ESEASA CONSTRUCCIONES S.A. DE C.V. (hereinafter, “ECO”), with address at Calle Montecito, Number 38, Floor 31, Office 32, Colonia Nápoles, Benito Juárez Borough, Mexico City, Postal Code 03810, is committed to protecting your personal data and assumes responsibility for its use, handling, and confidentiality in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties. To inform you about the main characteristics of the processing to which your personal data will be subject, ECO issues this Privacy Notice.

Personal data subject to processing by ECO

To fulfill the purposes set forth in this Privacy Notice, ECO will directly collect the following information:

• Identification data,
• Contact data,
• Location data,
• Employment data,
• Academic data,
• Financial and/or asset data, and
• Geolocation data

ECO may collect personal data indirectly through publicly available sources or when such data is provided by companies belonging to Grupo ESEASA and third parties with whom ECO has commercial or service agreements. ECO may also collect information from minors or individuals under guardianship. The processing of such data will only be carried out when prior consent from the parent or legal guardian has been obtained, in order to fulfill the purposes of this Privacy Notice.

ECO may process personal data of third parties (as beneficiary, obligor, guarantor, representative, proxy, shareholder, or other participant) when you provide their information to fulfill obligations arising from the product or service contracted. In such cases, you acknowledge that you have informed said third parties about the use of their data and have obtained their prior consent.

Sensitive data

In addition, ECO will collect the following categories of sensitive personal data:

• Biometric data,
• Health data,
• Data on ethnic origin, indigenous people or community.
• Primary purposes

ECO will process the personal data described in this Privacy Notice for the following primary purposes:

• Verify, confirm, and validate your identity;
• Consult your credit history;
• Obtain banking and commercial references;
• Evaluate your application to contract our products and services;
• Comply with the contractual relationship arising from the products and services contracted;
• Administer, operate, and monitor the products and services requested or contracted with ECO;
• Integrate and update your file and databases for the operation of your contracted products and services;
• Contact you through different communication channels to manage the relationship derived from the products and services contracted with us;
• Carry out collection activities;
• Issue tax receipts;
• Handle and follow up on your inquiries, clarifications, and complaints;
• Develop and monitor risk profiles and models;
• Conduct analysis to determine your legal standing, including whether you are subject to lawsuits;
• Identify and prevent potential unlawful conduct that could constitute a violation of applicable legal provisions;
• Carry out internal and external audit processes;
• Comply with obligations established by applicable legislation;
• Respond to lawful requests from competent authorities;
• If you are a representative or proxy, ECO will process your data to administer, operate, and manage the fulfillment of the contract you sign as the legal representative of a third party.

Secondary purposes

Additionally, if you do not object, ECO may process your personal data for the following secondary purposes:

• Send advertising, promotional information, and commercial prospecting regarding our products and services, according to your profile;
• Offer products and services from companies belonging to Grupo ESEASA;
• Send invitations to participate in programs, activities, campaigns, contests, tests, and events organized by ECO;
• Conduct consultations or surveys regarding our products and services, or arising from programs, activities, campaigns, contests, and events organized by ECO;
• Refer products and/or services of third parties with whom ECO has entered into agreements for such purpose;
• Analyze your commercial profile to understand your preferences, consumption, assets, and financial solvency, as well as to determine your financial health;
• Carry out statistics, models, or market studies related to the products and services contracted with ECO;

If you do not wish ECO to process your personal data for any of the purposes described in this section, you may request so by sending an email to: protecciondedatospersonales@eseasaconstrucciones.com . If we do not receive your objection within 5 business days from the date your data is collected, your consent will be deemed granted.

Transfer of personal data

ECO may transfer your personal data in the following cases:

• Companies belonging to Grupo ESEASA when required to fulfill the purposes set out in this Privacy Notice. These companies operate under privacy policies that comply with the applicable provisions;
• Third parties with whom agreements are in place for the commercialization of products and/or services for the benefit and/or interest of clients;
• Third parties with whom we have a commercial and/or collaboration relationship;
• Third parties with whom agreements exist for the benefit and/or interest of clients, to fulfill the legal relationship between the parties;
• Debt-acquiring companies with whom a portfolio sale agreement is executed;
• Notaries Public for the formalization of transactions;
• Specialized service providers and financial institutions to address requirements arising from supervisory powers, prudential obligations, justice, auditing, and/or the prevention and detection of irregularities or crimes;
• Government entities for the monitoring and fulfillment of ECO’s obligations arising from your participation in raffles, contests, or activities with them;
• Competent authorities in cases provided by law.

Where necessary, ECO will request your consent for the transfer of your data and will communicate this Privacy Notice so that your personal data is processed under its terms.

Means and procedure to exercise ARCO Rights and/or revoke consent for personal data processing

You or your legal representative may exercise your rights of access, rectification, cancellation, or opposition, as well as revoke your consent for the processing of your personal data by sending an email to: protecciondedatospersonales@eseasaconstrucciones.com .

Your email must include the subject line “ARCO Rights Request” (hereinafter, the “Request”) and contain all elements required by applicable regulations. For ECO to follow up on your Request, you or your legal representative must duly prove your identity by attaching a copy of a valid official identification.

If the information provided in the Request is erroneous or insufficient, or if the corresponding supporting documents are not attached, ECO may, within five (5) business days following receipt of the Request, require you to provide the elements or documents necessary to process it. You will have ten (10) business days to respond, counted from the day after you receive the requirement. If no response is provided within that period, the Request will be considered not submitted. ECO will communicate the determination adopted within a maximum of twenty (20) business days from the date the Request was received and, if appropriate, will make it effective within fifteen (15) business days following the communication of the response. The response will be provided by the means indicated in your Request.

Options and means to limit the use or disclosure of personal data

You may limit the use or disclosure of your personal data by sending an email to: protecciondedatospersonales@eseasaconstrucciones.com . The requirements to verify your identity and the procedure to address your request will follow the same criteria indicated in the previous section. If your request is deemed appropriate, ECO will register you in its own exclusion list.

Additionally, if you wish to stop receiving advertising or promotions of our products and services, you may submit the same request under the same criteria indicated above. If appropriate, ECO will register you in its exclusion list.

Changes to this Privacy Notice

ECO reserves the right, at its sole discretion, to change, modify, add, or remove parts of this Privacy Notice at any time. In such case, ECO will keep its current Comprehensive Privacy Notice available on the website www.eseasaconstrucciones . We recommend visiting this page periodically to stay informed of any changes to this Notice.