PRIVACY NOTICE
In compliance with applicable data protection regulations, Pulsar Labs (Limited Liability), its subsidiaries, affiliates, and/or related parties (“Sovra”), with its legal address at PO Box 10008, Willow House, Cricket Square, Grand Cayman, KY1-1001, Cayman Islands, website: https://sovra.io (the “Website”), holder of the rights to the Sovra technological platform (the “Platform”), and contact email info@sovra.io (the “Contact Email”), hereby makes available this:

PRIVACY NOTICE
In order to ensure the legitimate, controlled, and informed processing of your personal data, whether provided to us currently or in the future, stored in our databases, or collected through cookies or other web tracking technologies, and to guarantee your privacy and right to informational self-determination, Sovra is responsible for the use and protection of your personal data. Such data will be processed in accordance with principles of lawfulness, consent, information, quality, purpose, fairness, proportionality, and accountability, as required by applicable regulations.

USE OF INFORMATION
The information you provide through access, registration, or creation of a user profile on the Website and/or the Platform, and/or via email, and/or public key, and/or physical or electronic forms or surveys—whether in real-time or historically—will be processed and structured to generate data indicators that Sovra may use to make business decisions. All data collected will be used for generic, non-personalized statistical purposes and in connection with the growth, maintenance, and administration of Sovra, while respecting your privacy at all times. These purposes include internal operations and administration, communication with you, and fulfillment of service and/or product requests provided by Sovra, as well as the improvement, development, enhancement, and provision of Sovra services through its related parties, affiliates, authorized providers, and/or business partners. Adequate measures will be implemented to limit the use of collected data exclusively for authorized and lawful purposes under this Notice, with appropriate confidentiality and security safeguards. Sovra may also collect your IP (Internet Protocol) address to help diagnose issues with Sovra’s server and administer the Website and Platform. An IP address is assigned to your device when using the Internet and may be used to identify you during a session or to collect general demographic information. Sovra may also use “push” technology via applications to send notifications, subject to prior user authorization. This communication channel does not access any other functions or information on the device. Information collected may include the URL from which you arrive (whether or not on the Website), subsequent URLs accessed, browser type, pages visited, searches conducted, posts, commercial preferences, messages, etc.

USE OF COOKIES
Sovra informs you that, through the use of cookies and similar technologies, we seek to ensure optimal user experience on the Website and/or Platform by providing personalized information, remembering service and marketing preferences, and helping you access relevant information. For additional details regarding the use of cookies and similar technologies, Sovra makes its Cookie Use Policy available.

1. PERSONAL DATA REQUESTED
Sovra, and/or its controlling companies, and/or subsidiaries, and/or affiliates, and/or related parties, and/or third parties that, due to a commercial relationship with Sovra, have contracted the use of the Platform to complement their service offering and require the processing and/or use of your personal data (“Client” or “Public Entities” interchangeably), may collect general personal data as well as data considered sensitive under applicable law (hereinafter “General Personal Data” and “Sensitive Personal Data,” collectively referred to as “Personal Data”). Sensitive Personal Data may be requested electronically or physically. Any information provided in physical format will be treated under the same terms as if provided electronically on the Website and governed by this Notice. Sovra collects Personal Data in good faith for the purposes described herein. Therefore, it is presumed that all data provided by its owner is accurate and complete and remains the responsibility of the individual providing it. Personal Data collected from Platform Users—whether Public Entities or their Administrators (individuals representing the Public Entity and responsible for the process of requesting, selecting, and acquiring Platform services, as well as managing services and information provided to Citizens through the Platform), or individuals and/or legal entities seeking to carry out a process or request a service through Public Entities using the Platform (“Citizens”)—consists of information included or to be included in forms, lists, databases, or other physical and/or electronic media necessary for Sovra to provide Platform services and consolidate the catalog of processes and services offered by Public Entities to Citizens via the Platform.

A) PUBLIC ENTITIES AS PLATFORM USERS
The Personal Data collected from Public Entities using the Platform is necessary to document the existing or potential commercial and legal relationship. The Personal Data you voluntarily provide to Sovra may be included in contracts, letters, forms, lists, databases, or other physical and/or electronic means, as appropriate, enabling Sovra to document the relationship between the parties, the process of using and selecting the Platform Modules, maintain adequate records of the commercial relationship with Citizens as end-users of the Public Entities using the Platform, and fulfill internal policies, procedures, and applicable legal obligations. The Personal Data requested from Public Entities through their Administrators for registration as Platform users includes: Legal name of the Public Entity to be registered City and jurisdiction of the Public Entity Tax identification number (e.g., RFC or jurisdictional equivalent) Institutional size range and digital identification certificate (if applicable) Name of the Public Entity Administrator Position held within the Public Entity Corporate phone number and/or mobile number Official email address

B) CITIZENS AS PLATFORM USERS
The Personal Data Citizens provide voluntarily through the Platform may be included in contracts, forms, lists, databases, or other physical and/or electronic means in the Platform Modules, as applicable, to document their use and selection of Platform Modules, maintain effective records of interaction with Public Entities using the Platform, and comply with internal policies, procedures, and applicable legal obligations. The Personal Data requested from Citizens includes: Full name Date of birth Address (including external and internal number, street name, cross streets, neighborhood, city, state, postal code, and identifiable references) Landline and/or mobile phone number National identification code (e.g., CURP or equivalent) Tax identification number (if applicable) Specific information required for the process being executed in the Platform Modules, such as identity, passport and migration, education, health, employment, taxes and contributions, security, justice, social programs, energy, economy, housing, environment, transportation, financial services, tourism, etc. Digital copies of documents required to prove identity and nationality, such as official identification, proof of address, birth certificate, among others Banking data for payment processing related to requests made through Public Entities Public key or decentralized digital identity All Citizen Personal Data is processed by Sovra and stored in a repository for exclusive use, management, and administration by the corresponding Public Entity. As the Platform is a data processing tool used by the Public Entity to configure and provide services to Citizens, Sovra does not intervene in the subsequent processing of such data, which remains subject to the Privacy Notice issued by each Public Entity for this purpose.

2. PURPOSES OF PROCESSING PERSONAL DATA
The Personal Data provided to Sovra through the Platform will be used as previously outlined, specifically to: a. Process data that enables the creation of user records and service requests by Citizens requiring services from Public Entities through the Platform as a communication tool. b. Allow the Public Entity to evaluate, manage, and fulfill Citizen service requests. c. Process payment information for fees or service charges requested by Citizens through payment engines provided by Public Entities. Once the purposes of processing have been fulfilled, and in the absence of legal obligations requiring otherwise, Sovra will proceed with the cancellation, deletion, and/or destruction of received Personal Data under applicable regulations. The processing performed by Public Entities and payment engines regarding Citizen Personal Data will be subject to the terms and conditions of the Privacy Notices issued by such Public Entities or available on the websites of third-party payment providers.

3. TRANSFER OF PERSONAL DATA AND INFORMATION
Personal Data and Information of Citizens collected through the Platform will be processed and transferred to Public Entities with which Sovra has a legal and contractual relationship, as the primary recipients of such data to deliver services directly to Citizens. Likewise, Sovra may transfer this information to: (i) third parties (such as parent companies, subsidiaries, affiliates, or related parties) and/or business partners that have entered into contracts to offer or promote products and/or services via the Platform (e.g., technical support services); (ii) judicial or governmental authorities, domestic or international, to comply with applicable laws, legislation, notifications, or judicial requirements; (iii) internet service providers hosting the Platform or Sovra’s technological infrastructure. In cases where explicit consent is legally required for transferring Personal Data, Sovra will inform you accordingly to obtain such consent. Sovra will inform these third parties of this Privacy Notice and ensure, through agreements or equivalent binding documents, that such parties maintain the necessary administrative, technical, and physical security measures to safeguard Personal Data and use it only for the purposes for which it was collected. Likewise, Public Entities, Sovra, and any individual with access to Personal Data shall be bound by the same confidentiality and security standards and prohibited from disclosing or misusing such information, or they shall be held responsible under applicable law. Notwithstanding the above, Sovra will not transfer your Personal Data to unrelated third parties except as mentioned above or as allowed by law, without your prior consent.

4. MEANS AND PROCEDURES TO EXERCISE ARCO OR EQUIVALENT RIGHTS
As the owner of Personal Data provided to Sovra, you may request at any time the exercise of your rights of access, rectification, cancellation, or opposition (the “ARCO Rights,” or equivalent under applicable data protection regulations), which include: (i) accessing your Personal Data and details of its processing; (ii) rectifying inaccurate or incomplete data; (iii) canceling your data when it is no longer required for the purposes stated in this Privacy Notice, when used for non-consented purposes, or when your contractual or service relationship with Sovra has ended; and (iv) opposing the processing of your Personal Data for specific purposes. To exercise your rights, you must submit a written request to Sovra or send it to the Contact Email, containing at least the following information: (a) full name and address or another suitable means for communication; (b) documents proving your identity or, where applicable, that of your legal representative; (c) a clear and precise description of the Personal Data concerning which you seek to exercise your rights; and (d) any other element or information facilitating the location of the Personal Data, as well as any documentation required by applicable regulations when submitting the request. You may also contact the Contact Email for further information on the procedure to exercise your ARCO Rights. Sovra will respond to your request within the timeframes established by applicable data protection laws. You may also follow up on your request and response timeframe by contacting Sovra via the Contact Email, where any clarification or question regarding data processing or exercise of ARCO Rights will be addressed.

5. REVOCATION OF CONSENT; LIMITATION OF USE AND DISCLOSURE OF PERSONAL DATA
You may revoke your consent to Sovra’s processing of your Personal Data or request limitations on its use or disclosure, provided that such revocation does not conflict with legal obligations. To do so, you must submit your written request in the same manner described in Section 4 above. Sovra will respond to your request in accordance with applicable timelines under relevant laws. You may obtain further information about the status of your request and the response timeframe by contacting Sovra at the Contact Email. If your Personal Data was shared before the date of consent revocation and is still being processed by Sovra’s processors, Sovra will inform them of the revocation so that they take appropriate action.

6. CHANGES TO THE PRIVACY NOTICE
Sovra reserves the right to modify and/or update this Privacy Notice, in whole or in part, at its sole discretion. Any changes will be communicated here on the Website and/or the Platform, and, when required for specific users, through internal networks, written notices placed in visible areas, or via email communication.

7. DIGITAL, ELECTRONIC OR ONLINE FORMAT The parties agree that their agreement may be validly executed in digital, electronic, or online format, whereby acceptance expressed through the Website or Platform, together with the provision of Personal Data, shall suffice without requiring a physical signature.

Date of first issuance: September 1, 2025