PRIVACY NOTICE

This Appendix constitutes the Privacy Notice under the terms of the Federal Law on the Protection of Personal Data Held by Third Parties (the “LFPD”) and all requirements deriving or related to it. The present Privacy Notice has the following terms and conditions:

  1. Definitions. For the effects of this Privacy Notice, the following terms will have the meanings defined herein, on the understanding that, unless stated otherwise in this Appendix, the terms used that are not defined in this section will have the meanings used in the LFPD:

"Personal Information" has the meaning used in the LFPD.

"ARCO Rights" means the right of each user to access, rectify, cancel or oppose the use of their personal information, in accordance with the LFPD and subject to the exceptions established therein and in this Privacy Notice, as described below:

RIGHT OF ACCESS: This right of each User to know what personal information is held by the Administrator or their representatives, who this information has been shared with and to what end.

RIGHT OF RECTIFICATION: Each User has the right to rectify their personal information when it is inexact or incomplete.

RIGHT OF CANCELLATION: Each User has the right, at all times, to request that their personal information be deleted, which will occur at the expiration of a period in which their personal information is blocked. This block implies the identification and conservation of their personal information, once the use for which it was collected has been fulfilled, and has the purpose of identifying possible responsibilities involved in its treatment up until the contractual or legal limitation. Their personal information will not be handled during this period and will be deleted from the corresponding databases once this period has expired. Once the corresponding information has been deleted, the Administrator will notify the User. In the event that their personal information had been delivered to third parties prior to the date of the notification of rectification or cancellation, the Administrator will inform said third parties of the rectification or cancellation so they can carry it out.

RIGHT OF OPPOSITION: The User has, at all times, the right to request, provided they have just cause, that the Administrator stop handling their personal information.

"Administrator" means the person or party who receives the User’s personal information.

"User" means the person or party to whom the personal information corresponds, or the representative authorized to deliver their personal information to a third party, in accordance with all applicable laws, and who delivers said personal information to the Administrator.

  1. Consent of the User. Under the terms of the LFPD, particularly Article 17 (seventeen), each User states that: (i) they have been informed of this Privacy Notice by the Administrator prior to signing this Appendix, and (ii) signing this Appendix constitutes giving consent for their personal information to be handled under the terms of the LPFD and other applicable legislation. In the event that the personal information that the User provides to the Administrator under the terms of or for the fulfillment of this Appendix is sensitive, signing this Appendix constitutes giving consent for the User’s personal information to be handled under the terms of the LPFD and other applicable legislation.

This consent may be revoked by the User at any time, which does not have retroactive effects, under the terms and according to the procedures established below.

Notwithstanding any of the terms of this Privacy Notice, each User acknowledges that their consent is not required for the handling of their personal information by the corresponding Administrator or third party in any of the cases indicated in Article 10 (ten) of the LFPD.

  1. Objective of the Privacy Notice, Purpose of Collecting Personal Information. This Privacy Notice has the objective of establishing the terms and conditions under which the Administrator (or their designated representative): (i) receives and protects the personal information of the corresponding User in order to protect their privacy and their right to informational self-determination, in compliance with the terms of the LFDP, (ii) to use the aforementioned personal information, and (iii) to transfer this personal information to third parties, if applicable.

The Administrator will collect and handle the personal information of the User, that is, that information that can identify them: their first name and name; their date of birth; their address, whether personal, work or fiscal; their email address, whether personal or work; their social media handles; their phone number, whether home or work; their cell phone number; their credit card number; their Taxpayer Identification Number (RFC); their Population Registry Code (CURP); their Mexican Social Security Institute (IMSS) number; and their consumer and web browsing preferences. The collection of personal information may be carried out when the User visits the Administrator’s points of sale or those of their affiliates or authorized distributors; communicates with the Administrator or their representatives (including customer service centers) by telephone, email and/or text message (SMS); visits their websites and voluntarily provides information through the site’s dialogue boxes or through the use of automatic data capture methods; or by directly providing information to the administrator. These tools allow information to be sent to a website through the browser, such as the type of browser used, the User’s language, the access time, the IP address and the websites used to access the site of the Administrator or their affiliates or representatives.

The Administrator may also collect personal information from publicly available sources and other sources available on the market to which the User has given their consent to share their personal information, or to which they have provided anonymous geographical information associated with a determined geographic area.

The personal information of each User is collected and handled by the Administrator or their representatives to allow the User to carry out the following activities, whether in person, by phone or fax, printed forms, web-based forms or email:

The Administrator, whether directly or through their representatives, may also use the User’s personal information for the following purposes:

  1. Transfer of Personal Information. Each User states their express consent for the Administrator, or any of their representatives, to transfer their personal information to third parties, foreign or domestic, on the understanding that these third parties will handle the personal information in accordance with the terms of this Privacy Notice.

For the purposes established in this section, but subject to the terms of its last paragraph, the Administrator must inform each User that, with the goal of being able to deliver products, services and solutions to their clients, consumers, employees, suppliers and other users of their services, they and/or their representatives or affiliates have signed or will sign a variety of commercial agreements with providers of products and services, both foreign and domestic, to supply, among other services, landline telephone service, long distance telephone service, Internet, television, cell phone service and other telecommunication services. The authorization granted by each User, in accordance with this section, allows the Administrator and/or their representatives to transmit their personal information to these suppliers on the understanding that they are contractually obliged to maintain the confidentiality of the personal information provided by the Administrator and/or their representatives and to obey the terms of this Privacy Notice. The Administrator and/or their representatives may transfer the User’s personal information to their parent or controlling company, as well as the subsidiaries or affiliates under their control or any other company in the same corporate group, whether foreign or domestic, that operates with the same internal policies and procedures. They may also transfer this personal information to third parties that assist it in fulfilling its contractual or legal obligations towards the User.

Nevertheless, under the terms of this section and the Privacy Notice as a whole, the User acknowledges and accepts that the Administrator does not require their authorization nor their confirmation to transfer their personal information, domestically or abroad, in the cases established in Article 37 (thirty-seven) of the LFPD, or in any other exceptional case mentioned in the LFPD or other applicable legislation.

  1. Retention and Protection of Personal Information. The Administrator and/or their representatives will retain the User’s personal information for the time needed to process their requests for information, products and/or services, as well as to keep records for accounting, financial and auditing purposes under the terms of the LFPD and the current commercial, fiscal and administrative legislation. The personal information of the User that is collected by the Administrator and/or their representatives will be protected by administrative, technical and physical security measures appropriate to preventing their harm, loss, alteration, destruction or unauthorized use, access or handling, in accordance with the terms of the LFPD and related administrative regulations.

6. Department of Personal Information / Privacy Office; Management. The Administrator will make the Department of Personal Information / Privacy Office available to each User in order to receive, register and respond to their requests to exercise their ARCO rights, as well as their right to limit the use or transfer of their personal information, and all other rights mentioned in the LFPD.