l

PRIVACY NOTICE OF CRN ALKOT S.A. DE C.V.

Last updated: April 2024

This document constitutes the "Privacy Notice" of CRN ALKOT S.A. DE C.V., which is made available to you (the "Holder") prior to the collection and processing of your personal data.

PURPOSE

This Privacy Notice regulates the manner, terms, and conditions under which CRN ALKOT S.A. DE C.V., including its subsidiary and related companies, are authorized, and empowered by the Holder to collect, process, and transfer the Holder's personal data (hereinafter the "Data").

EXCLUDED DATA

CRN ALKOT S.A. DE C.V.'s website may include links to third-party websites. If you access such links, you will leave CRN ALKOT S.A. DE C.V.'s website, and CRN ALKOT S.A. DE C.V. assumes no responsibility regarding those third-party websites.

If you post, comment, or share personal information, including photographs, on any public forum, social network, blog, or other similar forum, please be aware that any personal information you post may be read, viewed, collected, or used by other users of such forums and may be used to contact you, send you unsolicited messages, or for purposes beyond your or CRN ALKOT S.A. DE C.V.'s control.

CRN ALKOT S.A. DE C.V. is not responsible for the personal information you choose to submit to these forums or social networks.

CONSENT

The Holder hereby declares, under penalty of perjury:

That in case this Privacy Notice is available through an electronic page (website, web page, or similar) or any other electronic device, by clicking "accept" or by otherwise continuing to browse the site, or by providing your Data through it, you are consenting to CRN ALKOT S.A. DE C.V. processing your Data in accordance with this Privacy Notice.

That in case this Privacy Notice is available through a written page, your signature, rubric, name, or fingerprint or by providing your Data on any part of the site, constitutes your consent for CRN ALKOT S.A. DE C.V. to process your data in accordance with this Privacy Notice.

That all the information you provide is true and complete. The Holder will be responsible at all times for the Data provided.

SENSITIVE DATA

The Holder declares, under penalty of perjury, that they have not provided and will not provide CRN ALKOT S.A. DE C.V. with "sensitive personal data," i.e., intimate personal data or data whose proper or improper use could lead to discrimination or pose a serious risk to them.

In particular, the Holder undertakes not to provide CRN ALKOT S.A. DE C.V. with any Data regarding racial or ethnic origin, present and future health status, genetic information, religious, philosophical, and moral beliefs, union membership, political opinions, or sexual orientation.

DATA COLLECTION

The Holder will voluntarily provide their Data to CRN ALKOT S.A. DE C.V., whether in writing, verbally, electronically, through surveys, by directly accessing the CRN ALKOT S.A. DE C.V. website, or by sending electronic files or any other nature, including, but not limited to, direct delivery of information, access to the CRN ALKOT S.A. DE C.V. website or that of its clients or affiliates (where reference is made to this Privacy Notice), telephone or telemarketing calls, email requests, seminars, conferences, or events, etc.

In case of use of or access to our websites or other electronic means, we inform you that our systems may collect Data from the Holder such as browser type, operating system, visited Internet pages, IP address, etc., through "cookies" or "web beacons," among others.

Cookies are text files that are automatically downloaded and stored on the hard drive of the user's computer when browsing a specific web page, which allow the Internet server to remember some data about this user, including their preferences for viewing pages on that server, username, and password.

On the other hand, web beacons are images inserted on a web page or email, which can be used to monitor the behavior of a visitor, such as storing information about the user's IP address, duration of interaction time on that page, and the type of browser used, among others.

The Holder agrees that CRN ALKOT S.A. DE C.V. may also obtain Data from the Holder through other means, such as information obtained from other commercially available sources, such as telephone directories, work directories, business cards, public databases, etc.

All the information and Data we collect about the Holder may be combined for the purposes permitted under this Privacy Notice.

USE OF DATA

CRN ALKOT S.A. DE C.V. may use the Data for any of the following purposes:

Improvement of the business process: For statistical information, internal processing data, commercial promotions, marketing studies, commercial offers, surveys, advertising matters, or similar, we may require general information such as name, address (home and office), telephone numbers, fax, and email address, information about commercial or consumption preferences, and age ranges.

These Data may be used, among other purposes, to (I) Provide you with the goods and/or services you have requested or expressed interest in; (II) Ensure efficient service and provide better user attention, as well as to improve your experience in using certain products and/or services; (III) Send you and present goods and/or services that may be relevant or attractive to you, including your participation in promotions, offers, and advertising campaigns; (IV) Inform you about changes or new products or services related to those contracted or acquired by the customer; (V) Fulfill obligations contracted with our customers; (VI) Evaluate the quality of service, or conduct internal studies on consumption habits.

Contact or work information: For job offers or requests, submission of resumes, work records, or any other similar, we may require or provide Data such as name, address, telephone numbers, cell phones, fax, email, photographs, information about academic degrees, information regarding academic and work history (previous jobs), and data related to interest in job positions, including skills and capabilities, contact information, socio-economic level, and job aspirations (including salary).

These Data may be used, among other purposes, for (I) internal purposes of CRN ALKOT S.A. DE C.V., including keeping them as work records within the Human Resources area of CRN ALKOT S.A. DE C.V.; (II) labor hiring or provision of independent services; (III) providing references in case another person or company requests information about possible candidates for a position, job, or commission; (IV) for internal legal purposes, including compliance with Social Security obligations or similar; (V) for publication purposes if required as part of a human resources offering strategy.

Information for commercial operations: For commercial operation purposes, such as financial information, including credit card number; and other exclusive information, such as user identification and passwords, billing or transactional information, bank details, etc. The aforementioned financial information, including credit card numbers, is used exclusively for processing credit requests, payments, and fraud prevention.

STORAGE, DISCLOSURE, AND TRANSFER OF DATA

The Data may be transferred, stored, and processed in a country other than where it was provided, in which case we transfer the information in accordance with applicable information protection laws.

If you do not express your opposition to the transfer of your Data, it will be understood that you have given your consent for it.

Regardless of the above, CRN ALKOT S.A. DE C.V. may also provide part of the Data to providers of goods or services that need to know this information.

Among these providers are, in an illustrative but not limited manner, credit card processors, customer service providers, and real-time support providers, marketing, email service providers, automated data processors, and carriers. Such service providers are contractually obligated to maintain the confidentiality of the Data in accordance with this Privacy Notice.

STORAGE OF DATA

Once the data is received, it will be processed and stored in a database that may be managed by CRN ALKOT S.A. DE C.V. or by a third party (inside or outside the country where the Data was provided) with which CRN ALKOT S.A. DE C.V. has a contract for this purpose. CRN ALKOT S.A. DE C.V. will incorporate protection mechanisms to prevent "to the extent possible" deviations, tampering, loss, consultation, or unauthorized treatment of the Data.

CONFIDENTIALITY

CRN ALKOT S.A. DE C.V. will not disclose the data to unauthorized third parties unless such disclosure is required by law or order of authority.

ARCO RIGHTS

The Holder has the right to access, rectify, and cancel their Data, as well as to oppose their treatment or revoke the consent granted for this purpose, through the procedures established in this Privacy Notice.

The Holder will have the right to access their personal information stored in the CRN ALKOT S.A. DE C.V. database and rectify, limit, or update it as required, for which they must send a request by email.

The request for access, rectification, cancellation, or opposition must contain and be accompanied by the following:

• The Holder's name and address or other means to communicate the response to their request;

• The documents proving identity or, where appropriate, the legal representation of the Holder;

• A clear and precise description of the personal data regarding which one of the aforementioned rights is sought to be exercised, and

• Any other element or document that facilitates the location of the Holder's personal data.

In case of total cancellation of Data or revocation of consent, these must be carried out in accordance with the provisions of the previous section.

Cancellation of Data will lead to a blocking period after which the Data will be deleted. CRN ALKOT S.A. DE C.V. may retain the Data solely for the purposes of liabilities arising from the treatment.

When the Data has been transmitted prior to the date of rectification or cancellation and continues to be processed by third parties, CRN ALKOT S.A. DE C.V. must inform said third parties of the request for rectification or cancellation, without any additional obligation on its part.

CRN ALKOT S.A. DE C.V. shall not be obliged to cancel the Data when:

• They must be processed by legal provision;

• They hinder judicial or administrative actions related to tax obligations, investigation, and prosecution of crimes, or updating of administrative sanctions;

• They are necessary to protect legally protected interests of the Holder;

• They are necessary to carry out an action in the public interest;

• They are necessary to comply with a legally acquired obligation.

MODIFICATIONS

CRN ALKOT S.A. DE C.V. reserves the right to make modifications at any time to these privacy policies and adapt them to legislative novelties, jurisprudence, as well as market practices. The Holder agrees and consents that any changes to this "Privacy Notice" or privacy policies be notified by publication on the CRN ALKOT S.A. DE C.V. website. It is the Holder's obligation to periodically visit said site to verify the most current version of the Privacy Notice.

I CONFIRM THAT I HAVE READ, AND THAT I UNDERSTAND AND ACCEPT THE TERMS AND CONDITIONS OF THIS PRIVACY NOTICE.