Privacy Notice

A. Privacy Statement

In compliance with the provisions of the

Federal Law for the Protection of Personal Data in Possession of Individuals (the Law), Grupo Industrial Creysi, Sociedad Anónima de Capital Variable (hereinafter the Responsible Party), makes this Privacy Notice available to you, by which it will permanently seek that the treatment of your Personal Data and/or Sensitive Personal Data (hereinafter the Data) is legitimate, controlled and informed, with the PTO guaranteed the right to informative self-determination of your data.

The Responsible Party, who for this instrument indicates as its address the one located at Manzana Tres, Lotes one, two and three, without number, in Colonia Parque Industrial Exportec 1, Zip Code 50223 in Toluca, State of Mexico, shall be the guarantor of the Data obtained from any individual (from now on the from now on).

B. Personal Data of the Data Subject and Purposes

The Responsible Party processes the Data of employees, collaborators, visitors to its facilities, service providers, clients, candidates for employment, and suppliers, either in writing or through tools, electronic devices, or any other technology, in any of the following ways:

1) when provided personally or directly by the Data Subject.

2) when they are provided by a third party other than the Data Subject

3) when the Data Subject uses an Internet site or the online services of the Responsible Party and

4) when the Responsible Party obtains through the sources permitted by law.

By way of example, the Data processed by the Responsible Party are Federal Taxpayer Registry Code, Unique Key of the Population Registry, name, date, and place of birth, state of health, address, telephone number, fiscal address, Federal Taxpayers Registry Code, Unique Key of the Population Registry, photographs, images (videos), financial information, company for which they provide their services, e-mail address, as well as the information necessary to offer and deliver our services, for visitors to enter our facilities, integrate a physical or electronic file by the applicable provisions and those used to enter into agreements, conventions or contracts and any similar or related activities that activities Responsible Party consider with the development of its corporate purpose and the actions it performs.

The collection, use, disclosure, or storage of Data and any action of access, handling, use, transfer, or the disposal thereof carried out by the Responsible Party shall have the following purposes:

i) identification of the Data Subject,

ii) updating of the Data,

iii) integration of files,

iv) sending information to third parties related to the activities carried out by the Responsible Party,

v) contacting the Data Subject,

vi) obtaining tax information,

vii) establishing physical security measures inside the facilities where the Responsible Party operates,

viii) entering into contracts, agreements, or arrangements,

ix) carrying out advertising and promotional campaigns for the products it manufactures or markets, as well as any similar or related activity that is necessary and appropriate for the performance of the commercial, business, and patrimonial activities carried out by the Responsible Party, including the information that must be shared with the authorities that so require.

The Responsible Party informs that graphic materials such as photographs, multimedia elements, reviews, profiles, videos, and filming of events, or institutional activities in which the Data Subject appears, may appear or be available in newsletters, brochures, magazines, newspapers, advertisements, advertising campaigns and diffusion, memorabilia, yearbooks, social networks, emails, websites or official profiles or any other material known or to be known.

For the Responsible Party to obtain and carry out Data processing, the consent of the Data Subject is required. Please read this Privacy Notice carefully. You consent to process your Data when you provide information through forms, proposals, or any document, in writing, in electronic format, or verbally. If you disagree with the privacy policy in this Privacy Notice, do not provide any data to the Responsible Party. If you do not expressly and in writing state your opposition to the transfer of the Data, it is understood that you give your consent to do so.

C. Limitation of Processing and Disclosure of Data

When the Data are no longer necessary to fulfill the purposes outlined in this Privacy Notice and the applicable legal provisions, they will be deleted.

The Data processing will be necessary, adequate, and relevant to the purposes set in the outlined Privacy Notice.

The Responsible Party complies with the Data protection principles established by the Law and adopts the necessary measures for its treatment. The preceding applies even if third parties process this data at the request of the Responsible Party.

D. Rights of Personal Data Subjects

You or, if applicable, your legal representative may exercise the rights of access, rectification, cancellation, and opposition provided by Law.

The request for access, rectification, cancellation, or opposition must be sent in writing to the address established in section A of this document. It must be accompanied by the following:

a) The name of the Data Subject and e-mail address to communicate the response to the request.

b) Documents proving the identity or, as the case may be, the legal representation of the Data Subject.

c) The clear and precise description of the Data concerning which the exercise of any of the rights above is sought, and

d) Any other element or document that facilitates the location of the Data.

Only when the requirements in the preceding paragraph are met will the Responsible Party process the requests for the exercise of the rights referred to in the Law.

In the case of requests for rectification of Data, the Data Subject shall indicate, in addition to those above, the modifications to be made and provide the documentation supporting their request.

The Responsible Party shall communicate to the Data Subject, within a maximum period of five calendar days from the date on which the request for access, rectification, cancellation, or objection is received, the determination adopted so that, if applicable, the same is made effective within ten working days from the date on which the response is communicated. In the case of requests for access to Data, the delivery shall be made upon proof of the applicant’s or legal representative’s identity, as the case may be.

The deadlines above may be extended once for an equal period, provided that the circumstances of the case so justify them.

The obligation of access to the information shall be deemed fulfilled when the Data Subject is provided with the Data; or using the issuance of simple copies, electronic documents, or any other means determined by the Responsible Party.

The Responsible Party may deny access to the Data, make the rectification or cancellation, or grant the opposition to the processing thereof in the following cases:

a) When the applicant is not the Data Subject or the legal representative is not duly accredited.

b) When in its databases, the Data in question in the request are not found.

c) When the rights of a third party are harmed.

d) When there is a legal impediment, or the resolution of a competent authority, which restricts access to the Data or does not allow the rectification, cancellation, or opposition of the same, and

e) When the rectification, cancellation, or objection has been previously made.

The refusal referred to in this section may be partial, in which case the Responsible Party shall carry out the access, rectification, cancellation, or opposition required by the Data Subject.

In all the above cases, the Responsible Party shall inform the reason for its decision and communicate it to the Data Subject or, as the case may be, to the legal representative, within the terms established for such purpose, by e-mail, attaching, as the case may be, the elements it deems appropriate.

The Data delivery shall be free of charge, and the Data Subject shall only have to cover the justified shipping costs or the cost of reproduction in copies or other formats. However, if the same person repeats his request in fewer than twelve months, the costs will be, at most, fifteen days of the General Minimum Wage in Force.

E. Changes to this Privacy Notice

From time to time, this Privacy Notice may be modified at the discretion of the Responsible Party.

If there are material changes to this Privacy Notice, the new version will be available at the address outlined in Section A.

F. Jurisdiction

Except as expressly stated herein, the information collected does not constitute an offer of employment or recruitment.

For this Privacy Notice, the Responsible Party indicates its address established in section A of this document or the one it may designate in the future.

For the interpretation and fulfillment of this document, the Data Subject expressly submits to the Jurisdiction of the Courts and competent Laws of Mexico City, waiving any other jurisdiction that may correspond to them for any reason.

G. Internet E-mail

Any unprotected e-mail communication made over the Internet may be subject to interception, loss, and possible alteration. You and others may not be liable for any damages resulting from any interception, loss, or alteration related to an e-mail message sent by you to the Responsible Parties or by the Responsible Parties to you.