Privacy Notice

A. Privacy Statement

In compliance with the provisions of the Federal Law for the Protection of Personal Data in Possession of Individuals (LFPDPPP), the Federal Law for the Protection of Industrial Property (LFPPI) and in compliance with the Intellectual Property Law, Términal Logistics, Sociedad Anónima de Capital Variable; and its different business units (hereinafter and jointly, the Responsible Party), place at your disposal the present Privacy Notice, by virtue of which they will permanently seek that the treatment of your Personal Data and/or Sensitive Personal Data (hereinafter the Data) be legitimate, controlled and informed, with the purpose of guaranteeing the privacy and the right to informative self-determination of your Data. TheResponsible Party, who for the purposes of this instrument indicates as its domicile the one located at the RecintoFiscalizado Términal Logistics, located at Carretera Estatal 200 Querétaro-Tequisquiapan, number twenty-two thousand five hundred, in Colón, Querétaro, Zip Code 76270, will be the guarantor of the Data obtained from any individual (hereinafter the Data Subject).Translated with DeepL.com (free version)

B. Personal Data of the Data Controller and Purposes

The Controller expressly states that it processes Personal Data, as well as Sensitive Personal Data of employees, collaborators, visitors to its facilities, service providers, candidates for employment and suppliers, either in writing or through tools, electronic devices or any other technology, in any of the following ways: 1) when the Data Subject provides them personally or directly, 2) when they are provided by a third party other than the Data Subject, 3) when the Data Subject uses any Internet site or online services made available by the Controller and/or 4) when they are obtained by the Controller through the sources permitted by law (article 15 of the LFDPPP).
1) Personal Data. The Personal Data and Sensitive Personal Data processed by the Responsible Party are: Federal Taxpayer Registry Code, Unique Population Registry Code, full name, if applicable, signature, date and place of birth, state of health, address, telephone, photographs, identifications, images or videos.
2) Academic, professional training and professional qualification data. Data on schooling, academic performance, as well as data on courses, programs or academic and/or professional certifications.
3) Tax data. Banking and financial information, tax domicile;
4) Employment data. Employment history, remunerations, benefits and working conditions, incapacities, employment references, company for which you provide your services, e-mail address.
5) Payment method data: Name of the holder, bank account number, CLABE and bank of origin.
6) Financial and patrimonial data. Information on income, information on bank account data in which the payment of salaries and benefits will be deposited, special credit bureau report, socioeconomic study (if hired).
7) Sensitive personal data. Data related to your health status, medical history, union affiliation and criminal record, legal proceedings in which you are or have been part of.
8) Personal data collected on Web site. Browser type, language, IP address, computer system operating system or device to access the site, interaction with our emails and our Web site.
9) Personal data received via consensual transfers. Personal data that has been shared with us by third parties to whom you have previously authorized.
10) Third party data for referrals: Identification and contact data to request professional and/or commercial references from you.
11) Personal data of family members and/or other economic dependents. Identification and contact data of family members, dependents or beneficiaries, such as their name and surname, telephone and/or e-mail.

C. Purposes.

The collection, use, disclosure or storage of Data and any action of access, handling, use, transfer or disposal of the same carried out by the Responsible will have the following purposes: I) offering and providing our services for visitors to enter our facilities, II) integrating a physical or electronic file in accordance with the applicable provisions and those used to enter into agreements, conventions or contracts any similar or related action that theResponsible considers in accordance with the development of its corporate purpose and the activities it performs; III) provision of services and identification of the Data Subject; IV) updating of the Data; V) sending information to third parties related to the activities carried out by the Responsible Party and the services it provides; VI) contacting the Data Subject; VII) obtaining fiscal, banking and financial information; VIII) establishing physical and logical security measures within the facilities where the Responsible Party operates), IX) to carry out advertising and promotional campaigns of the services it provides, X) to collect and obtain resources through donations; as well as any similar or related action that may be necessary and appropriate for the performance of the activities, school, academic, commercial, business and patrimonial activities carried out by the Responsible, including the information to be shared with institutions and authorities that so requireThe personal data described above may be contained in different documents in printed or digital format, such as copies of: personal birth certificate and those of economic dependents, valid official identification (voter's credential, passport, national military service identity card released; immigration document or driver's license), marriage certificate, if applicable, identification card of the Federal Taxpayers Registry, CURP, account statements, proof of address, proof of studies, IMSS proofs; the account number of the Retirement Fund Administrator (Afore) if applicable; curriculum vitae; letter of no criminal record and letters with work references. These are collected through: I) voluntary and direct provision of your information through our printed forms; II) voluntary provision of information and personal data in face-to-face or telephone interviews with our authorized personnel; III) or through the use of e-mails, and the use of public access sources and other sources available in the market. The Controller informs that graphic materials such as photographs, multimedia elements, reviews, profiles, videos and filming of events or institutional activities where the Holder, employees, collaborators, visitors to its facilities, service providers, candidates for employment and suppliers appear, may appear or be available in circulars, brochures, magazines, newspapers, advertisements, publicity campaigns and dissemination of information, advertisements, publicity and dissemination campaigns, memorabilia, yearbooks, social networks, e-mails, Internet sites or official profiles or any other material known or to be known, without for this reason the holder should receive any remuneration (neither economic nor academic), so from this moment on he expressly waives the collection of any consideration for the use of his image.

D. Options and means offered by the Controller to the Data Subject to limit the use or disclosure of the Data

Your data may be transferred within and outside the country under the following terms:

Transfer WITHOUT consent                                                                          Transfer WITH consent
Article 37 of the LFPDPPP                                                                             Article 36 and 9 of the LFPDPPP
- Tax, customs, judicial authorities.                                                             - Business partners
- National or public security                                                                         - Marketing companies
- Medical emergencies                                                                                 - Non-obligated financial institutions.
.                                                                                                                        - Third parties

Compliance with legal obligations or public interest                                  Commercial, promotional or other non-legal purposes
Any personal data when legal exception applies                                        General, sensitive or patrimonial personal data
Low (regulated and limited by law)                                                               Medium to high (depends on the use of the third party)
Yes, must be informed in the privacy notice                                                Yes, and mechanisms to obtain consent must be specified
The holder may exercise the right of opposition                                          The holder may refuse and the transfer is not made

Legal basis: Art. 36 of the LFPDPPP. For transfers that do require consent, we will request your written authorization, expressly, in compliance with Article 9 of the same law.

In order for you to limit the use and disclosure of the Data, we offer you the following options: a) Your registration in the Public Registry to Avoid Advertising, which is in charge of the Federal Consumer Attorney's Office (PROFECO), so that the Data will not be used to receive advertising or promotions of goods or services companies. For more information about this registration, you can consult PROFECO's Internet portal. b) Your registration in the exclusion list kept by the Responsible Party, so that your personal data will not be used for marketing, advertising or commercial prospecting purposes by us. In this alternative, you must submit a written request at the address set forth in section A. The requirements to prove your identity as well as the procedure to attend your request will be governed by the same criteria indicated in section D. In case your request is successful, the Controller will register you in the exclusion list. In order for the Controller to obtain and carry out the processing of Data, the consent of the Data Subject must be obtained.

Please read this Privacy Notice carefully. You consent to the processing of your Data, when you provide information through forms, proposals, or any document, in writing, in electronic format or verbally. If you do not agree with the privacy policy contained in this Privacy Notice, do not provide any data to the Data Controller. If you expressly and in writing do not express your opposition for the Data to be transferred, it is understood that you give your consent to do so. You may revoke the consent that, if applicable, you have given us for the processing of the Data. However, it is important that you keep in mind that not in all cases we will be able to meet your request or terminate the use immediately, since it is possible that for some legal obligation we may require to continue processing the Data. Also, you should consider that, for certain purposes, the revocation of your consent will mean that we can no longer provide the service you requested, or the conclusion of your relationship with us. For the benefit of the protection of the Data, in the treatment of the same we observe the following practices: 1. When the Data have ceased to be necessary for the fulfillment of the purposes foreseen by this Privacy Notice and the applicable legal dispositions, they will be cancelled. 2. The treatment of the Data will be that which is necessary, adequate and relevant in relation to the purposes foreseen in this Privacy Notice. 3. The Controller complies with the Data protection principles established by Law and adopts the necessary measures for its treatment. The foregoing applies even if this Data is processed by third parties at the request of the Controller. Likewise, you should consider that, for certain purposes, the revocation of your consent will mean that we can no longer provide the service you requested, or the conclusion of your relationship with us. For the benefit of the protection of the Data, in the treatment of the same we observe the following practices: 1. When the Data have ceased to be necessary for the fulfillment of the purposes foreseen by this Privacy Notice and the applicable legal dispositions, they will be cancelled. 2. The treatment of the Data will be that which is necessary, adequate and relevant in relation to the purposes foreseen in this Privacy Notice. 3. The Controller complies with the Data protection principles established by Law and adopts the necessary measures for its treatment. The foregoing applies even if this Data is processed by third parties at the request of the Controller.

E. Derechos de los Titulares de Datos Personales

1. You, in your own right or, if applicable, your duly accredited and authorized representative, may exercise the rights of access, rectification, cancellation and opposition provided for in the Law.
2. The request must be sent in writing to the address established in section A. of this document. It must be accompanied by the following:a) The name of the Data Subject and e-mail address to communicate the response to the request; b) The documents that prove the identity or, as the case may be, the personality and powers of the representative of the Data Subject by means of a power of attorney signed by the grantor and two witnesses, with copies of their identifications; c) A clear and precise description of the Data with respect to which the Data Subject seeks to exercise any of the aforementioned rights, and d) The elements or documents that facilitate the location of the Data.
3. Only when the requirements referred to in the immediately preceding paragraph are met, the Controller shall process the requests for the exercise of the rights referred to in the Law.
4. In the case of requests for rectification of Data, the Data Subject must indicate, in addition to the above, the modifications to be made and provide the documentation supporting the request.
5. The Controller shall communicate to the Data Subject, within a maximum term of five business days, counted from the date on which the request for access, rectification, cancellation or opposition is received, the determination adopted, so that, if applicable, the same is made effective within the ten business days following the date on which the response is communicated. In the case of requests for access to Data, the delivery will be made upon accreditation of the identity of the applicant or legal representative, as the case may be.
6. The terms referred to in the preceding paragraph may be extended only once at the discretion of the Controller for an equal period when justified by the circumstances of the case.
7. The obligation of access to the information shall be deemed fulfilled when the Data are made available to the Data Subject, or through the issuance of simple copies, electronic documents or any other means determined by the Controller.
8. The Controller may deny access to the Data, or to make the rectification or cancellation or grant the opposition to the processing thereof, in the following cases: a) When the applicant is not the Data Owner, or the representative is not duly accredited for such purpose; b) When in its databases, the Data in question of the request are not found; c) When the rights of a third party are harmed; d) When there is a legal impediment, or resolution of a competent authority, which restricts access to the Data, or does not allow the rectification, cancellation or opposition of such, and e) When the rectification, cancellation or opposition has been previously made.
9. The refusal referred to in this section may be partial, in which case the Controller shall carry out the access, rectification, cancellation or opposition required by the Data Subject.
10. In all the above cases, the Controller shall inform the reason for its decision and communicate it to the Data Subject, or if applicable, to the legal representative, within the deadlines established for such purpose, by e-mail, attaching, if applicable, the elements it deems appropriate.
11. However, if the same person repeats his request in a period of less than twelve months, the costs shall not exceed fifteen days of the General Minimum Wage in Force.

F. Limiting

Términal Logistics, Sociedad Anónima de Capital Variable; and its different business units, will only keep your personal data for the time necessary to manage the commercial, labor and/or legal relationship with you, as well as to keep the records required by the LFPDPPP, its Regulations, the applicable mercantile, administrative, labor, social security and tax legislation. Your personal data that were collected are protected by adequate administrative, technical and physical security measures against damage, loss, alteration, destruction or unauthorized use, access or treatment, in accordance with the provisions of the LFPDPPP and its Regulations. To limit the use and disclosure of your personal data, please send an email to the Quality or Customer Service Department to communicate your request.

G. Changes to this Privacy Notice

1. From time to time this Privacy Notice may be modified at the discretion of the Responsible Party.
2. If there are material changes to this Privacy Notice, the new version of this Privacy Notice will be made available at the address set forth in Section A.

H. Jurisdiction

Except as expressly stated in this document, the information collected does not constitute an offer of employment or recruitment.
2. For the purposes of this Privacy Notice. For the purposes of this Privacy Notice, the Responsible Party indicates as its address established in section A. of this document, or such address as it may designate in the future.
3. For the interpretation and compliance of this document, the Holder expressly submits to the jurisdiction of the Courts and competent laws of Mexico City, waiving any other jurisdiction that for any reason may correspond to him/her.

I. Internet E-mail

Any unprotected e-mail communication made over the Internet may be subject to interception or loss, as well as possible alteration. Neither you, nor others may claim liability for any damage resulting from any interception, loss or alteration related to an e-mail message sent by you to the Controller or by the Controller to you.Based on Article 9 of the Federal Law for the Protection of Personal Data in Possession of Individuals, when processing sensitive personal, financial or patrimonial data, your express written consent will be required.

J. Consent.

You represent that you have read, understood and agreed to the terms set forth in this Notice for the collection and processing of your patrimonial, financial and/or sensitive data, the foregoing, based on articles 8 and 9 of the LFPDPPP, as well as articles 11, 12, 14, 15 and 16 of the Regulation, without prejudice to the cases of exception provided in articles 10 and 37 of the LFPDPPP that empower us to treat your personal data and transfer them in order to comply with our obligations in legal, contractual terms, or by virtue of the legal relationship, present and/or future that we have or will have with you. For the collection, processing and transfer of your personal data, which are not financial, patrimonial, or sensitive, you will provide us with your tacit consent under the terms of this Notice by not objecting or opposing its content within the following 48 hours after your personal data are collected and this notice has been made available to you by different means, including publication on our website.