Privacy Notice

Terms and conditions

Identity and address of the data controller

For the purposes of this Privacy Notice, “PMP” and/or its affiliates or subsidiaries in Mexico identify PLANEACION MANTENIMIENTO Y PROYECTOS S.A. DE C.V., located at Carretera Federal Libre a Miguel Alemán Km. 26, Parque Industrial Star, Apodaca, Nuevo León, Mexico, ZIP Code 66600, as the party responsible for processing personal data, hereinafter referred to as “PMP”.

Personal data

The personal data covered by this Notice may be sensitive or non-sensitive and will allow “PMP” to develop products, solutions, and services intended to meet THE CUSTOMER's needs according to its activities and industry. By way of example and without limitation, this information consists of the name of THE CUSTOMER and/or the contacts representing THE CUSTOMER; contact details such as telephone number and email address; address; Federal Taxpayer Registry number (RFC); Unique Population Registry Code (CURP); and financial, administrative, and legal information, among other data required to provide the requested service.

“PMP” will obtain personal data through physical or digital means or from other sources permitted by law, including:

• Through our authorized sales representatives and distributors.
• When you contact us by telephone or through the call center.
• Through the use of the data controller's websites.
• Through publicly available sources and other means available in the market.
• By postal mail and other means.

Purpose of personal data processing

“PMP” accepts and acknowledges that it will process THE CUSTOMER's personal data. Processing refers to any partially or fully automated action performed and may include, by way of example and without limitation, collection, recording, organization, storage, use, responding to lawful requests from competent authorities, and/or deletion from databases belonging to “PMP”, for the following purposes, among others:

1. Adding and, where applicable, updating information in our databases, which may include purchase history, for internal statistical purposes and service improvement.
2. Assigning a username and password that identify the party as a “PMP” CUSTOMER.
3. Evaluating the party as a prospective customer.
4. Providing the services, products, and comprehensive solutions requested by THE CUSTOMER.
5. Providing information about new products and services and sending other advertising communications.
6. Evaluating the quality of the services or products offered by “PMP”.
7. Preparing and executing agreements arising from the business relationship.
8. Fulfilling obligations arising from the legal and business relationship established between “PMP” and THE CUSTOMER.
9. Preparing and retaining a file for THE CUSTOMER, which “PMP” will safeguard under the conditions it considers appropriate in accordance with applicable local laws and regulations.

Options and means to limit the use or disclosure of data

“PMP” states that it has a Quality and Security Policy that supports an information-security culture and is committed to establishing and maintaining the administrative, legal, technological, technical, and physical measures that are necessary, sufficient, and consistent with its capabilities to protect THE CUSTOMER's personal data against damage, loss, alteration, destruction, unauthorized use, access, or processing. It also protects the information it handles through confidentiality agreements with its employees, service providers, suppliers, customers, and visitors.

Computer equipment has the security required to prevent information leaks. Physical and logical access controls, environmental controls, intrusion-prevention systems, antivirus tools, and web filters are among the safeguards used to protect data in “PMP” information systems.

How to exercise ARCO rights

THE CUSTOMER may exercise the rights of access, rectification, cancellation, and opposition regarding the processing of personal data at any time by sending a written request by email to ventas@pmpgrupo.mx. The request must contain the following information:

“PMP” will notify THE CUSTOMER of its response at the email address provided for that purpose within 15 to 20 business days from the date the request is received. If the request is granted, “PMP” undertakes to implement it within fifteen days following the date on which the response is communicated.

“PMP” is not responsible for problems that may arise when transmitting data to the email account provided by THE CUSTOMER for notifications, or for any other cause not attributable to “PMP”.

1. THE CUSTOMER's full name and an email address at which to receive the response.
2. A document proving identity and, in the case of legal representation, proof of the identity of the person submitting the request on behalf of THE CUSTOMER.
3. The reason for the request and the arguments supporting it, including supporting documents where necessary.
4. A clear and precise description of the personal data with respect to which any of the foregoing rights is to be exercised.
5. Any other item or document that facilitates locating the personal data.

Changes and amendments to the Privacy Notice

“PMP” reserves the right to amend and/or change this Privacy Notice at any time and undertakes to provide notice through any of the following means:

• Notices posted within “PMP” facilities.
• The email address provided by the customer who owns the personal data.
• Notices on the intranet and/or online portal: www.pmpgrupo.mx.

Sincerely

PLANEACION MANTENIMIENTO Y PROYECTOS S.A. DE C.V.

Commercial Department

RGC-VEN-14 REV.00

Privacy Notice for job applicants

PLANEACION MANTENIMIENTO Y PROYECTOS S.A. DE C.V., located at Carretera Federal Libre a Miguel Alemán Km. 26, Parque Industrial Star, Apodaca, Nuevo León, Mexico, ZIP Code 66600, hereinafter referred to as “PMP”, hereby informs you, in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, hereinafter “the Law”, that your personal data—including data that may be considered sensitive because it affects your most private sphere—appearing in documents duly completed by you in your employment application or provided by any other means, such as labor unions or placement agencies, in connection with a potential employment relationship with this company, will be processed, among other purposes, for inclusion in statistics, reports, directories, and medical examinations concerning your health; and, where applicable, to provide you the opportunity to work for this company, obtain advancement, promotions, or any other benefit during a potential employment relationship and for any similar service. The data may be transferred to “PMP” affiliates, parent companies, subsidiaries, the corporate group to which it belongs, or any company considered appropriate.

If you wish to exercise the rights of access, rectification, cancellation, and opposition established under the Law with respect to your personal data, you must do so in writing at the address stated in the preceding paragraph.

All information will be protected and safeguarded under the highest security and technological standards available to “PMP”, with access to your data limited to the purposes for which it was provided.

“PMP” will provide notice, through any means it considers appropriate, of any change, amendment, or update to this Privacy Notice.

After reading this Notice in full, which is based on the provisions of Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, and having been informed of its legal value and effect, the appearing parties ratify and sign it in agreement in Apodaca, Nuevo León, Mexico, on the _____ day of __________________, 20____.

APPLICANT'S NAME AND SIGNATURE: ______________________________________

SIGNATURE ON BEHALF OF PMP GRUPO: _______________________________________

New clause to be included in all employment agreements

“THE COMPANY” hereby informs “THE EMPLOYEE”, in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, hereinafter “the Law”, that the employee's personal data—including data that may be considered sensitive because it affects the employee's most private sphere—appearing in documents completed in the employment application or provided by any other means, such as labor unions or placement agencies, in connection with the employment relationship with this company, will be processed, among other purposes, for inclusion in statistics, reports, directories, and medical examinations concerning the employee's health; and to provide the possibility of advancement, promotions, or any other benefit during the employment relationship and for any similar service. The data may be transferred to THE COMPANY's affiliates, parent companies, subsidiaries, the corporate group to which it belongs, or any company considered appropriate in connection with the employee's work.

If the employee wishes to exercise the rights of access, rectification, cancellation, and opposition established under the Law with respect to personal data, including data considered sensitive, the employee must do so in writing at THE COMPANY's address.

All information will be protected and safeguarded under the highest security and technological standards available to THE COMPANY, with access to the employee's data limited to the purposes for which it was provided.

THE COMPANY will provide notice, through any means it considers appropriate, of any change, amendment, or update to this Privacy Notice.

If THE EMPLOYEE, as a result of the employee's work, has access to personal data—including data that may be considered sensitive—belonging to coworkers or customers of THE COMPANY's affiliates, parent companies, subsidiaries, or the corporate group to which it belongs, the employee agrees not to disclose to third parties any information contained in the files of coworkers or those customers, in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, regardless of whether that information is stored physically, electronically, or by any other means.

Personal data processed

Some of the personal data that “PMP” obtains, uses, discloses, and/or stores includes:

• Full name.
• Address.
• Email address.
• Landline and/or mobile telephone number.
• Payment information, such as a credit card number or bank account number.
• Federal Taxpayer Registry number (RFC).
• Articles of incorporation.
• Tax information.
• Business references.
• Information regarding financing and credit.

Purposes and/or uses of personal data collected by “PMP”

The personal data collected by “PMP” is used to request the products and/or services that you provide or offer and, in general, to fulfill obligations arising from the relationship that may be established with you. Your personal data may be used for the following necessary activities that may result from that relationship:

• Analyzing your internal structure, technological and operational capacity, and any other aspect that allows “PMP” to identify your ability to perform the activities for which you may be engaged.
• Executing the corresponding agreements and the ancillary instruments required for the legal relationship.
• Creating and administering your account and supplier file.
• Following up on engagements.
• Requesting quotations or estimates.
• Determining whether to grant you a concession as a service center.
• Processing payments.
• Conducting analyses, studies, and research regarding business relationships.
• Maintaining communications to achieve the purpose of the legal relationship that may be established with you.

Transfers of personal data

“PMP” does not sell, assign, or transfer your personal data to third parties unrelated to “PMP” without your prior consent. However, “PMP” may transfer your personal data when the transfer is permitted by the Law. Your personal data may also be transferred in the event of a merger or acquisition because it will be considered an asset of “PMP”; you will be informed of such circumstances in a timely manner.

Security of your personal data

“PMP” has adopted and maintains the administrative, technical, and physical security measures required to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing.

Your rights regarding your personal data

As the owner of personal data, you may exercise the rights of access, rectification, cancellation, and opposition established by the Law. You may also revoke at any time any consent you have given that is required to process your personal data and may limit its use or disclosure. To do so, send a written request by email, in accordance with the requirements of the Law, to compras@pmpgrupo.mx.

For reference, the ARCO rights are briefly described below:

Access: to be informed which of your personal data is contained in “PMP” databases, how that data is used, its source, and any communications made using it.

Rectification: to request that your personal data be corrected or updated if it is inaccurate or incomplete. You are responsible for informing “PMP” of changes that must be made when those changes are known only to you.

Cancellation: to request the complete or partial removal of your personal data from “PMP” databases. The request will result in a blocking period, after which the data will be deleted. In certain cases, cancellation will not be possible under the Law and other applicable legal provisions.

Opposition: to object, for legitimate cause, to the processing of your personal data by “PMP”. When the objection concerns receiving certain communications, those communications will include an option to unsubscribe from the mailing list and stop receiving them.

Changes to the Privacy Notice

THE SUPPLIER is responsible for reviewing any amendments and updates that “PMP” makes to the Privacy Notice, which remains fully available through any of the means described in this document.

Sincerely

PLANEACION MANTENIMIENTO Y PROYECTOS S.A. DE C.V.

Purchasing Department