PRIVACY NOTICE

This Appendix constitutes the Privacy Notice under the terms of the Federal Law on the Protection of Personal Data Held by Third Parties (the “LFPD”) and all requirements deriving or related to it. The present Privacy Notice has the following terms and conditions:

1. Definitions. For the effects of this Privacy Notice, the following terms will have the meanings defined herein, on the understanding that, unless stated otherwise in this Appendix, the terms used that are not defined in this section will have the meanings used in the LFPD:

"Personal Information" has the meaning used in the LFPD.

"ARCO Rights" means the right of each user to access, rectify, cancel or oppose the use of their personal information, in accordance with the LFPD and subject to the exceptions established therein and in this Privacy Notice, as described below:

RIGHT OF ACCESS: This right of each User to know what personal information is held by the Administrator or their representatives, who this information has been shared with and to what end.

RIGHT OF RECTIFICATION: Each User has the right to rectify their personal information when it is inexact or incomplete.

RIGHT OF CANCELLATION: Each User has the right, at all times, to request that their personal information be deleted, which will occur at the expiration of a period in which their personal information is blocked. This block implies the identification and conservation of their personal information, once the use for which it was collected has been fulfilled, and has the purpose of identifying possible responsibilities involved in its treatment up until the contractual or legal limitation. Their personal information will not be handled during this period and will be deleted from the corresponding databases once this period has expired. Once the corresponding information has been deleted, the Administrator will notify the User. In the event that their personal information had been delivered to third parties prior to the date of the notification of rectification or cancellation, the Administrator will inform said third parties of the rectification or cancellation so they can carry it out.

RIGHT OF OPPOSITION: The User has, at all times, the right to request, provided they have just cause, that the Administrator stop handling their personal information.

"Administrator" means the person or party who receives the User’s personal information.

"User" means the person or party to whom the personal information corresponds, or the representative authorized to deliver their personal information to a third party, in accordance with all applicable laws, and who delivers said personal information to the Administrator.

2. Consent of the User. Under the terms of the LFPD, particularly Article 17 (seventeen), each User states that: (i) they have been informed of this Privacy Notice by the Administrator prior to signing this Appendix, and (ii) signing this Appendix constitutes giving consent for their personal information to be handled under the terms of the LPFD and other applicable legislation. In the event that the personal information that the User provides to the Administrator under the terms of or for the fulfillment of this Appendix is sensitive, signing this Appendix constitutes giving consent for the User’s personal information to be handled under the terms of the LPFD and other applicable legislation.

This consent may be revoked by the User at any time, which does not have retroactive effects, under the terms and according to the procedures established below.

Notwithstanding any of the terms of this Privacy Notice, each User acknowledges that their consent is not required for the handling of their personal information by the corresponding Administrator or third party in any of the cases indicated in Article 10 (ten) of the LFPD.

3. Objective of the Privacy Notice, Purpose of Collecting Personal Information. This Privacy Notice has the objective of establishing the terms and conditions under which the Administrator (or their designated representative): (i) receives and protects the personal information of the corresponding User in order to protect their privacy and their right to informational self-determination, in compliance with the terms of the LFDP, (ii) to use the aforementioned personal information, and (iii) to transfer this personal information to third parties, if applicable.

The Administrator will collect and handle the personal information of the User, that is, that information that can identify them: their first name and name; their date of birth; their address, whether personal, work or fiscal; their email address, whether personal or work; their social media handles; their phone number, whether home or work; their cell phone number; their credit card number; their Taxpayer Identification Number (RFC); their Population Registry Code (CURP); their Mexican Social Security Institute (IMSS) number; and their consumer and web browsing preferences. The collection of personal information may be carried out when the User visits the Administrator’s points of sale or those of their affiliates or authorized distributors; communicates with the Administrator or their representatives (including customer service centers) by telephone, email and/or text message (SMS); visits their websites and voluntarily provides information through the site’s dialogue boxes or through the use of automatic data capture methods; or by directly providing information to the administrator. These tools allow information to be sent to a website through the browser, such as the type of browser used, the User’s language, the access time, the IP address and the websites used to access the site of the Administrator or their affiliates or representatives.

The Administrator may also collect personal information from publicly available sources and other sources available on the market to which the User has given their consent to share their personal information, or to which they have provided anonymous geographical information associated with a determined geographic area.

The personal information of each User is collected and handled by the Administrator or their representatives to allow the User to carry out the following activities, whether in person, by phone or fax, printed forms, web-based forms or email:

• a)  Requesting, purchasing, exchanging or returning products;
• b)  Requesting, contracting, changing or cancelling services;
• c)  Making payments online;
• d)  Requesting an invoice or digital tax receipt;
• e)  Requesting an estimate, information or free samples of products and services;
• f)  Requesting the delivery, repair or fulfillment of a warranty for products;
• g)  Requesting services or demanding that service agreements be kept;
• h)  Contacting the Customer Service department;
• i)  Receiving printed or electronic advertising, including communications for online market research, or telemarketing;
• j)  Creating personal profiles;
• k)  Participating in surveys;
• l)  Using the different services provided by the Administrator’s websites, including downloading forms and content;
• m)  Notifying the Administrator of problems on their website;
• n)  Participating in online chats and/or discussion forums about products and services;
• o)  Participating in trivia contests, competitions, raffles and other games;
• p)  Sharing comments and suggestions about products and services;
• q)  Requesting a job;
• r)  Processing payments, and
• s)  Any other activity analogous to those described above.

The Administrator, whether directly or through their representatives, may also use the User’s personal information for the following purposes:

• a) Carrying out studies on the demographic background, interests and behavior of their clients, consumers, employees, suppliers and any third parties it may deal with;
• b) Carrying out market research and consumption studies, with the goal of offering personalized products and services, as well as designing advertising and content that is appropriate for the needs of their clients and consumers;
• c) Collecting internal statistics that indicate the services and products that are most appreciated by different segments of consumers, clients and other users of their respective websites;
• d) Formalizing the transaction process with clients, consumers and suppliers;
• e) Collecting information from debit or credit cards used to pay for products and services in order to provide the corresponding information to the credit agencies under the terms of the Law for the Regulation of Credit Agencies. This information may be used as evidence in the event of a dispute over the purchase of a product or the payment for a service, as well for processing requests for the return of articles and the corresponding refund or exchange, and for use in procedures aimed at detecting and preventing fraud and identity theft;
• f) Reviewing the information provided by employees and/or employee candidates, which may be carried out by third parties or the Human Resources department;
• g) Equipping stores with video surveillance cameras to prevent loss and other security purposes, creating recordings that will be stored in a secure area and restricted to managers, directors and, if applicable, the authorities, and are routinely destroyed unless required for the investigation of an incident or a criminal investigation;
• h) Keeping records on purchases and other operations, as well as the information accessed on different sections of their websites, as collected by automatic data capture methods;
• i) Sending the User offers, notifications and/or promotional messages through their websites, unless the User states their desire to not receive such offers through a printed or electronic form or fax. These offers may occasionally include information from the Administrator’s providers.

4. Transfer of Personal Information. Each User states their express consent for the Administrator, or any of their representatives, to transfer their personal information to third parties, foreign or domestic, on the understanding that these third parties will handle the personal information in accordance with the terms of this Privacy Notice.

For the purposes established in this section, but subject to the terms of its last paragraph, the Administrator must inform each User that, with the goal of being able to deliver products, services and solutions to their clients, consumers, employees, suppliers and other users of their services, they and/or their representatives or affiliates have signed or will sign a variety of commercial agreements with providers of products and services, both foreign and domestic, to supply, among other services, landline telephone service, long distance telephone service, Internet, television, cell phone service and other telecommunication services. The authorization granted by each User, in accordance with this section, allows the Administrator and/or their representatives to transmit their personal information to these suppliers on the understanding that they are contractually obliged to maintain the confidentiality of the personal information provided by the Administrator and/or their representatives and to obey the terms of this Privacy Notice. The Administrator and/or their representatives may transfer the User’s personal information to their parent or controlling company, as well as the subsidiaries or affiliates under their control or any other company in the same corporate group, whether foreign or domestic, that operates with the same internal policies and procedures. They may also transfer this personal information to third parties that assist it in fulfilling its contractual or legal obligations towards the User.

Nevertheless, under the terms of this section and the Privacy Notice as a whole, the User acknowledges and accepts that the Administrator does not require their authorization nor their confirmation to transfer their personal information, domestically or abroad, in the cases established in Article 37 (thirty-seven) of the LFPD, or in any other exceptional case mentioned in the LFPD or other applicable legislation.

5. Retention and Protection of Personal Information. The Administrator and/or their representatives will retain the User’s personal information for the time needed to process their requests for information, products and/or services, as well as to keep records for accounting, financial and auditing purposes under the terms of the LFPD and the current commercial, fiscal and administrative legislation. The personal information of the User that is collected by the Administrator and/or their representatives will be protected by administrative, technical and physical security measures appropriate to preventing their harm, loss, alteration, destruction or unauthorized use, access or handling, in accordance with the terms of the LFPD and related administrative regulations.

6. Department of Personal Information / Privacy Office; Management. The Administrator will make the Department of Personal Information / Privacy Office available to each User in order to receive, register and respond to their requests to exercise their ARCO rights, as well as their right to limit the use or transfer of their personal information, and all other rights mentioned in the LFPD.