection of your personal data.

This Notice is issued in compliance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on the Protection of Personal Data Held by Private Parties), published in the Diario Oficial de la Federación (Official Gazette of the Federation) on March 20, 2025 (hereinafter, "LFPDPPP" or "the Law"), in particular its articles 14 and 15, and, where applicable, its Regulations published in the Diario Oficial de la Federación on December 21, 2011.

Nimboo acts as controller with respect to the data of its clients, of the users of the Platform and of the visitors to its website, which it collects in order to provide and charge for the service. With respect to the personal data that each client incorporates into the Platform —that of its prospects, buyers and team—, the client is the controller and Nimboo acts as processor (persona encargada) under article 2, section XII, of the Law, in accordance with the Personal Data Processing Agreement, available at saleskit.nimboo.com.mx/legal/tratamiento-de-datos.

2. Personal data we collect

2.1 Identification data

• Full name
• Email address
• Telephone number (optional)
• RFC and tax information (when you request a CFDI)
• Tax domicile (when you request a CFDI)

2.2 Billing and payment data

• Last 4 digits of the card used
• Card brand (Visa, Mastercard, etc.)
• Expiration date
• Transaction and invoice history
• Information provided for the issuance of CFDI (electronic tax invoices)

2.3 Platform usage data

• IP address
• Browser and device type
• Pages visited and actions taken within the Platform
• Session start and end date and time
• Content you upload to the Platform (images, floor plans, renders, descriptions)
• Data of the leads/clients you manage in the CRM (where applicable)

2.4 Communication data

• Messages and inquiries you send to our team
• Responses to promotional communications (where applicable)

2.5 Sensitive data

Nimboo does NOT collect sensitive personal data (racial or ethnic origin, health status, genetic information, religious beliefs, political opinions, sexual preferences, etc.).

3. Purposes of the processing

3.1 Primary purposes (necessary for the service)

• Creating and managing your account on the Platform
• Processing payments and recurring charges through Stripe
• Issuing invoices (CFDI) where applicable
• Providing technical support
• Notifying changes to the service, plans or prices
• Complying with tax obligations (retention of invoices for 5 years under the Código Fiscal de la Federación, the Federal Tax Code, CFF)
• Ensuring the security and proper operation of the Platform
• Preventing fraud and abuse

3.2 Secondary purposes (require your consent)

• Sending promotional communications about new products, discounts or events
• Anonymous statistical analysis to improve the Platform
• Satisfaction surveys

You may object to processing for secondary purposes without affecting the provision of the main service, by sending an email to legal@nimboo.com.mx stating your decision.

4. Data from your Google account

If you choose to connect your Google account to the Platform to synchronize your appointments, the following rules also apply; they are additional to, and more specific than, those in the rest of this Notice.

4.1 What data we obtain and with what permission

The connection requests the permissions https://www.googleapis.com/auth/calendar.events.owned (only the user's own calendars), which Google classifies as sensitive, and https://www.googleapis.com/auth/calendar.freebusy. With them we obtain:

• The email address of the Google account you connected, to show you which one is linked.
• The ability to create, modify and delete events in your calendar.
• Which hours in your calendar are busy (only the start and end time, without the title, description or guests of your events).

The connection is voluntary and the Platform works without it: without connecting Google, appointments live only within Nimboo SalesKit.

4.2 What we use it for

Solely so that the appointments you schedule with your clients within the Platform also appear in your calendar. Specifically:

• Creating the event when you schedule an appointment.
• Moving that event when you reschedule.
• Deleting it when you cancel.
• Generating a Google Meet link, if the appointment is by video call.
• Not offering for an appointment a time at which you are already busy, if you keep the option «Block my busy times from Google Calendar» enabled in «My availability».

The invitation your client receives, when you so indicate, is not sent from your Google account: the Platform sends it by email, and your client is not added as a guest to the event in your calendar.

4.3 What we store

• The token that keeps the connection alive, encrypted at rest and accessible only by the Platform's services.
• The email address of the connected account.
• The identifier of each event the Platform created, so that it can be moved or deleted later.

We do not copy or retain the content of your calendar.

4.4 With whom it is shared

With no one. Your Google account data is not sold, is not transferred to third parties, and is not used for advertising or profiling, and is not used to train artificial intelligence models, whether our own or third parties'. No person at Nimboo reads it, except as strictly necessary to resolve a technical problem you report to us, to comply with a legal obligation, or to investigate a security abuse.

4.5 Limited Use

4.6 How to disconnect and what happens then

You may disconnect your account at any time from the Platform settings, or by revoking access at myaccount.google.com/permissions. When you disconnect, we delete the token and immediately cease to have any access to your calendar. Events already created remain in your calendar: they are yours, and you decide whether to keep or delete them.

5. Telephone calls: recording, transcription and analysis

The Platform includes a telephony module with which the advisors of each real estate company call their prospects and receive their calls. When that module is active:

• The call may be recorded. Before recording begins, a notice is played to whoever is on the line.
• The recording is automatically transcribed into text.
• The transcript is analyzed with artificial intelligence to summarize the conversation and identify the prospect's interest.

5.1 Who is responsible

The telephone line, the regulatory file with the carrier and the recordings belong to the real estate company that contracts the Platform, not to Nimboo. Nimboo acts as data processor: it operates the infrastructure on behalf of that company and in accordance with its instructions, under the terms of the Personal Data Processing Agreement.

Each real estate company is responsible for having its own privacy notice for the prospects it calls.

5.2 How to object, and how to turn it off

Anyone who receives or makes a call may state their objection to being recorded; in that case the call must continue by other means or be ended. In addition, recording can be disabled per account: the account-holding real estate company may request this by writing to legal@nimboo.com.mx, and from that moment none of its calls are recorded, transcribed or analyzed.

5.3 How long they are kept

Audio recordings are kept for 12 months from the call, after which they are automatically and permanently deleted. That period coincides with the validity of the contracted minutes. The transcript and the summary —which do not contain the voice— are kept with the prospect's file in accordance with section 9.

The data subject may request the early deletion of a specific recording by exercising their ARCO rights (section 7).

5.4 WhatsApp voice notes

Voice notes that a prospect sends to the real estate company's WhatsApp, and those that advisors send to the prospect from the Platform, are stored together with the conversation and automatically transcribed into text. The transcript is used so that the advisor can read the note, to find it when searching conversations, and so that artificial intelligence can take it into account when analyzing the conversation, estimating the prospect's interest or drafting a reply when the real estate company's assistant is active.

What this section says about voice as biometric data applies equally to voice notes: they are not used to identify people by their voice, they can only be heard by those who have access to that conversation within the real estate company, and the audio is sent to Deepgram solely to transcribe it. The audio and its transcript are kept with the conversation in accordance with section 9, and the data subject may request their deletion by exercising their ARCO rights (section 7).

5.5 WhatsApp photos and documents

Photos and documents that a prospect sends to the real estate company's WhatsApp —for example, an official ID, proof of address, a bank statement or a proof of payment—, and those that advisors send to the prospect from the Platform, are stored together with the conversation so that the real estate company can follow up. Nimboo does not request them or use them for a purpose of its own: it keeps them on behalf of the real estate company, which is responsible for requesting only those necessary for the transaction.

They can only be viewed by those who have access to that conversation within the real estate company; there is no public link to download them. Artificial intelligence takes into account that a file was sent, with its name and the accompanying text, but does not read the content of the photos or documents. They are kept with the conversation in accordance with section 9, deleted when the real estate company's account is cancelled, and the data subject may request their deletion by exercising their ARCO rights (section 7).

5.6 Reading of shared quotes and fact sheets

When an advisor shares a quote or a fact sheet with a prospect through a link, the Platform records the opening and reading of that document, so that the real estate company knows whether it was viewed and can follow up. For each visit, the following is recorded:

• The date and time of the visit and the days on which the document was viewed.
• Reading time, in total and per section of the document, and whether the download button or the contact-the-advisor button was pressed.
• The device type, operating system and browser, inferred from the identifier that the browser itself sends with each request.
• The approximate city, state and country, inferred from the headers that the hosting service adds to the request based on the IP address. The IP address is not stored with the visit.
• A random marker that the prospect's browser stores in its local storage for that link, in order to tell whether the person returning is the same one. The server keeps only an encrypted, irreversible digest of that marker.

This record does not use pixels, cookies or third-party analytics tools, and visits by the real estate company's own staff are not counted. With this information the Platform notifies the advisor of the reading and may prepare, with artificial intelligence, a summary suggesting which prospects to follow up with first; for this purpose, the reading figures and the prospect's first name are sent to Anthropic, without surnames, emails, telephone numbers or identifiers.

Nimboo carries out this recording as processor, on behalf of the real estate company that shares the document (section 5.1). The information is kept with the prospect's file in accordance with section 9, and the data subject may exercise their ARCO rights in accordance with section 7.

6. Communication and transfer of personal data

6.1 Technology providers (data processors)

To provide the service, Nimboo relies on the following providers. Each one receives only the data necessary for the function it performs.

These providers act solely in accordance with our instructions. Nimboo imposes on them, by contract or through the acceptance of their data processing terms, confidentiality and security obligations.

Nimboo's public website also uses Google Analytics, solely on its public pages and only with the visitor's consent, in accordance with the Cookie Policy. That measurement is not activated within the Platform.

6.2 Future providers

Nimboo may incorporate new technology providers in the future to improve the service (for example: messaging platforms or analytics tools, among others). Any new provider involving the processing of personal data will be reflected in an update to this Notice, notified to the Client at least 30 calendar days in advance.

6.3 Authorities

Nimboo may transfer your data to authorities when there is a court order, a resolution or a reasoned and legally grounded order from a competent authority, or when the transfer is provided for by law. In these cases your consent is not required, pursuant to articles 9, section VII, and 36, sections I and V, of the LFPDPPP.

6.4 We do not sell your data

Nimboo does not sell, rent or trade your personal data to third parties for marketing purposes or any other purpose unrelated to the service.

6.5 Processing outside Mexico

The Platform's database resides in Mexico. Part of the processing takes place outside the country, mainly in the United States, as set out in the table in section 6.1; in particular, files uploaded to the Platform are stored in the United States.

Data is communicated to these providers as processors that handle it on behalf of Nimboo or, where applicable, of the real estate client, solely to provide the service. Under article 2, section XX, of the Law, the communication of data to a processor does not constitute a transfer, and therefore does not require the data subject's consent.

7. ARCO rights

As the data subject, you have the right to (the "ARCO" rights, from their Spanish initials):

• Access the personal data we hold about you
• Rectify your data when it is inaccurate or incomplete
• Cancel your data when you consider that it is not required for any of the purposes described herein
• Object to the use of your data for specific purposes

7.1 How to exercise them

Send a written request to legal@nimboo.com.mx including:

1. Your full name and contact email address
2. A copy of your official identification (INE voter ID card, passport) proving your identity
3. A clear description of the right you wish to exercise (access, rectification, cancellation or objection)
4. Information or documents that facilitate locating your data
5. In the case of rectification: the specific change you wish to make
6. In the case of cancellation: the reason why you wish to cancel

Nimboo will notify you of its decision within a maximum of 20 business days from the date your request is received and, if it is granted, will make it effective within the 15 business days following the date on which the response is communicated to you. These periods may be extended once for an equal period when justified by the circumstances of the case, pursuant to article 31 of the LFPDPPP.

Exercising ARCO rights is free of charge; only the costs of reproduction, copies or shipping may be charged, pursuant to article 34 of the LFPDPPP.

If you are a prospect or buyer of a real estate company that uses the Platform, the controller of your data is that real estate company, and it is before that company that these rights must be exercised. If you address your request to Nimboo, Nimboo will forward it to the real estate company without delay.

7.2 Limitations

Pursuant to article 25 of the LFPDPPP, cancellation will not proceed, among other cases, when:

• There are legal obligations requiring the data to be retained (e.g. tax invoicing)
• The data is necessary to perform the contract with you

8. Revocation of consent

You may revoke at any time your consent to the processing of your personal data, without retroactive effect, pursuant to article 7 of the LFPDPPP, except where a legal or contractual obligation prevents it.

To revoke your consent, send an email to legal@nimboo.com.mx.

Note: revoking your consent may mean that we are unable to continue providing you with the service.

9. Data retention

Your personal data will be retained for as long as necessary to fulfill the purposes described and to comply with legal obligations, mainly:

• Billing data: 5 years under the Código Fiscal de la Federación (Federal Tax Code)
• Account data and content: for the duration of the contractual relationship and up to 90 calendar days after cancellation, after which it is deleted (except for legal retention obligations)
• Security logs: up to 6 months
• Call recordings: 12 months from the call (see section 5.3)

After these periods, the data is blocked and, once the blocking period has ended, deleted, pursuant to articles 10 and 24 of the LFPDPPP.

10. Security measures

Nimboo implements reasonable administrative, technical and physical measures to protect your personal data against unauthorized access, loss, alteration or destruction.

These measures include:

• Encryption of communications (HTTPS/TLS)
• Encryption of sensitive data at rest (where applicable)
• Two-factor authentication (2FA) available to users
• Access restricted to authorized personnel
• Periodic audits of access and permissions
• Safekeeping of information backups

Notwithstanding the foregoing, no system is 100% impregnable. In the event of a security breach that significantly affects your property or moral rights, Nimboo will inform you immediately, pursuant to article 19 of the LFPDPPP, so that you can take the appropriate measures to defend your rights. Breaches affecting data that Nimboo processes on behalf of a real estate company are notified to that company under the terms of the Personal Data Processing Agreement.

11. Cookies and similar technologies

The Platform uses cookies and similar technologies to improve the user experience. Details on the use of cookies can be found in our Cookie Policy, available at saleskit.nimboo.com.mx/legal/cookies.

12. Data of minors

Nimboo SalesKit is intended exclusively for adults (18 years of age and older). We do not knowingly collect personal data from minors. If we detect that data of a minor has been collected, we will delete it immediately.

13. Changes to the Privacy Notice

Nimboo reserves the right to modify this Privacy Notice. Any modification will be published at saleskit.nimboo.com.mx/legal/privacidad indicating the date of last update, and will be notified to registered users by email when the changes are substantial.

Users are advised to review this Notice periodically.

14. Competent authority

The competent authority in matters of protection of personal data held by private parties is the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), pursuant to articles 2, section XV, 38 and 39 of the LFPDPPP. Pursuant to the Fourth transitory article of the Decree issuing the Law, references to the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (National Institute for Transparency, Access to Information and Personal Data Protection, INAI) are understood to refer to the entities that acquired its powers; in this matter, to said Ministry.

If you consider that your right to the protection of personal data has been violated, you may file a data protection request with the Ministry within 15 business days following the date on which Nimboo communicates its response to you or, if you receive no response, from the expiration of the period to give it, pursuant to article 40 of the LFPDPPP. More information at www.gob.mx/buengobierno.

15. Contact

For any question about this Privacy Notice or the processing of your personal data:

Email: legal@nimboo.com.mx
Location: Cancún, Quintana Roo, Mexico.