NOTICE OF PRIVACY

The present Privacy Notice is issued in accordance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter referred to as the "Law"), its regulations, and other provisions related to the processing of Personal Data in force in Mexico (hereinafter referred to as the "Applicable Legislation") and demonstrates the commitment assumed by Grupo Lamosa, S.A.B. de C.V. (hereinafter referred to as "Grupo Lamosa") and its subsidiaries and affiliates to protect all information concerning any individual that provides it to us, either directly or indirectly, verbally or through printed, electronic, digital, optical, sound, visual, and/or any other means (hereinafter referred to as the "Personal Data") as follows: (A) suppliers and customers, (B) those natural persons who (i) apply for a job with any of Grupo Lamosa’s subsidiaries or affiliates by filling out a job application, regardless of whether it is an authorized format by the corresponding subsidiary or affiliate, and submitting additional documents that have been requested or provided in relation to said selection process; and (ii) have been hired to occupy a position or position in any of the subsidiaries or affiliates of Grupo Lamosa. This Privacy Notice sets forth the terms and conditions under which the Personal Data contained in the database controlled by the Data Controller (as defined below) and used by Grupo Lamosa’s subsidiaries and affiliates will be obtained, used, stored, disclosed, and, where applicable, transferred (hereinafter referred to as "Processing").

You are informed that despite your Personal Data being delivered or directed to Grupo Lamosa and its subsidiaries and affiliates, Lamosa Servicios Administrativos, S.A. of C.V. (hereinafter referred to as the "Processor"), a subsidiary of Grupo Lamosa, will serve as the person who will process the Personal Data on behalf of Grupo Lamosa in terms of the Applicable Legislation, with address located at Av. Pedro Ramírez Vázquez 200-1, Colonia Valle Oriente, 66269 San Pedro Garza García, Nuevo León, which will be used to hear and receive notifications.

Personal Data processed by Grupo Lamosa

Grupo Lamosa, in order to comply with the purposes indicated in this Privacy Notice, will process, but is not limited to, the following Personal Data: (i) full name, (ii) date of birth, (iii) email, (iv) phone(s), (v) workplace, (vi) address and (vii) any other that you provide us to process them in accordance with the same purposes.

In the event that the legal relationship between you and Grupo Lamosa requires it, we inform you that Grupo Lamosa may process Personal Data that affects the most intimate sphere of its owner, or whose improper use may give rise to discrimination or entail a serious risk for this, which includes, but is not limited to: (i) clinical history (including without limitation (a) medical history, (b) medical and/or surgical treatments, (c) allergies, among others), (ii) present or future health status, (iii) genetic information and (iv) union membership (hereinafter the "Sensitive Personal Data"). We inform you that Grupo Lamosa will only process Sensitive Personal Data in order to facilitate compliance with the obligations derived from the legal relationship that Grupo Lamosa has with you and for the fulfillment of the purposes mentioned below.

Additionally, Grupo Lamosa may collect from you the financial and/or patrimonial data that is necessary and/or convenient to comply with the obligations of Grupo Lamosa derived from the legal relationship that exists between Grupo Lamosa and you (hereinafter, the "Data Personal Patrimonial and/or Financial Data"), with the understanding that said Personal Financial and/or Patrimonial Data will be treated in accordance with the provisions of this Privacy Notice. Personal Financial and/or Patrimonial Data may include, but are not limited to: (i) type and number of bank account, (ii) name of the bank, (iii) interbank CLABE, and (iv) name of the beneficiary. You are informed that despite your Personal Data being delivered or directed to Grupo Lamosa and its subsidiaries and affiliates, Lamosa Servicios Administrativos, S.A. of C.V. (hereinafter referred to as the "Processor"), a subsidiary of Grupo Lamosa, will serve as the person who will process the Personal Data on behalf of Grupo Lamosa in terms of the Applicable Legislation, with address located at Av. Pedro Ramírez Vázquez 200-1, Colonia Valle Oriente, 66269 San Pedro Garza García, Nuevo León, which will be used to hear and receive notifications.

Purpose of Personal Data Processing

Personal Data will be treated in accordance with this Privacy Notice, and will be used in a general manner and as necessary to fulfill all or any of the following purposes, depending on each case:

(A).- Clients and Suppliers: Grupo Lamosa may process your Personal Data, Sensitive Personal Data and/or Personal Financial and/or Patrimonial Data for the following purposes (1) the evaluation of a possible commercial relationship between the owner and any of the the subsidiaries or affiliates of Grupo Lamosa so that, if the same is finalized or formalized, the Personal Data, Sensitive Personal Data and/or Financial and/or Patrimonial Personal Data, are stored and used to comply with the purposes and commitments assumed. by the respective subsidiary or affiliate of Grupo Lamosa including, without being limited to, disclosing or transferring Personal Data, Sensitive Personal Data and/or Personal Financial and/or Patrimonial Data to third parties not related to Grupo Lamosa that require knowledge of the data. personal to allow the fulfillment of the aforementioned purposes and commitments; (2) the marketing of products and/or the provision of services by the respective subsidiary or affiliate of Grupo Lamosa; (3) the development and implementation of service or product improvement programs; (4) the development and implementation of commercial or marketing strategies related to the products and/or services offered by any of the subsidiaries and affiliates of Grupo Lamosa; (5) your safety, that of our offices and the people who visit us; (6) to send update information or events that Grupo Lamosa deems relevant and that are related to the products and/or services offered by any of the subsidiaries and affiliates of Grupo Lamosa; and (7) where applicable to process, request from financial institutions, and make any payment derived from or related to the legal relationship that exists between Grupo Lamosa and you (hereinafter, the "Primary Purposes for Clients and Suppliers") .

(B).- Employees and Potential or Contracted Workers: Grupo Lamosa may process your Personal Data, Sensitive Personal Data and/or Personal Financial and/or Patrimonial Data for the following purposes: (1) the consideration, evaluation and selection of candidates for hold a position or position in any of the subsidiaries and affiliates of Grupo Lamosa; (2) the creation, storage and consultation of a base of potential candidates to occupy a position or position in the future in any of the subsidiaries and affiliates of Grupo Lamosa; and/or (3) in the event that the owner of the Personal Data Sensitive Personal Data and/or Financial and/or Patrimonial Personal Data has been selected and hired to occupy a position or position in any of the subsidiaries or affiliates of Grupo Lamosa, to comply with the labor obligations that result from the employment relationship and even to be considered to occupy a different position or position in the same or another subsidiary or affiliate of Grupo Lamosa; (4) your safety, that of our offices and the people who visit us; (5) to send update information or events that Grupo Lamosa deems relevant to the legal relationship between you and Grupo Lamosa; and (6) where applicable to process, request from financial institutions, and make any payment derived from or related to the legal relationship that exists between Grupo Lamosa and you (hereinafter, the "Primary Purposes for Employees").

Notwithstanding the foregoing, and only in those cases where you do not expressly state otherwise for this purpose, Grupo Lamosa may process your Personal Data for purposes that do not derive directly from the fulfillment of the obligations inherent to the legal relationship between Grupo Lamosa and you. , such as informative, advertising and/or promotional media (hereinafter, the "Secondary Purposes").

The fulfillment of any of the purposes established above will include, without being limited to, disclosing or transferring Personal Data, Sensitive Personal Data and/or Personal Financial and/or Patrimonial Data to third parties not related to Grupo Lamosa that require knowledge of the Data. Personal Data, Sensitive Personal Data and/or Personal Financial and/or Patrimonial Data to allow compliance with the aforementioned purposes and commitments.

Security Measures for Protection of Personal Data

Lamosa Group is aware that Personal Data, Sensitive Personal Data and/or Patrimonial and/or Financial Personal Data may include private and confidential information concerning your person, and recognizes the importance of protecting the privacy and confidentiality of said Personal Data. Sensitive Personal Data and/or Personal Patrimonial and/or Financial Data, which is why it is obliged to maintain the privacy and/or confidentiality of said information, adopting the same protection measures that Grupo Lamosa regularly uses to preserve the confidentiality of its own information. , with the purpose of restricting the Processing of Personal Data, Sensitive Personal Data and/or Patrimonial and/or Financial Personal Data, exclusively for the purposes for which they were collected, as well as to protect them from unauthorized loss, alteration and destruction. .

Processing of Personal Data

The Processing of Personal Data, Sensitive Personal Data and/or Patrimonial and/or Financial Personal Data will be limited exclusively to those personnel of Grupo Lamosa or its subsidiaries and affiliates who, by virtue of the functions they perform within the organization, require access. to Personal Data, Sensitive Personal Data and/or Patrimonial and/or Financial Personal Data to comply with the purpose established in this Privacy Notice, as appropriate.

The Processing of your Personal Data, Sensitive Personal Data, Patrimonial and/or Financial Personal Data will be in accordance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility, as provided in the Applicable Legislation, Grupo Lamosa does not intends to market in any way the Personal Data, Sensitive Personal Data, Patrimonial and/or Financial Personal Data with third parties; However, in those cases established by Law, the Treatment or transfer of your personal data may be carried out without the consent of the owner.

Transfer of Personal Data

We inform you that in certain cases, and with the purpose of complying with the purpose established in this Privacy Notice, your Personal Data, Sensitive Personal Data, Personal Patrimonial and/or Financial Data may be shared or transferred, as the case may be, to our subsidiaries and affiliates of Grupo Lamosa or any third party that provides any type of service related or necessary to the legal relationship between Grupo Lamosa and you, with the sole purpose of complying with the purposes described in this Privacy Notice. The respective transmission will be made, either physically or electronically (except in the case of confidential information, in which case the transmission will always be made physically), using the security measures that Grupo Lamosa regularly uses to process our own confidential information. If you wish to express your opposition for this purpose, please contact Grupo Lamosa by sending an email to privacy@lamosa.com. Grupo Lamosa, within a maximum period of 20 (twenty) business days, counted from the date on which your request is received, will contact you with the response to your request.

Any third party that receives Personal Data, Sensitive Personal Data and/or Patrimonial and/or Financial Personal Data from Grupo Lamosa is aware of the terms and conditions of this Privacy Notice and, therefore, are subject to it in accordance with the provisions of this Privacy Notice. established in Article 36 (thirty-six) of the Law.

ARCO Rights of the Owner of Personal Data

The owner of the Personal Data, Sensitive Personal Data and/or Patrimonial and/or Financial Personal Data, either directly or through a legal representative, may at any time revoke the consent that has been granted to Grupo Lamosa for the processing of their Data. Personal Data, limit the use or disclosure thereof, express opposition to the purposes for which your Personal Data will be used, as well as exercise your rights of Access, Rectification, Cancellation and Opposition (hereinafter, the "ARCO Rights") , in accordance with the terms and subject to the exceptions established in the Applicable Legislation. If you wish to exercise any of the aforementioned Arco Rights, the owner may do so by sending the Request for Access, Rectification, Cancellation or Opposition of Data and Revocation of Consent form found on our page.
www.lamosa.com/privacidad/Solicitud_Derechos_ARCO_y_Revocaciones.pdf to the following email privacy@lamosa.com or, failing that, to the address of the Manager indicated in the foreword of this Privacy Notice, indicating or attaching, as appropriate, the information or documentation that is indicated in said request. Grupo Lamosa, within a maximum period of 20 (twenty) business days, counted from the date on which your request is received, will contact you with the response to your request.

Consent of the Owner of Personal Data

It will be understood that the decision of the holder of (i) deliver the Personal Data, Sensitive Personal Data and/or Patrimonial and/or Financial and/or Personal Data (ii) signing this Privacy Notice constitutes in itself an unequivocal sign of the consent granted by the owner for the Treatment in accordance with the provisions of this Privacy Notice.

It is worth mentioning that, among other cases, the consent of the owner of the Personal Data will not be required to: (i) the Processing of Personal Data when its purpose is to comply with obligations derived from a legal relationship between the owner and Grupo Lamosa, in accordance with the provisions of section IV of Article 10 (ten) of the Law; and (ii) the transfer of personal data to controlling companies, subsidiaries or affiliates under the common control of Grupo Lamosa, or to a parent company or any company in the same group of Grupo Lamosa that operates under the same processes and internal policies, in accordance with the provisions provided in section III of Article 37 (thirty-seven) of the Law.

The owner of the Personal Data may revoke his/her consent for the Processing of his/her Personal Data at any time by sending the Request for Access, Rectification, Cancellation or Opposition of Data and Revocation of Consent form found on our page.
grupolamosa.com/default/pdf/Solicitud_Derechos_ARCO_y_Revocaciones to the following email privacy@lamosa.com or, failing that, to the address of the Manager.

Revocation of the Owner's Consent

Which is indicated in the foreword to this Privacy Notice indicating or attaching, as appropriate, the information or documentation indicated in said request, without said revocation being able to have retroactive effects. Grupo Lamosa, within a maximum period of 20 (twenty) business days, counted from the date on which your request is received, will contact you with the response to your request.

Applicable legislation

This Privacy Notice is subject to the legislation applicable in the Mexican Republic.

Issue Date: February 9, 2022


WhatsApp