ESEASA CONSTRUCCIONES S.A. DE C.V. , (hereinafter "ECO"), with registered address at Calle Montecito, No. 38, Floor 31, Office 32, Colonia Nápoles, Alcaldía Benito Juárez, Mexico City, Postal Code 03810, committed to the protection of your personal data and assuming responsibility for its use, handling and confidentiality in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties, hereby issues this Privacy Policy to inform you of the main characteristics of the processing to which your personal data will be subject.

Personal data subject to processing by ECO

To fulfill the purposes set out in this Privacy Policy, ECO will collect the following information directly from you:

• Identification data,
• Contact data,
• Location data,
• Employment data,
• Academic data,
• Patrimonial and/or financial data, and
• Geolocation

ECO may collect personal data indirectly, through publicly accessible sources, or when provided by companies belonging to the ESEASA Group and third parties with whom ECO has entered into commercial or service agreements. ECO may also collect information about minors or persons under guardianship. The processing of such data will only take place when consent has been obtained from the parent or legal guardian to fulfill the purposes set out in this Privacy Policy.

ECO may process personal data of third parties (acting as beneficiary, obligor, guarantor, representative, attorney-in-fact, shareholder or other participant) when you provide their information to us, in order to fulfill our obligations arising from the contracting of a product or service. In such cases, you acknowledge having informed those third parties about the use of their data and having previously obtained their consent.

Sensitive data

Additionally, ECO will collect the following categories of sensitive personal data:

• Biometric data,
• Health data,
• Data on ethnic origin, indigenous people or community.
• Primary purposes

ECO will process the personal data described in this Privacy Policy for the following primary purposes.

• Verify, confirm and validate your identity;
• Check your credit history;
• Obtain banking and commercial references;
• Evaluate your application for our products and services;
• Comply with the contractual relationship arising from the contracting of our products and services;
• Manage, operate and follow up on the products and services requested or contracted with ECO;
• Integrate and update your file and databases for the operation of your contracted products and services;
• Contact you through different communication channels to manage the relationship arising from the products and services contracted with us;
• Carry out collection management;
• Issue tax receipts;
• Attend to and follow up on your inquiries, clarifications and complaints;
• Develop and monitor risk profiles and models;
• Conduct analysis to determine your legal status, including whether you have ongoing lawsuits;
• Identify and prevent possible illegal conduct that could constitute a violation of current legal provisions;
• Carry out internal and external audit processes;
• Comply with the obligations established by applicable legislation;
• Attend to legal requirements from competent authorities.
• If you are acting as a representative or attorney-in-fact, ECO will process your data to manage, operate and fulfill the contract signed in your capacity as legal representative of a third party.

Secondary purposes

Additionally, if you do not object, ECO may process your personal data to fulfill the following secondary purposes:

• Send you advertising, promotional and commercial prospecting information about our products and services, according to your profile;
• Offer you products and services from companies belonging to the ESEASA Group;
• Send you invitations to participate in programs, activities, campaigns, contests, trials and events organized by ECO;
• Conduct surveys or questionnaires about our products and services, or arising from programs, activities, campaigns, contests and events organized by ECO;
• Reference products and/or services of third parties with whom ECO has entered into contracts for that purpose;
• Analyze your commercial profile to understand your preferences, consumption habits, asset capacity and financial solvency, as well as to determine your financial health;
• Conduct statistics, models or market studies related to the products and services contracted with ECO;

If you do not wish ECO to process your personal data for any of the purposes described in this section, you may request this by sending an email to the following address: protecciondedatospersonales@eseasaconstrucciones.com . If we do not receive your objection within 5 business days from when your data is collected, the use of your information will be deemed consented.

Transfers of personal data

ECO may transfer your personal data in the following circumstances:

• Companies belonging to the ESEASA Group, where required to fulfill the purposes set out in this Privacy Policy. We inform you that such companies operate under privacy policies that comply with the applicable provisions;
• Third parties with whom contracts have been entered into for the commercialization of products and/or services, for the benefit and/or interest of clients;
• Third parties with whom we have a commercial and/or collaborative relationship;
• Third parties with whom we have entered into contracts for the benefit and/or interest of clients, to fulfill the legal relationship established between the parties;
• Debt-acquiring companies with whom a portfolio sale agreement is entered into;
• Public notaries for the execution of transactions;
• Specialized service providers and financial institutions for compliance with requirements arising from supervisory powers, prudential, judicial, tax, and irregularity or crime prevention and detection obligations;
• Government entities for the follow-up and fulfillment of ECO's obligations arising from your participation in sweepstakes, contests or activities with them.
• Competent authorities in legally provided cases.

If necessary, ECO will request your consent for the transfer of your data and will communicate this Privacy Policy so that your personal data is processed in accordance with its terms.

Means and procedure to exercise ARCO Rights and/or revocation of consent for the processing of personal data

You, or your legal representative, may exercise any of the rights of access, rectification, cancellation or opposition, as well as revoke your consent for the processing of your personal data by sending an email to the following address: protecciondedatospersonales@eseasaconstrucciones.com .

Your email must state in the Subject line "ARCO Rights Request" (hereinafter, the "Request") and must contain all the elements required to process your request in accordance with applicable regulations. For ECO to follow up on the request, you or your legal representative must properly verify your identity, which requires that your "Request" be accompanied by a copy of a valid official identification document.

In the event that the information provided in the "Request" is erroneous or insufficient, or the corresponding accreditation documents are not included, ECO, within five (5) business days following receipt of the request, may require you to provide the necessary elements or documents to process it. You will have ten (10) business days to comply with this requirement, counted from the day after you received it. If no response is provided within that period, the corresponding request will be deemed not submitted. ECO will notify you of the decision adopted within a maximum period of twenty (20) business days from the date the request was received, so that, if applicable, it may be made effective within fifteen (15) business days following the communication of the response. The response will be provided through the means or channel you specified in your "Request".

Options and means to limit the use or disclosure of personal data

You may limit the use or disclosure of your personal data by sending an email to the following address: protecciondedatospersonales@eseasaconstrucciones.com . The requirements to verify your identity, as well as the procedure for processing your request, will be governed by the same criteria set out in the previous section. If your request is approved, ECO will register you in its own exclusion list.

Additionally, if you wish to stop receiving advertising or promotions about our products and services, you may make the same request following the same criteria set out in the previous section. If your request is approved, ECO will register you in its own exclusion list.

Changes to the Privacy Policy

ECO reserves the right, at its sole discretion, to change, modify, add or remove parts of this Privacy Policy at any time. In such case, ECO will keep its current Comprehensive Privacy Policy available on the website https://www.eseasaconstrucciones.com/ . We recommend that you periodically visit this page to stay informed of any changes to this policy.