Privacy Notice

1. Who processes your data and which laws apply

Title Solutions de México, S.A. de C.V. and Title Solutions III, S.A. de C.V. (collectively, “Title Solutions,” “we,” or the “Data Controller”), with a registered address for receiving notifications at Plaza Progreso Interior 80, Carretera Federal Mz. 293, Lote 001-01, Colonia Ejido, Playa del Carmen, Quintana Roo, C.P. 77712, Mexico, are responsible for the processing of personal data collected to operate Ahead Legal at https://app.aheadlegal.io, manage accounts and subscriptions, and respond to contact or support requests.

Privacy contact: info@aheadlegal.io

This notice is issued in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties. Ahead Legal is offered to real estate professionals in Latin America. Therefore, in addition to Mexican law:

• If you reside or are located in another Latin American country, the data protection regulations of that country will also apply when they are relevant to the processing, including, but not limited to, Brazil's LGPD, Colombia's Law 1581 of 2012, Argentina's Law 25.326, Chile's Law 21.719 and Law 19.628, Peru's Law 29733, Uruguay's Law 18.331, Ecuador's LOPDP, Costa Rica's Law 8968, Panama's Law 81, and other local habeas data or personal data protection laws.
• When a local regulation grants you broader rights or stricter protection than this notice, that regulation will prevail regarding your data processing.
• This notice does not create rights that are not recognized by applicable law, nor does it limit those that are recognized by such law.

When a client organization uploads information about buyers, sellers, staff, or other contacts, that organization determines the purposes for that information and acts as the controller for those individuals. Title Solutions processes this information as a processor or operator, according to applicable law, to provide the contracted service and in accordance with the organization's instructions. This notice does not replace that organization's policy, notice, or authorization.

Title Solutions de México, S.A. de C.V. and Title Solutions III, S.A. de C.V. act as joint controllers regarding accounts, subscriptions, and platform operations. Requests regarding rights are handled via the email address indicated in this notice.

2. Scope

This notice applies when you:

• create or use an Ahead Legal account;
• contact us;
• upload, generate, or receive information in a real estate transaction managed with the service; or
• visit Ahead Legal pages that link to this notice.

3. Information processed

Account and business data: name, email, phone number, organization, branch, role, access credentials, and language preference.

Transaction data captured by authorized users: contact information, identification (e.g., official documents, CURP, or local equivalents), tax information (RFC, RUT, CUIT, RUC, or others), addresses, property information, financial and payment records, correspondence, uploaded files, and generated documents.

Subscription and billing data: plan, payment status, billing details, and payment processor references. Card charges are processed via Stripe. Ahead Legal does not store the full card number; it uses payment references and limited method information to manage billing.

Technical and support data: IP address, browser, device, access and activity logs, error information, and data included in support requests.

Data origin: the data subject themselves; their organization; counterparties or recipients of a transaction; the payment processor; and automated service tools (technical logs).

Sensitive, financial, or asset-related data. We do not require health data, religious beliefs, political opinions, ethnic or racial origin, sexual life, or biometric data to create an account. Real estate files may include official identification, tax information, and financial or asset-related data (payments, accounts, liens, deeds, or equivalents). Such data should only be uploaded if necessary for the transaction.

Client organizations must have the notice, authorization, or consent required by law from the data subject, especially when dealing with sensitive, minor, financial, or asset-related data. Because the data is sensitive, the data subject is not obligated to authorize its processing when the law classifies it as optional. Do not send identity documents or unnecessary sensitive data via support email.

Minors. Ahead Legal is not directed at children or adolescents. If a file includes data of a minor, the client organization must have the consent of the person exercising parental authority, guardianship, or legal representation, in accordance with applicable law.

4. How information is used and the legal basis for processing

Purposes necessary to provide the service or comply with a legal obligation

• creating and authenticating accounts;
• applying permissions by organization and role;
• storing and managing files;
• generating, signing, sending, and storing documents;
• sending operational communications requested by authorized users;
• managing subscriptions, billing, and collections;
• providing support;
• investigating errors, fraud, or misuse;
• protecting the security, integrity, and availability of the service;
• complying with legal, accounting, tax, notarial, or anti-money laundering obligations, where applicable;
• establishing, exercising, or defending legal claims.

These purposes are necessary for the service relationship. If the essential data is not provided, we will be unable to create the account or provide the contracted service.

Purposes requiring consent, authorization, or other voluntary basis

• sending marketing communications, product updates, or educational material not essential to the service;
• non-essential cookies, analytics, or tracking, when enabled;
• transfers to third parties that are not covered by a legal exception and require your consent.

You may decline these optional purposes without losing access to the contracted service.

Legal basis for processing by country. Depending on the applicable law, processing will be based on one or more of the following: performance of a contract or pre-contractual measures; compliance with a legal obligation; legitimate interest compatible with your rights, where recognized by law; prior, express, and informed consent or authorization, where required; and other bases provided for in local regulations. In Colombia, except for legal exceptions, processing requires prior, express, and informed authorization, which may be granted upon accepting this notice, creating an account, or by other verifiable and consultable means. In Mexico, financial or asset-related data requires express consent, and sensitive data requires express written consent when required by law. In Brazil, processing will be subject to a legal basis under the LGPD and, if applicable, a specific basis for sensitive data.

Use of the platform does not replace the consent or authorization required by law for the client organization regarding the data that said organization uploads.

5. Who may receive the information

Information is available to authorized users according to their organization, role, and permissions. Documents or messages may also be sent to buyers, sellers, lawyers, notaries, banks, trustees, and other recipients selected by an authorized user. The organization is responsible for verifying these recipients before sharing information.

Processors or operators. Providers that offer hosting, file storage, payment processing, email delivery, electronic signatures, and technical operations may process the information necessary for their services under instructions and with confidentiality and security obligations. These include, among others, Stripe for payments.

Transfers to third-party controllers. We do not sell personal data. We will disclose data to competent authorities when there is a legal obligation, a valid request, or to formulate, exercise, or defend legal claims. Transfers requiring your consent or authorization will only be carried out if you accept them, except for legal exceptions.

Transfer clause. Except for communications to recipients selected by you or your organization within the service, communications to processors or operators necessary to operate Ahead Legal, and those authorized or mandated by law, you may accept or reject any other transfer that requires your consent. Refusing voluntary transfers does not prevent you from using the contracted service, although it may limit features that depend on an external recipient of your choosing.

International transfers. Title Solutions is established in Mexico. Providers may process information in Mexico, the United States, or other countries. Such processing will be subject to applicable law and contractual and security safeguards, including contractual clauses or other mechanisms recognized by the competent authority when required (for example, the ANPD standard contractual clauses when processing is subject to the LGPD). By using the service or accepting this notice, you are informed that your data may be transferred and stored outside your country of residence.

6. Cookies and external resources

The application uses cookies and similar browser storage for session management, authentication, and interface functionality. You can delete or restrict cookies through your browser; however, doing so may prevent you from logging in or using the service normally.

Pages may load fonts or libraries from third-party providers, which receive technical data from the request, including the IP address.

Any non-essential cookie, analytics, or tracking tool that requires consent will be presented separately and will remain disabled until you accept it. You may withdraw that consent at any time.

7. Retention and security

We retain information while the account or file is active and for the additional periods necessary for billing, legal or accounting obligations, security, fraud prevention, and the exercise or defense of legal claims. For reference:

• account data: for the duration of the account and up to 3 years after its cancellation, unless a different legal obligation applies;
• transaction files and documents: the period required by the client organization, real estate, notary, tax, or anti-money laundering laws, and the statute of limitations for legal actions;
• technical and security logs: up to 24 months, unless an investigation is ongoing;
• billing data: applicable tax and accounting deadlines.

When information must be retained, its use will be limited to that purpose. Afterward, it will be deleted or blocked. Account cancellation, export, and deletion are governed by the Terms and Conditions and applicable law. Please contact us before canceling if you need to retrieve information.

We implement access controls and technical, administrative, and organizational measures to reduce unauthorized access, loss, alteration, or misuse. No system offers absolute security. Keep your credentials private, use the available security features, and report any suspected unauthorized access to info@aheadlegal.io.

If a security breach occurs that poses a significant risk to your rights, we will notify you and, when required by law, the competent authority as well, without undue delay.

8. Your rights and how to exercise them

Depending on the law of your country of residence or the place of processing, you may exercise, among others, the rights of:

• access or knowledge;
• rectification or updating;
• cancellation, suppression, or deletion;
• objection;
• revocation of consent or authorization;
• limitation or blocking of use or disclosure;
• portability, where recognized by law;
• not to be subject to a decision based solely on automated processing that produces legal effects or significantly affects you, where recognized by law;
• request proof of your authorization, be informed of how your data is used, and file a complaint or claim with the local authority.

Ahead Legal does not make decisions with legal effects based solely on automated processing. Document generation requires action from an authorized user.

How to submit your request. Send an email to info@aheadlegal.io with the subject line “Privacy Request,” or submit it in writing to the address provided, addressed to Ahead Legal Privacy. Please include:

• full name;
• country of residence;
• a method for receiving a response;
• the right you wish to exercise;
• a clear description of the data;
• for rectifications, the requested change.

We will instruct you on how to verify your identity or representation through an appropriate channel. If the request is incomplete, we will ask for the missing information. Exercising these rights is free of charge, except for justified shipping or reproduction costs permitted by law.

We will respond to your request within the timeframe established by applicable law. If that law does not set a shorter period, we will endeavor to respond within a maximum of 30 calendar days, which may be extended once when justified by complexity and permitted by regulation. Revocation does not affect prior lawful processing. Legal, contractual, accounting, or record-keeping obligations may limit deletion or restriction.

Limitation of use or disclosure and opting out of voluntary communications. To limit the use or disclosure of your data, or to opt out of marketing communications, please email info@aheadlegal.io with the subject line “Data use limitation” or use the unsubscribe link included in the message. This refusal does not affect the necessary purposes of the service.

If a client organization provided your data, please contact that organization first. If you write to us, we can help identify them and collaborate within our capacity as a processor or operator.

Authorities. In addition to contacting us, you may reach out to the authority in your country, including:

• Mexico: Secretariat of Anti-Corruption and Good Governance;
• Brazil: National Data Protection Authority (ANPD);
• Colombia: Superintendency of Industry and Commerce (SIC);
• Argentina: Agency for Access to Public Information (AAIP);
• Chile: Agency for Personal Data Protection;
• Peru: National Authority for Personal Data Protection;
• Uruguay: URCDP;
• Ecuador: Superintendency of Personal Data Protection;
• Costa Rica: PRODHAB;
• and the relevant local authority in other countries.

9. Changes

The current notice is published on this page with its update date. Substantial changes will be communicated via the service or the account email, as applicable. When a change requires new consent or authorization, we will request it before applying the new processing. Continued use of the service after a change that does not require new consent implies that you have acknowledged the updated notice, without prejudice to the rights granted to you by law.

10. Contact

Questions regarding this notice or the processing of your information: info@aheadlegal.io

Address: Plaza Progreso Interior 80, Carretera Federal Mz. 293, Lote 001-01, Colonia Ejido, Playa del Carmen, Quintana Roo, 77712, Mexico.