Privacy Notice (full version).

1. Who is responsible for your personal data

OrangeStudio lab, which operates orangestudio.com.mx under the OrangeStudio® brand, is the controller of the personal data described in this notice.

• Address: WeWork Mitikah, Av. Río Churubusco 601, Xoco, Coyoacán, C.P. 03330, Mexico City, Mexico.
• Privacy and ARCO requests: through our contact form, starting your message with “Privacy request”.
• Personal data department: OrangeStudio Privacy Team (Equipo de privacidad de OrangeStudio), at the same email address.

2. Personal data we collect

We receive the data you provide and technical data needed to operate the site and its services:

Gina answers predefined questions in your browser. The question you choose is not sent to OrangeStudio or an external service. The “Listen” button uses your browser or device voice, subject to its manufacturer's practices. We will update this notice before connecting an external voice agent.

3. Sensitive personal data

We do not request sensitive data such as racial or ethnic origin, health, genetic information, religious beliefs, political opinions or sexual preference. Please do not include it in messages. If we receive it without requesting it, we will avoid using it and delete it when there is no legal obligation to retain it.

When requested, the budget refers to your company's project, not your personal assets. We do not request banking or personal financial information through this form.

4. Why we use your data

We use your data only for these primary purposes:

1. Reply to your message, email or WhatsApp conversation.
2. Schedule and hold the initial 20-minute conversation, and send the event invitation and reminders.
3. Understand your company's situation and prepare a recommendation or proposal.
4. Provide the commercial follow-up you requested about that proposal.
5. Handle your privacy requests and protect the form against automated or abusive submissions.

There are no secondary purposes. If we wish to send newsletters or content beyond the follow-up you requested in the future, we will ask for your consent first.

5. Providers that help us operate

We do not sell your data or transfer it to third parties. For transparency, we list providers that process data on OrangeStudio's behalf to deliver these services. These processor disclosures may involve processing outside Mexico:

Links you open to WhatsApp or Google Maps take you to external services governed by their own policies.

6. ARCO rights, withdrawal and limitation

You may request:

• Access: learn what data we hold and how we use it.
• Rectification: correct inaccurate or incomplete data.
• Cancellation: delete your data, subject to any legally required blocking period.
• Opposition: object to processing in the cases provided by law.
• Withdrawal of consent and limitation of the use or disclosure of your data.

Send your request to the OrangeStudio Privacy Team (Equipo de privacidad de OrangeStudio) through our contact form, starting your message with “Privacy request” and including:

1. Your full name and an email address for our response.
2. Documents proving your identity and, if a representative acts for you, their identity and authority.
3. A clear description of the data and the right you wish to exercise.
4. Information that helps us locate your data.
5. For rectification, the requested changes and supporting documents.

ARCO deadlines: we will respond within 20 business days of receiving your request. If granted, we will act on it within 15 business days after the response. Each period may be extended once for an equal period, with justification. If information is missing, we may request clarification once within 5 business days of receipt; you will have 10 business days to respond, counted from the day after you receive the request for clarification. In that case, the response period starts the day after you provide the clarification; if you do not, the request will be treated as not submitted.

Exercising these rights is free; only justified shipping or reproduction costs may apply where permitted by law. Access will be provided after identity verification, through consultation or an electronic copy sent to the designated email, or another legally appropriate method.

To withdraw consent or limit use or disclosure, write to the same email and identify the processing you want stopped or limited. We will explain whether and to what extent the request can be granted; we will apply the periods above when handling it. Withdrawal has no retroactive effect and may prevent us from continuing to handle your inquiry. Some legal obligations may require us to retain information.

7. Cookies and similar technologies

We do not use analytics or advertising. The cookie banner informs you about the Google map on Contact and lets you reject functional cookies to disable it. We store your choice in browser local storage, and some providers may use necessary or functional cookies. See the cookie policy for the services and how to change your choice from the footer.

8. Security and retention

We use HTTPS connections for the site and form submissions, and spam protection through hCaptcha and a hidden field to detect automated submissions.

We retain messages and contact data for up to 24 months after the last contact if there is no business relationship. If a contract is signed, we retain them throughout the relationship and applicable statutory periods. We then delete or anonymize them, subject to any required legal blocking period. Providers retain technical logs under their own policies.

If a security breach significantly affects your economic or moral rights, we will notify you immediately, under Article 19 of the LFPDPPP, about the incident, affected data, and protective actions and recommendations.

9. If you have a complaint

You may write to us through our contact form or contact the Secretaría Anticorrupción y Buen Gobierno, at www.gob.mx/buengobierno.

10. Changes to this notice

We will publish changes on this page with their date and version. If new authorizations are required for processing, we will request them beforehand.

Version 1.0, November 1, 2026

OrangeStudio cookie policy

Version 1.0, November 1, 2026

1. Cookies and local storage

Cookies are small files saved in your browser. Local storage saves information on your device without automatically sending it with every request. This policy covers both technologies and the site's external services.

We do not use analytics or advertising, or first-party cookies to track you or build profiles.

2. Necessary

• os-consent: the site's own localStorage key stores the format version, your choice about optional features and the date of that choice. It has no automatic expiry: it remains until you change your choice or clear site storage. It does not contain your name or email. If the browser prevents saving it, the choice lasts only for that page and we will ask again on another visit.
• Web3Forms and hCaptcha: enable form delivery and spam protection. Verification loads when you open the contact form. Their security services may use cookies, including __cf_bm where applicable, and hCaptcha technical storage. Names and lifetimes depend on the provider and session; not all are installed on every visit. These technologies are necessary to submit the form. If you block them, you can reach us by WhatsApp or book a conversation.

3. Functional

• Google Maps: the map loads automatically on Contact unless you rejected functional cookies. The cookie banner informs you of this use. To disable it, reject functional cookies in “Cookie preferences” in the footer. If you rejected them, you will see a notice with a “Load map” button that loads it for that page without changing your saved preference. Google may receive IP address and browser data and use cookies such as NID, AEC or SOCS depending on the session and its policies. Their names and lifetimes depend on Google.
• Cal.com calendar: a scheduling feature for checking availability and booking. The calendar shows available times automatically on Contact unless you rejected functional cookies; in that case you can press “Show available times” to load it for that visit only. Its queries do not send cross-site cookie credentials or store Cal.com cookies. It receives IP address, browser and time zone; we send name, email and notes only when you confirm a booking.

We do not use analytics or advertising categories. If introduced, we will update this policy and request your consent first.

4. Other services and policies

The WhatsApp button and Google Maps directions link open external services. Their own policies apply when you open them.

5. How to change your choice

Open “Cookie preferences” in any page's footer to change the functional category. Reject functional cookies to disable the map; saving that choice removes it and you can continue browsing. This control does not delete cookies Google has already saved. You can also block the map and delete or block cookies and storage in browser settings; some features may stop working.

6. Changes and contact

We will publish changes here with their date and version. For questions, write to the OrangeStudio Privacy Team through our contact form. See also the privacy notice.