Governance Privacy Statement

1. WHAT WE COLLECT

We collect personal information when you engage in Activities. The personal information we collect will depend on your relationship with KTSA. For example, we may collect personal information from our business clients during an engagement to provide services to our clients; our collection and use of such personal information is governed by our contract with that entity. In other cases, we may collect personal information directly from individuals that engage in our Activities.

Categories of Personal Information Collected

We may collect the following categories of personal information about you through this website:

• Geolocation data based upon your IP address, cell network data, and/or other similar location data; and
• Inferences about you, which may include preferences and characteristics and other information we may infer from other personal information we have collected;

1.1 Personal Information You Provide

We collect the personal information that you provide voluntarily (e.g., participating in a survey). For example, when you register attend a firm-sponsored event, we may collect business contact information about you such as your name, title, employer, work e-mail address, mailing address, and phone number.

1.2 Information We Gather

In some instances, we and our third-party providers use cookies, web beacons, wayfinding technology, and other tracking technologies to collect certain types of personal information when you engage in Activities (e.g., web-based), as well as through messages that we may exchange.

1.2.1 What We Gather

IP Addresses. We collect an IP address when you conduct an Activity online. An IP address is a number assigned to your Internet-enabled device (including computers and mobile devices) whenever you access the Internet. It allows computers and servers to recognize and communicate with one another.

Cookie Data. We gather various information via cookies or similar web tracking technologies. Please see our Cookie Preferences in Section 8 for further information.

Location Information. We may collect geographical location from your Internet-enabled device (e.g., via tracking beacons, Bluetooth, or Global Positioning System technology) in connection with certain Activities, but only if you have not disabled sharing of such information via your device. Typically, you may disable or enable sharing of such information by managing the location services preferences on your device. If you disable location services, some features of our Activities may not be available.

1.2.2 How We Gather Personal Information

Cookies. We use cookies to identify you online and gather certain personal information. Please see our Cookie Preferences in Section 8 for further information.

Web Beacons. We may use web beacons to gather certain information. A web beacon is a small image file on a web page that can be used to collect certain information from your Internet-enabled device, such as an IP address, the time the content was viewed, web browser type, and the existence of cookies previously set by the same server. You have the option to render some web beacons unusable by rejecting their associated cookies. The web beacon may still record an anonymous visit from your IP address, but cookie information will not be recorded. If you opt to render some web beacons unusable, some features of our Activities may not be available.

Analytics Tools. We use third-party usage analytics tools as part of online Activities, including Metricool, which may be subject to Metricool's privacy policies. More information about how Metricool is used by KTSA can be found here: Use of Cookies in Metricool | Metricool. To provide website visitors with more choice on how their data is collected by Metricool, Metricool has developed the Metricool Opt-out Browser Add-on. The Add-on communicates with the Metricool JavaScript (ga.js) to indicate that information about the website visit should not be sent to Metricool. The Add-on does not prevent information from being sent to us or to other web analytics services.

1.3 Children

KTSA understands the importance of protecting children's privacy. Our Activities are not intentionally designed for nor directed at children under the age of 18. It is our policy not to knowingly collect or maintain personal information about anyone under the age of 18, except as may be required by applicable law and where permission has been granted by a child's parent or legal guardian (e.g., for benefits administration).

2. HOW WE USE PERSONAL INFORMATION

We use the personal information we collect to enable you to engage in Activities as detailed below. Among other things, this personal information allows us to customize your online experience; improve the performance, usability, and effectiveness of our Activities; advertise and market our Activities; measure the effectiveness of our Activities; and generate and analyze statistics about your engagement in our Activities. We also use your personal information (i) when you expressly permit us to use it, or (ii) as required or permitted by applicable law or professional standards.

If we provide specific terms in connection with a particular request, product or service, those terms which apply to such request, product, or service, and in the event of a conflict between this Privacy Statement and those terms, the specific terms provided in connection with the request, product or service shall control.

2.1 To Participate in Activities and Further Our Business Purposes

We may use the personal information we collect to: enable you to engage in Activities; provide you with web-based applications; communicate with you; provide you with information about KTSA's services; comply with applicable laws, regulations, and/or professional standards, including for background checks for onboarding KTSA's Personnel, anti-money laundering, and know-your-client checks; operate, maintain, and enhance any of our Activities; improve the delivery or quality of services or technology for KTSA and its clients through the use of technologies, such as artificial intelligence (including, but not limited to, machine learning), internal analytics, and benchmarking; and fulfill your specific requests. For example, if you send us a message requesting information about KTSA, we will use the contact information you provide, such as your e-mail address, and other personal information you provide, to respond to your request. If you send us a resume or curriculum vitae to apply online for a position with KTSA, we will use the personal information that you provide to match you with available KTSA job opportunities.

IP addresses from which visitors appear to originate may be recorded for our IT security and system diagnostic purposes. This information may also be used to maintain and improve our Activities and to generate and analyze statistics about the Activities and your engagement.

We or our third-party providers may also use personal information in an aggregated, deidentified or anonymized data for our legitimate business purposes detailed below, including, but not limited to, improving the delivery or quality of services or technology, and for research and development. This data does not identify you individually, but rather helps to identify trends in user preferences and behaviors. Any deidentified information will be maintained in a deidentified form and will not be re-identified.

2.2 Data Retention

We retain personal information only for so long as it is needed to fulfil the purpose for which it was collected as described in this Privacy Statement, including to meet business needs and comply with legal requirements, professional standards, or an individual's request. Accordingly, the retention period may vary and depend on KTSA's retention policies.

3. DISCLOSURE OF PERSONAL INFORMATION

3.1 Business Purposes

We disclose personal information with third parties that we engage to carry out your requests and as necessary for our legitimate professional and business needs, and to market our services, including in coordination with other third parties for joint-marketing purposes, as required or permitted by law or professional standards, or otherwise with your permission. We require them to safeguard any personal information disclosed in the same manner as we do.

Furthermore, we may disclose aggregated or deidentified information, including reports on user demographics and traffic patterns, with certain third parties.

Legal Purposes

Our legitimate interest in the effective delivery of information and services to you, and the effective and lawful operation of our business includes:

• Our legitimate interest in developing and improving our site, and your user experience.
• Performance of a contract.
• Compliance with a legal or regulatory obligation.
• Our legitimate interest in providing you with seamless, consistent, high-quality services and securing prompt payment of any fees, costs, and debts in respect of our services.
• Our legitimate interest in understanding any conflict of interest or challenge with regard to independence legislation.
• Our legitimate interest in safeguarding KTSA against inadvertently dealing with the proceeds of criminal activities or assisting in any other unlawful or fraudulent activities (for example, terrorism).
• Our legitimate interest in organizing events or meetings, managing the registration process for such events or meetings, and creating summaries of such events or meetings.
• Our legitimate interest in protecting our people, assets, and information, and to prevent unauthorized people from gaining access to KTSA events.
• Our legitimate interest in providing information about KTSA, our services, and events we organize.
• Our legitimate interest to process and manage applications for roles at KTSA, including the screening and selecting of candidates.
• Compliance with a legal or regulatory obligation.
• For any other purpose with your consent.

3.2 Legal Reasons

We may also disclose personal information in order to respond to lawful requests of government or law enforcement agencies, including to meet national security or law enforcement requirements or where disclosure is required by applicable laws, court orders, government regulations or professional rules.

3.3 Corporate Transactions

In the event that the ownership of KTSA or an affiliate or their assets changes as the result of a merger, acquisition, or sale of assets, information owned or controlled by KTSA may be transferred to another company. Information that has been collected by KTSA may also be shared in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company, or we sell, liquidate, assign, or transfer all or a portion of our assets. These disclosures may also be needed for data privacy or security audits and/or to investigate or respond to a complaint or security threat.

3.4 Social Media

If you use social media platforms and integrated third-party provider tools to share personal information or you otherwise interact with these features, those providers may collect information about you and may use and share such information in accordance with your account settings, including by sharing such information with the general public. Your interactions with such social media platforms and tools may be governed by the privacy policies of those providers. We encourage you to carefully read those privacy policies.

In addition, our online Activities may feature blogs, forums, crowd-sourcing and other applications, or services (collectively, "Social Media Features"). The purpose of Social Media Features is to facilitate the sharing of knowledge and content. Any personal information that you provide on any KTSA Social Media Feature may be shared with other users of that Social Media Feature (unless otherwise stated at the point of collection), over whom we may have limited or no control.

3.5 Cross-Border Collection and Transfer

We may collect personal information from or about you if you are in a jurisdiction other than Mexico in connection with your use of KTSA's services. Similarly, if you are in Mexico, we may transfer outside of Mexico the information we collect from or about you. Regardless of where you are, we may transfer certain personal information across geographical borders to KPMG International, other member firms affiliated with KPMG International or to various third-party providers working on our behalf, or we may receive personal information in the U.S. or elsewhere transferred from KPMG International, another member Firm affiliated with KPMG International, or an unaffiliated third party. KTSA may also store personal information in a jurisdiction other than where you are based, and such jurisdiction may not provide the same level of protection for your personal information as your home country. By providing your personal information to KTSA, you understand that your personal information may be collected, transferred and/or stored in a jurisdiction other than your home country. Each KPMG Member Firm affiliated with KPMG International is required to safeguard personal information in accordance with its contractual obligations and data protection legislation applicable to its provision of services. Your personal information will only be transferred if appropriate or suitable safeguards are in place.

4. Choices

We may require you to provide certain personal information in order to receive additional information about our Activities. We may also ask for your permission for certain uses of your personal information, and you may agree to or decline those uses. If you have previously opted in to particular Activities (e.g., an online newsletter), you will be able to unsubscribe at any time by following the instructions included in each communication. If you decide to unsubscribe from an Activity, we will remove your personal information, and reach out to you in case we require additional information or confirmation before we can process your request.

If you have submitted personal information to us, you may have the right to request, under applicable law, that we provide you with reasonable access to your personal information, update or correct any inaccuracies in your personal information, delete your personal information, and, in any such event, we will undertake reasonable and practical efforts to comply with your request, so long as our doing so would be consistent with applicable law, our contractual requirements, our record retention policies, and/or the professional standards applicable to us.

To make a Data Privacy Request, please contact us by:

E-mailing us-legalktsaprivacid@KPMG.com

5. DATA SECURITY

We have data security policies and procedures that help protect personal information from loss, misuse, alteration, destruction, and unauthorized access, disclosure, transfer, use, or modification, and we require our service providers and other third-party providers to similarly safeguard personal information. Despite those efforts, security cannot be guaranteed against all threats. We seek to limit access to your personal information to those who have a need to know, and we require those individuals to maintain the confidentiality of such information.

KTSA has a comprehensive incident response program that includes procedures for incident notification, mitigation, and prevention, as applicable.

This Privacy Statement does not govern the privacy practices concerning any current or former KTSA employees, directors, officers, interns, and individuals engaged with KTSA. The collection and processing of KTSA Personnel's personal information is subject to KTSA's Employee's Privacy Notice and in furtherance of other KTSA policies.

6. DATA PRIVACY FRAMEWORK

KTSA complies with the Mexican Federal Law of Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce and as available. KPMG has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles ("EU-U.S. DPF Principles") with regards to the processing of personal information received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. KPMG has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles ("Swiss-U.S. DPF Principles") with regard to the processing of personal information received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Statement and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.

7. LINKS TO OTHER SITES

Our Activities may contain links or refer you to other websites, applications, social media platforms, collaboration platforms, products or services maintained by KPMG International, other member firms affiliated with KPMG International, or by unaffiliated third parties (collectively, "Other Sites"). Other Sites are not governed by this Privacy Statement and may be governed by their own privacy notices. We are not responsible for the content or practices of these Other Sites. We encourage you to review the applicable privacy notices of Other Sites you visit before disclosing personal information.

8. COOKIES AND SIMILAR TECHNOLOGIES

This website uses a visit measurement and analytics tool provided by Metricool to measure website traffic in an anonymous and aggregated manner. Metricool uses a JavaScript-based tracker that does not install cookies, store information on the user's device, or assign unique identifiers. The visitor's IP address is accessed only during the connection and is not stored.

The data collected is used solely for statistical purposes on behalf of the website operator and is not shared with third parties. Under applicable privacy regulations, user consent is not required for this type of audience measurement.

9. CHANGES TO THIS PRIVACY STATEMENT

We may modify this Privacy Statement from time to time to reflect our current personal information practices. When we make changes to this Privacy Statement, we will revise the "updated" date at the top of this page. We encourage you to periodically review this Privacy Statement to be aware of updates to our personal information practices. Your use of the Activities after such update signifies your consent to the updated terms.

10. QUESTIONS AND COMMENTS

If you have questions or comments about this Privacy Statement or our privacy practices, or if you have any concerns regarding compliance with this Privacy Statement, please contact by e-mail at us-legalktsaprivacid@kpmg.com.