Read the Privacy Notice

This document constitutes the “Privacy Notice” of Servicios Administrados BSS, S.A. de C.V., hereinafter referred to as “THE COMPANY,” whose address is: Insurgentes Sur 859, Floor 14, Col. Ampliación Nápoles, Benito Juárez Delegation, C.P. 03840, Mexico City. This notice is provided to you (the “Data Subject”) prior to the processing of your personal data.

This Privacy Notice regulates the manner, terms, and conditions under which THE COMPANY, its subsidiaries, and related companies are authorized by the Data Subject to process and transfer the personal data of the Data Subject

The Data Subject hereby states under oath:

a) That by signing this document or in any other way indicating their acknowledgment of it, they express their Consent for THE COMPANY to process their data in accordance with this privacy notice.

b) That under no circumstances will they provide THE COMPANY with “sensitive personal data,” meaning any intimate personal data or data whose proper or improper use could lead to discrimination or pose a serious risk to them. In particular, the Data Subject is obligated not to provide any information related to racial or ethnic origin, present or future health status, genetic information, religious, philosophical, or moral beliefs, union affiliation, political opinions, or sexual preference.

c) That all information provided is truthful and complete. The Data Subject will be responsible at all times for the data provided.

THE COMPANY and the Data Subject agree that the processing of the Data Subject’s Personal Data will be subject to the following terms and conditions:

First.- Data Collection and Purpose

The Data Subject will voluntarily provide their personal data to THE COMPANY, either in writing or electronically, through surveys, direct access to the website, or by sending electronic files. The Data Subject agrees that THE COMPANY may also obtain information from other sources, such as information collected from the Data Subject when visiting the site (such as IP address, browser type and operating system, links followed) or information obtained from other commercially available sources. All information collected about the Data Subject may be used by THE COMPANY to provide efficient service and better attention to the user, the Data Subject, and/or clients, as well as to improve their experience using THE COMPANY’s services and access goods or services that may be relevant or attractive to the Data Subject, including participation in promotions, offers, and advertising. This will be considered as the purpose of processing the Data Subject’s data, which may be combined for the purposes permitted under this notice:

a) Use for Recruitment and Selection Purposes:

The data provided by the Data Subject includes: full name, address, email, phone, mobile and/or fax, photograph, information about academic degrees, employment history (previous jobs), and data related to interest in job positions, including skills and abilities, socioeconomic level, and employment expectations (including salary), personal references. This data will be processed for the following purposes: recruitment and selection; promotion of job offers, job boards, or independent service provision, for the purpose of requesting job references, for publication for potential recruiters in the group, for the application of any type of socioeconomic study, and documents that support the shared data and/or technical and/or academic competencies referred to by the Data Subject during the selection process.

b) Use for Hiring Purposes:

The data provided by the Data Subject includes: documents validating full name, official identification, address, email, phone, mobile and/or fax, RFC, photograph, fingerprint and/or facial recognition data, information about academic degrees, social security number, academic history (proof of studies) and employment history (employment certificates), bank account information. This data will be processed for the following purposes: internal file integration, external audit process for business certification, bidding processes, legal procedures, and/or related processes justifying the employment relationship.

c) Use for Marketing/Commercial Promotions:

The data provided by the Data Subject includes: name, address (home and office), phone numbers, fax, and email address, information on commercial or consumption preferences, income ranges, age ranges, and/or socioeconomic levels, which will be processed for the following purposes: commercial promotions, market research studies, commercial offers, advertising matters, providing goods and/or services requested or in which interest has been expressed, seeking services that may be relevant or attractive, including participation in promotions, offers, and advertising campaigns; information on changes or new products or services related to the contract acquired with the client, evaluating service quality, or conducting internal studies on consumption habits.

d) Use for Commercial Contact with Suppliers:

The data used for communication with the responsible contact at the supplier includes: full name and position, address, RFC, official identification, phone, and email, information about bank accounts, and incorporation documents of the company and/or supplier. This data will be processed for the following purposes for internal legal effects (including compliance with legal obligations, improving service quality, providing or demanding goods and/or services that have been requested or in which interest has been expressed).

This purpose may be carried out through the processing and use of data directly by THE COMPANY or by third parties to whom the data is transferred in accordance with the provisions of the following clause.

Second.- Warning in Case of Using Electronic Means

If the Data Subject provides their Data through electronic means, including THE COMPANY’s website (Internet), then the Data Subject understands, accepts, and acknowledges that:

a) THE COMPANY’s website may include links to third-party websites, and accessing these links will cause the Data Subject to leave THE COMPANY’s website, for which it assumes no responsibility regarding those third-party websites.

b) THE COMPANY’s website may include links to sites that manage social networks, in which case the Data Subject agrees that promoting any type of information or Data on such sites may result in that information being read, viewed, accessed, retransmitted, and processed by anyone, and therefore releases THE COMPANY from any liability.

c) It is possible that THE COMPANY’s systems may collect Data from the Data Subject, such as browser type, operating system, visited web pages, IP address, etc., through “cookies” or “web beacons,” among others.

Third.- Disclosure and Transfer of Data

The Data Subject understands and accepts that THE COMPANY is authorized to use, store, disclose, transfer, as well as to sell, assign, lease, or otherwise commercialize or transfer the data provided by the Data Subject. THE COMPANY will enter into contracts with third parties to whom it provides the Data, which will incorporate the restrictions and other terms and conditions of this privacy notice. The Data Subject's personal information may be transferred, stored, and processed in a country different from where it was provided, in which case we transfer the information in accordance with applicable data protection laws.

The Data Subject has the option to limit the use or disclosure of their data and information, for which they must send an email to the following address: marketing@sabss.com.mx specifying the extent of the limitation they wish.

In this case, THE COMPANY has the option to accept or reject such a request, and if it rejects it, it will be considered a cancellation of the request, in terms of this document.

Fourth.- Data Storage

Once the data is received, it will be processed and stored in a database that may be managed by THE COMPANY or by a third party with which THE COMPANY has a contract for such purposes. THE COMPANY will incorporate protective mechanisms to prevent, "to the extent possible," deviations, tampering, loss, unauthorized access, or processing of said database. The protective mechanisms are as follows:

a) No distribution of the information without prior signing of the privacy notice by the Data Subject for their acknowledgment and authorization.

b) Designation of a responsible person within THE COMPANY for the safeguarding and access, according to the purpose of the information provided by the Data Subject.

c) If the information provided by the Data Subject is physical, it will be kept under strict confidentiality and with physical security measures for access.

Fifth.- Confidentiality

THE COMPANY will not disclose the data to unauthorized third parties unless such disclosure is required by law or by an authority's mandate.

Sixth.- Modifications

THE COMPANY reserves the right to make modifications to these privacy policies at any time and to adapt them to new legislative or jurisprudential developments, as well as to market practices. The Data Subject agrees that any changes to this notice or the privacy policies will be notified by publication through the means that THE COMPANY considers most appropriate within its facilities.

The Data Subject agrees that any changes to this notice or the privacy policies will be notified by publication through the means that THE COMPANY considers most appropriate within its facilities.

ARCO RIGHTS, POLICIES, AND PROCEDURE

Seventh.- Access and Rectification

The Data Subject has the right to access their personal information stored in THE COMPANY's databases or files and to rectify or update it when necessary. To do this, they must send a request by email to the following address: marketing@sabss.com.mx. The request for access or rectification must include and be accompanied by the following:

• The name of the Data Subject and an address or other means to communicate the response to their request;

• Documents that prove the identity or, if applicable, the legal representation of the Data Subject;

• A clear and precise description of the personal data for which the Data Subject wishes to exercise any of the aforementioned rights; and

• Any other element or document that facilitates the location of the personal data.

Eighth.- Cancellation/Opposition

The Data Subject may cancel their consent at any time without retroactive effects.

• To cancel consent, the Data Subject must send a written request to the following email address: marketing@sabss.com.mx. The cancellation of personal data will result in a blocking period, after which the data will be deleted. THE COMPANY may retain the data solely for the purposes of responsibilities arising from processing.

• When personal data has been transmitted prior to the date of rectification or cancellation and continues to be processed by third parties, THE COMPANY must inform them of such a request for rectification or cancellation, without any further obligation on its part.

• THE COMPANY is not obligated to cancel personal data when:

• It must be processed by legal provision;

• It obstructs judicial or administrative actions related to tax obligations, investigation and prosecution of crimes, or the updating of administrative sanctions;

• It is necessary to protect the legally protected interests of the Data Subject;

• It is necessary to carry out an action based on public interest;

• It is necessary to comply with a legally acquired obligation.

• To oppose the use of personal data for a specific purpose, the Data Subject must send a written request to the following email address: marketing@sabss.com.mx. specifying the purposes for which they wish to oppose the use of their personal data. THE COMPANY will proceed to delete the data for the specified purpose and may retain it solely for the purposes of responsibilities arising from processing.

Ninth.- Responsible Party

If you wish to access your data, rectify it, cancel it, or oppose its processing, or if you do not want it to be used to provide you with information about our products or our company, please contact THE COMPANY through the Human Resources representative located at: Insurgentes Sur 859, Floor 14, Col. Ampliación Nápoles, Delegación Benito Juárez. C.P. 03840, Mexico City, Tel 55 5340 2700, You can also do so through the following email address: marketing@sabss.com.mx. Any request for access, rectification, cancellation, or opposition, in accordance with the applicable law, will be carried out through a request according to the following ARCO Rights Request Procedure:

1. DATA SUBJECT

1.1 Communicates their ARCO Rights request via email to the following address: marketing@sabss.com.mx.

1.1.1 They must accompany their request with the following:

– The name of the Data Subject, email, address, or other means to communicate the response to their request.

– Documents proving the identity or, if applicable, the legal representation of the Data Subject.

– A clear and precise description of the personal data regarding which they wish to exercise any of the aforementioned rights, and any other element or document that facilitates the location of the personal data.

1.2 Completes the ARCO Rights Form manually or electronically.

1.3 Sends the ARCO Rights Form via email to the following address: marketing@sabss.com.mx.

2. THE COMPANY

2.1 Receives the email with the ARCO Rights request from the Data Subject and/or legal representative.

2.2 Validates the document that proves the identity of the Data Subject and/or legal representative.

2.2.1 If the identity verification document is not attached by the Data Subject, an email confirmation of receipt will be sent, requesting the necessary documentation within no more than 10 business days. If received within the specified period, proceed to point 2.3.

2.2.2 If the identity verification documentation is not sent within the requested period, the request will be considered not submitted after 10 business days.

2.3 Sends an email confirmation of receipt and attaches the ARCO Rights Form for completion by the Data Subject.

2.4 Receives the email with the ARCO Rights Form completed manually or electronically by the Data Subject and/or legal representative.

2.4.1 If the ARCO Rights Form is not duly completed, requests correction within no more than 10 business days. If received, proceed to point 2.5.

2.4.2 If the ARCO Rights Form is not corrected within 10 business days, the request will be considered not submitted.

2.5 Sends an email confirming receipt of the ARCO Rights Form, with a description of the response time that will be provided to the Data Subject.

2.6 Assigns folio numbers according to the type of request, whether for access, rectification, cancellation, or opposition.

2.6.1 In the case of a request from the Data Subject for access, rectification, cancellation, and/or opposition, THE COMPANY will adhere to the guidelines described in the current procedure for the execution or non-execution of the request and proceeds to point 2.7.

2.7 Notifies the Data Subject via email about the outcome of their request within no more than 10 business days.

2.7.1 Notifies the Data Subject via email about the physical delivery of copies or other formats related to their personal data.

2.7.2 If the request proceeds, applies the cancellation of personal data during a blocking period, after which the data will be deleted.