Company: CTTRF
Filing Date: 2025-04-30
Form Type: 20-F
Source: 0001292814-25-001765
Chunk: 38

Company: Controladora Vuela Compania de Aviacion, S.A.B. de C.V.
Filing Date: 2025-04-30
Form: 20-F
Item: Item 3
Chunk 38
---
 We expect to be dependent on such third-party
arrangements for the foreseeable future.

Furthermore, our agreements with third parties are subject
to termination upon short notice. The loss or expiration of these contracts or any inability to renew them or negotiate and enter into
contracts with other providers at comparable rates could harm our business. Our reliance upon others to provide essential services on
our behalf also gives us less control over costs, and the efficiency, timelines and quality of contract services.

  30  

  Table of Contents  

Our processing, storage, use and disclosure of Personal Information, and
any actual or perceived failure to comply with applicable privacy and cybersecurity laws, could give rise to material liabilities that
impact on our business, results of operations and financial condition.

In the processing of our customer transactions and otherwise
running our business, we receive, process, transmit, and store substantial volumes of data that may be classified under various data privacy
laws as “personal data,” “personal information,” or “personally identifiable information,” or similar
terms under applicable data privacy laws (collectively, “ Personal Information”). Personal Information includes sensitive categories
of data (such as payment card information) managed by our reservation system provider, which purpose is to maintain compliance with the
Payment Card Industry Data Security Standard. This data is subject to legislation, regulation and other requirements intended to protect
the privacy of Personal Information that is collected, processed and transmitted. In addition, we or our service providers collect, retain
and otherwise process certain categories of Personal Information that are deemed particularly sensitive and subject to heightened legal
protection and requirements, such as biometrical information received from customers.

As a result, we must comply with a complex proliferating and
fast-evolving set of legal requirements in this area, including substantive cybersecurity standards requirements and obligations to notify
as well as requirements for notifying regulators and affected individuals in the event of a data security incident. The regulatory environment
is increasingly challenging and imposes obligations and risks on our business, including significantly expanded compliance burdens, costs
and enforcement risks. For example, Mexico’s Federal Personal Data Protection Law(Ley Federal de Protección de Datos
Personales en Posesión de los Particulares), the European Union’s General Data Protection Regulation (and the United
Kingdom’s equivalent regulation), and the California Consumer Privacy Act each impose data privacy and security requirements, imposing
significant costs on us and carrying substantial fines and penalties for non-compliance. Similar regulations have been (and may in the
future be) enacted