En cumplimiento a lo dispuesto por los artículos 14, 15, 16 y 17 de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Altor Casa de Bolsa, S.A. de C.V. (Altor), con domicilio en calle Paseos de los Tamarindos 90 Torre I, Piso 7, Colonia Bosques de las Lomas, Alcaldía Cuajimalpa de Morelos, Código Postal 05120, Ciudad de México, es el responsable del uso y protección de sus datos personales, y al respecto le informamos lo siguiente:

For what purposes will we use your personal data?

The personal data we collect from you will be used for the following purposes that are necessary for the service you request:

Main or necessary purposes:

• For the management, control, administration and updating of information related to clients and legal representatives of clients (in the case of legal entities), necessary to enter into and confirm transactions, to contract services with Altor and to ensure the confidentiality of transactions.
• For the analysis of the quality, creditworthiness and payment capacity of clients, management, control and administration of communications, analysis of the profile and personal and work history between Altor and its clients in accordance with current and applicable legislation. It is also necessary to ensure compliance with confidentiality, integrity and transparency obligations; as well as legal provisions on the prevention of money laundering and terrorist financing; through the implementation of administrative and technical procedures established for such purposes.
• Operation and management of the services you contract with Altor.
• Perform intermediation acts in the Securities Market.

Secondary purposes:

• Sending communications about offers and new products and/or services provided, sending information and commercial offers (electronic and physical) about products and/or services offered or produced by third parties, marketing or advertising promotion, distribution, commercialization and sale of products and/or services offered by Altor's parent, affiliated or subsidiary companies.

Means to limit the use or disclosure of your personal data.

If you do not wish for your personal data to be processed for secondary purposes, you will have a period of fifteen business days from the date on which this Privacy Notice is made available to you, to notify us of your refusal via email to our Personal Data Office, located at the address, telephone numbers and email address detailed below.

The rights of the data subject to exercise their rights to revoke consent or object after the provision of their personal data or their use are always preserved. The refusal to use their personal data for these purposes may not be a reason for us to deny them the services and products they request or contract with us.

What personal data will we use for these purposes?

In order to carry out the purposes described in this privacy notice, we will use the following personal data:

In addition to the personal data mentioned above, for the purposes reported in this privacy notice we may use personal data considered sensitive, which requires special protection, such as: biometric and banking information.

With whom do we share your personal information and for what purposes?

We inform you that your personal data may be shared within and outside the country with companies, organizations or authorities other than us, in accordance with the following:

• Sus datos personales podrán ser transferidos dentro del territorio nacional o al extranjero, solo en los supuestos previstos en el artículo 36 fracciones I, V, VI y VII de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares, en términos que fija esa ley.
• When requested by public bodies and national and international administrative authorities, judicial authorities, regulatory entities in the exercise of their functions, financial entities and service providers.

Purpose of personal data.

The purposes of obtaining your personal data are to comply with legal, informational and transparency obligations, to prevent operations with illicit proceeds and the financing of terrorism, for statistical purposes, to comply with judicial and administrative requirements issued by competent authorities, in compliance with requirements or requests with effects in the territory of the United Mexican States or abroad in accordance with international treaties to which the Mexican State is a party, always in accordance with the legal provisions in force in our country.

How can you access, rectify or cancel your personal data or oppose its use?

You have the right to know what personal data we have about you, what we use it for and the conditions of use we give it (Access). You also have the right to request the correction of your personal information if it is outdated, inaccurate or incomplete (Rectification); to have it deleted from our records or databases when you consider that it is not being used appropriately (Cancellation); as well as to oppose the use of your personal data for specific purposes (Opposition). These rights are known as ARCO rights.

To exercise any of the ARCO rights, you must submit the respective request at any time after any legal relationship between Altor and the person who provides their personal data comes into force.

You may revoke the consent you have given for the processing of your data; to do so, you must request it through the following email address: arco@altorcb.com or by coming in person to our address located at Paseo de los Tamarindos 90, Tower I, Floor 7, Bosques de las Lomas, Cuajimalpa de Morelos Municipality, Postal Code 05120, Mexico City.

Procedure for exercising ARCO rights.

The owner or his legal representative must submit his application to which he must attach a simple copy of his official identification and present the original for comparison (In the case of legal entities: public instrument containing power for acts of administration and ownership or special clause to exercise ARCO rights, as well as official identification of the legal representative or attorney).

What information and/or documentation should the application contain?

• Identification data of the owner of the personal data (Full name, company name or business name, address, email and telephone number).
• Proof of identity/legal representation (official identification, original public instrument and copy for comparison).
• Express manifestation of the ARCO right that will be exercised.
• Name and signature of the natural person and/or legal representative in the case of legal entities.
• Date.

How many days will it take us to respond to your request?

Within a maximum of 15 business days.

By what means will we communicate the response to your request?

Email provided in the application.

In what media can the personal data that you request be reproduced?

Magnetic, electronic and physical media.

Contact information for the department in charge of processing ARCO rights requests:

Paseo de los Tamarindos 90, Tower I, Floor 7, Colonia Bosques de las Lomas, Cuajimalpa de Morelos Municipality, Postal Code 05120, Mexico City, email address arco@altorcb.com arco@altorcb.com

Limitations on the request to revoke consent for the use of your personal data.

You may revoke the consent that you have given us for the processing of your personal data. However, it is important to note that we will not be able to respond to your request or terminate the use immediately in all cases, since we may be required to continue processing your personal data due to some legal obligation. You should also consider that for certain purposes, the revocation of your consent will imply that we are unable to continue providing the service you requested or to terminate your relationship with us.

How can you limit the use or disclosure of your personal information?

In order for you to limit the use and disclosure of your personal information, we offer the following:

To limit the use and disclosure of your personal information, you must submit your request in writing to the email address arco@altorcb.comor go in person to Altor's address, in order to be added to an exclusion list maintained by Altor and in this way the use of your personal data will only be for the necessary purposes derived from the legal relationship that unites you.

Use of tracking technologies on our website

We inform you that on our website www.altorcb.com we use cookies, web beacons or other technologies, through which it is possible to monitor your behavior as an Internet user, as well as provide you with a better service and experience when browsing our website.

We will use the personal data we collect through these technologies to verify identity, manage and operate the services offered by Altor and for statistical purposes.

The personal data we obtain from these tracking technologies are as follows:

• Session identifiers, usernames, and passwords.
• User preferred language.
• Region in which the user is located.
• Any data that allows Altor to locate you in accordance with current regulations.
• User's browser type.
• Type of user operating system.
• Date and time of the start and end of a user session.

These technologies may be disabled by following the procedures of the internet browser you use, however, please note that this may result in you not being able to obtain all the functionality that our website offers.

Changes to the privacy notice

This privacy notice may be subject to modifications, changes or updates derived from new legal requirements, due to the needs of the products or services we offer, privacy practices, changes in our business model, changes in regulations, among others.

We undertake to keep you informed of any changes that may occur to this privacy notice on our website www.altorcb.com

Acceptance of terms

This privacy statement constitutes a legal agreement between you and Altor. By using our services you are agreeing to the terms set out above.