COMPREHENSIVE PRIVACY NOTICE – ST JUDE SCHOOL INTERNATIONAL

St Jude School (hereinafter the "School" or "We") is the Data Controller responsible for the processing and protection of your Personal Data and, as such, provides you ("You") with this PRIVACY NOTICE in accordance with the Law on the Protection of Persons Against the Processing of Their Personal Data, No. 8968, of July 7, 2011 (hereinafter, the "Law") and its Regulation (Executive Decree 37554-JP, hereinafter, the "Regulation"). Terms used in this Privacy Notice will have the meaning assigned to them by the Law, unless expressly defined otherwise in this document.

This Privacy Notice (hereinafter the "Notice") applies to the personal data that the School collects from students and prospective students, their parents, guardians and/or legal representatives, in connection with the comprehensive educational services it offers.

1.- Personal Data We Will Process:

1.1. The School will process the following personal data directly and/or through Data Processors, including the external service providers described in Section 4 below:

1.1.1. Prospective students of the School: name, image, voice, date and place of birth, official identification or passport, gender, nationality, signature, email address, address, school grade for which they are interested in enrolling, previous school, father's name, mother's name, guardian's name (if applicable), legal representative's name (if applicable), landline and mobile telephone numbers.

1.1.2. Students of the School: name, image, voice, date and place of birth, official identification or passport, gender, nationality, signature, email address, address, grade in which they enroll or re-enroll, father's name, mother's name, guardian's name (if applicable), legal representative's name (if applicable), landline and mobile telephone numbers, names of the people they live with, number of siblings, school grade and school attended by siblings. Information contained in the following documentation: official photo identification, photographs, report card for the immediately preceding grade and final report card for the current school year, no-debt letter from the previous school, proof of payment for books and materials (if applicable), school certificates (if applicable), birth certificate, vaccination card (if applicable).

Sensitive personal data of students (provided by their parents, guardians and/or legal representatives): blood type, birth weight, immediate neonatal complications, APGAR score, gestational age, development psychomotor, speech disorders, health conditions, illnesses suffered and/or currently suffered, surgeries, hospitalizations, accidents, transfusions, vision problems, hearing problems, current treatment, vaccines received, allergies, intolerances, family medical history (illnesses suffered and/or currently suffered by grandparents, father, mother, siblings, aunts, uncles and cousins), and psychological health status.

1.1.3. Father, mother, guardian and/or legal representative of the students: name, image, voice, photograph, occupation, employer, signature, date of birth, official identification (identity card, passport or equivalent identification document), gender, nationality, marital status, number of children, profession, address, whether or not they share the same address as the student, landline and mobile contact numbers, email addresses, name of alternate contact person, alternate contact telephone. Billing information: name or corporate name, official identification or passport, email for sending electronic invoices, tax address, whether or not it is the same address as the student, tax information and bank account information, where applicable, payment information when necessary to process tuition and other school fees, no-debt letters (for students transferring from other institutions). Information contained in the following documentation: official photo identification, banking data and proof of address.

Sensitive personal data of the father, mother, guardian and/or legal representative: religious affiliation, health status.

You declare, under oath, that the information you have provided to the School is true, current and correct. You likewise agree to hold the School harmless from any claim and/or demand arising from errors in the information you have provided.

1.2. The School may obtain the personal data of the Data Subject: (i) from publicly accessible sources, for the purpose of validating, updating and contacting the Data Subject, always respecting the reasonable expectation of privacy referred to in the Law; (ii) through third parties authorized by the Data Subject to transfer such data and/or as permitted by the Law.

1.3 The School will use the IP (Internet Protocol) address to analyze any type of threat, as well as to collect demographic information. However, IP information will under no circumstances be used to identify Data Subjects, except where there is a likelihood of fraudulent activity.

2.- Use of "Cookies" and "Web Beacons":

The School's websites use cookies, web beacons, pixels and similar technologies to improve website functionality, optimize the user experience, analyze site traffic, measure the effectiveness of communications and marketing campaigns, and maintain website security.

The School uses a consent management platform ("CMP") to allow users to manage their cookie preferences. Through the cookie banner displayed when accessing the websites, users may accept, reject or configure the use of non-essential cookies at any time.

The cookies used on the websites may include, among others:

• Strictly necessary cookies;

• Functional cookies;

• Analytics cookies;

• Marketing cookies.

The School also uses certain third-party technologies, including Google Analytics 4 (GA4), Google Tag Manager (GTM), Google Ads, Meta and HubSpot technologies, which may collect information about users' interactions with the websites for analytics, advertising, communication and website performance purposes.

Users may modify their cookie preferences at any time through the "Privacy Settings" option available on the School's websites.

For more information about the specific cookies used on the School's websites, their purposes, providers, retention periods and how to manage your preferences, see the Cookie Settings available through the cookie banner displayed on the websites.

3.- Purposes of Personal Data Processing:

3.1 The School, either directly or through its Data Processors, will process the Data Subject's personal data, in accordance with the nature of its relationship with the Data Subject, for the following primary purposes:

3.1.1 With respect to prospective students:

• Contact the Data Subject, parents, guardians, legal representatives and/or representatives of the previous school by email, telephone or any other physical or electronic means, in order to answer questions about availability and enrollment requirements at the School, as well as to request references about their performance at the previous educational institution;

• Keep records in the School's databases with the information of parents, guardians and/or legal representatives who contact the School by telephone or email to make inquiries or request quotes for educational services, for follow-up purposes. These records will be stored electronically for a period of 1 (one) year from the date of collection, in case the School has not provided services.

3.1.2 With respect to the student:

• Identify the student and process their initial enrollment or re-enrollment at the School;

• Create the student's file and academic record, in both physical and electronic format. Such file will be kept throughout the student's relationship with the School and for up to 10 (ten) years after that relationship ends. If the student's relationship with the School terminates and there is an express request for cancellation or deletion from the Data Subject, the procedure described in the Law will be followed, within the time limits it provides; Provide the comprehensive educational services it offers, whether in person or online;

• Creation of a student database for administrative and/or academic purposes, kept for the same period described above, subject to the exception indicated, and which, during the educational relationship, will include the student's sensitive personal data relating to their health status, since keeping such data is justified by the legitimate purpose of providing medical assistance if needed during classes and/or activities related to the services provided by the School. Once that relationship ends, this database will no longer include the student's sensitive personal data, which will be deleted immediately.

• Respond to requests for information about the educational or administrative services provided by the School;

• Verify the authenticity of the documentation submitted by the Student and/or their parents, guardians or legal representatives;

• Review scholarship applications for orphans and educational scholarships submitted by Students;

• Issue degrees, diplomas, certificates and any other documentation in favor of students certifying the completion of their studies;

• Take out school accident insurance;

• Transmit the information requested by the Ministry of Public Education to validate and recognize students' studies;

• Notify Students about the School's academic, cultural and institutional activities;

• Comply with the legislation applicable to educational services in the Republic of Costa Rica;

• Request socioeconomic studies for the granting of scholarships, and

• Provide them with medical care in case of emergencies.

3.1.3 Of the student's father, mother, guardian or legal representative:

• Contact the parents by any means, by telephone or email, to respond to and follow up on their requests for information and on the educational services offered by the School;

• Contact the Data Subject by any means to provide clarifications and follow up on payments or any other situation arising from the educational services provided by the School, such as complaints or comments about them;

• Contact the Data Subject to manage and collect outstanding debts;

• Register the information of the father, mother, guardian and/or legal representative in the School's accounting and enterprise resource planning (ERP) systems (currently NetSuite or any successor platform), or any system that may replace it in the future, to allow authorized personnel to access personal data;

• Respond to questions, comments or requests for information about the educational or administrative services provided by the School;

• Issue electronic invoices and credit notes arising from the educational services offered by the School. Such invoices, in physical and electronic format, as well as credit notes, will be kept by the School during the commercial relationship and for 10 (ten) years after it ends;

• Contact the Data Subject by email to respond to and follow up on their comments or requests submitted through the "Contact" section of the School's website;

• Carry out transactions with credit and/or banking institutions arising from the contractual relationships entered into between the Data Subjects and the School;

• Coordinate meetings by telephone, email or any other means, whether in physical or digital format, in connection with the educational services provided by the School;

• Request socioeconomic studies to analyze situations related to students' scholarship applications regarding tuition or re-enrollment;

• Send notifications about students' academic status to the Data Subject by any means, whether physical or electronic;

• Create a record in the database of parents, guardians and/or legal representatives of the School's students, which will be kept during the provision of educational services and for one (1) year after they end, and which will not include sensitive personal data. The data in this database will be deleted before the indicated period upon express request by the Data Subject; and

• Contact them to notify any emergency and/or situation related to the students.

• Process tuition and fee payments, reconcile payment settlements, monitor and prevent fraudulent transactions, provide customer support related to payments, and manage chargebacks, in each case directly and/or through the School's Data Processors.

3.2 With respect to the personal data it collects, the School undertakes to observe the principles of lawfulness, purpose, fairness, consent, data quality, proportionality, information and accountability, as required by the Law on the Protection of Personal Data.

3.3 The School will delete the Data Subject's personal data once the purposes for which it was collected have been fulfilled, except in cases where this Notice establishes a different specific period, or where a specific period is required for the exercise of rights or obligations, or where otherwise provided by applicable law.

3.4 The Data Subject's personal data may be used for the following secondary purposes:

• Create a record in the School's "Contacts" database, which will be kept for 10 (ten) years from the date of collection, without including sensitive personal data. The data in this database will be deleted before the indicated period upon express request by the Data Subject; and

• Create a database of School alumni for the purpose of organizing meetings and other social activities. This database will be kept indefinitely and will not include sensitive personal data. The data in this database will be deleted upon express request by the Data Subject; and;

• Generate internal reports on the use of the School's website;

• Send newsletters on topics related to School activities that may be of interest to the school community;

• Evaluate the quality of the educational services offered;

• Prepare statistical reports using data that has been dissociated from its Data Subjects;

• Record audio and video, and take photographs of the various events held by the School both inside and outside its facilities, and use such material for illustrative, promotional, marketing or advertising purposes, through electronic and/or print media. The material mentioned above will be kept by the School for the duration of the promotional campaign or until the purposes of this Notice have been fulfilled, whichever occurs first; and

• Send information and promotions to Data Subjects about new academic offerings provided by the School.

3.5 If the Data Subject does not want the School to use their personal data for the secondary purposes set out in Section 3.4, the Data Subject may submit a request not to be subject to processing for secondary purposes through the department and contact channel identified in Annex A of this Notice.

4.- Data Processors and International Processing:

4.1 In order to provide certain administrative, financial, technological and payment-related services, the School has engaged specialized external service providers acting as Data Processors, who process personal data solely on behalf of the School, under its instructions and exclusively for the purposes described in this Notice.

4.2 These Data Processors provide services including: payment processing, settlement reconciliation, fraud monitoring, payment customer support, chargeback management, and outsourcing of information technology, as well as support in finance and procurement and, where applicable, other administrative business support services. With respect to the information technology outsourcing service, the School's Data Processors may have technical access to the platforms and systems where the School's administrative and academic records are hosted. Access to personal data is in all cases limited to what is strictly necessary for the Data Processor to provide the contracted service, in accordance with the data minimization principle, and does not authorize the Data Processor to use personal data for any purpose other than those described in this Notice.

4.3 Some of these Data Processors may provide services from abroad, including, but not limited to, Mexico, and others from the United Kingdom, the European Economic Area, India and other countries..

4.4 The School's contract with its Data Processors includes specific data protection and information security annexes that require them, among other obligations: (i) to process personal data only for the purposes and in accordance with the instructions given by the School; (ii) to implement appropriate administrative, technical and physical security measures for the personal data processed, including access controls, encryption in transit and at rest, and continuous monitoring; (iii) to maintain the confidentiality of personal data, even after the service contract ends; (iv) to refrain from subsequently transferring or subcontracting the processing of personal data without the School's prior authorization; (v) to notify the School immediately of any security incident affecting personal data; and (vi) to delete or return personal data upon termination of the applicable service contract, according to the School's instructions. Where applicable to personal data originating in the United Kingdom or the European Economic Area, the contract incorporates recognized international transfer safeguards. Likewise, where required by the laws governing personal data originating outside Costa Rica, the School and its Data Processors implement the corresponding international data transfer safeguards.

4.5 For the avoidance of doubt, the services described in this Section do not include the processing of the School's employees' personal data, which is addressed in the Employee Privacy Notice, separate from this Notice.

5.- Person Designated to Process Requests:

5.1 If the Data Subject wishes or needs to revoke their consent, or to access, rectify, cancel or object to the processing of the personal data they have provided, they must do so through the department designated by the School for this purpose. The department and contact channel designated by St Jude School are identified in Annex A of this Notice.

5.2 The School will keep the designation established in Annex A up to date. Any change to the designated department or contact channel will not require amending the substantive provisions of this Notice, and notice of the change will be sufficient.

6.- Means to Revoke Consent:

The Data Subject may revoke the consent granted by accepting this Notice. Such revocation must be carried out according to the following procedure:

6.1 Send an email to the contact designated in Section 5.1 of this Notice, through which such requests will be handled.

6.2. The request must indicate:

6.2.1. The Data Subject's full name and address, to receive the response to their request;
6.2.2 The reason for the request;
6.2.3 The grounds supporting the request;
6.2.4 An official document proving identity and confirming that you are who you say you are; and,
6.2.5 The date from which the revocation of consent takes effect.

6.3 The School will communicate its decision on the request within a maximum of five (5) business days from receipt of the complete request, a period that may be extended once for an equal period when the circumstances of the case justify it, in accordance with the Law on the Protection of Personal Data. If the request is granted, the School will give effect to the revocation within five (5) business days.

7. Means to Exercise the Rights of Access, Rectification, Cancellation and/or Objection ("ARCO"):

7.1 If the Data Subject needs to access, rectify, cancel or object to the personal data they have provided to the School, they must follow the procedure below.

7.2 Send an email to the contact designated in Section 5.1 of this Notice, including:
7.2.1 The Data Subject's full name, address and email address to receive the response;
7.2.2 The reason for the request;
7.2.3 The grounds supporting the request;
7.2.4 An official document proving the identity of the applicant;
7.2.5 A clear and precise description of the personal data with respect to which the Data Subject seeks to exercise any ARCO right; and
7.2.6 In the case of rectification requests, the changes to be made and the supporting documentation.

7.3 The School will communicate its decision within a maximum of five (5) business days from the date the complete request is received, a period that may be extended once for an equal period when the circumstances of the case justify it. If the request is granted, the School will give effect to it within five (5) business days. The exercise of ARCO rights is free of charge, except for reproduction, copying or sending costs, in accordance with the Law. In the case of requests for access to personal data, the data will be provided after verifying the identity of the applicant or their legal representative, as applicable.

8. Transfer of Personal Data:

8.1 The School will not transfer or share the personal data referred to in this Notice with third parties, except in the cases described below or when ordered by a competent authority or applicable law.

8.2 In compliance with its legal obligations, and for the Data Subject's knowledge, the School may make the following transfers:

• To the Ministry of Public Education or the corresponding state educational authority, in order to comply with the School's legal obligations in providing its educational services.

• To the Tax Administration, in order to comply with tax legislation, as well as for the payment of taxes and the management of tax compliance records.

• To banking institutions, in order to collect or pay for the products and/or services required or offered by the School to its students;

• To authorities, private and/or government institutions, as well as official bodies within the Republic of Costa Rica, in order to provide the services offered by the School;

• To judicial authorities and attorneys external to the School for the recovery of debts and the management of litigation;

• In case of outstanding debts, to private entities responsible for collecting overdue payments;

• To parent companies, subsidiaries or affiliates under the common control of, or within the same corporate group as, International Schools Partnership, operating under common internal processes and policies; and

• To the new educational institution where the Data Subject will enroll, if requested by the parents or guardians.

8.3 Except in the cases described in Section 8.2 above, for which the Law does not require the Data Subject's consent, to the extent they are necessary to comply with a legal obligation, take place between companies of the same corporate group operating under common policies, or fall under another applicable legal exception, any other transfer of personal data to third parties (other than the Data Processors described in Section 4) will require the Data Subject's prior consent.

9.- Amendments:

9.1 The School reserves the right to modify or update this Privacy Notice at any time, to reflect changes in applicable legislation, its personal data processing activities, or its internal privacy practices. Any updated version will be published on the School's official website and will take effect upon publication, unless applicable law requires otherwise.

ANNEX A — School Information and Privacy Contact

This Annex forms part of the Comprehensive Privacy Notice of St Jude School and identifies the contact details of the department responsible for receiving and processing requests related to the exercise of data protection rights under the Law on the Protection of Persons Against the Processing of Their Personal Data, No. 8968, of July 7, 2011, including requests to exercise ARCO rights, revoke consent where applicable, or submit questions about the processing of personal data.

School Information and Privacy Contact Details