Comprehensive Privacy Notice — Transformación Puebla

In accordance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations, TRANSFORMACIÓN PUEBLA, S.A. DE C.V. (hereinafter "the Controller"), with registered address at Calle Hidalgo, number 105, Colonia Rafael Ávila Camacho, San Pedro Cholula, State of Puebla, Zip Code 72757, Mexico, is the legal entity responsible for the processing of the personal data it collects from you as the Data Subject. This Comprehensive Privacy Notice supplements any simplified or short privacy notices that the Controller may have made available to you and is supplementary in all matters not expressly addressed by such notices.

1. Purposes of Personal Data Processing

Primary purposes (necessary for the legal relationship):

• Providing the services and/or sale of products you require, in accordance with the proposal presented by the Controller.
• Fulfilling obligations contracted with you, as well as informing you of any situation or change regarding said services.
• Complying with tax, accounting, and legal obligations before competent authorities.
• Managing collections, payments, and invoicing.

Secondary purposes (not necessary, subject to your consent):

• Evaluating the quality of services provided by the Controller and conducting satisfaction surveys.
• Maintaining contact with you to invite you to conferences, courses, or events related to the Controller's services.
• Sending commercial and promotional information about our products and services.

If you do not wish your data to be processed for secondary purposes, you may notify the Personal Data Department through the means indicated in section 6 of this notice.

2. Personal Data We Collect

To carry out the purposes described in this privacy notice, the Controller may collect the following personal data:

Identification data:
• Full name, company name, and/or corporate name
• RFC (Federal Taxpayer Registry)
• CURP (when applicable)

Contact data:
• Email address
• Landline and/or mobile phone number
• Mailing address

Employment data:
• Name of the company you represent
• Position or title

Billing data:
• Tax address
• RFC
• Tax regime
• CFDI use

Browsing data:
• IP address, browser type, pages visited, and cookie data (see our Cookie Policy for more information)

3. Sensitive Personal Data

The Controller informs you that, in order to fulfill the purposes set forth in this privacy notice, it does NOT need to collect sensitive personal data.

4. Personal Data Transfers

Your personal data may be transferred and processed within and outside the country in the following cases:

• To companies within the Controller's corporate group, when necessary for the purposes described in this notice.
• To competent authorities (tax, judicial, federal, or local) to comply with legal obligations.
• To third-party service providers acting as data processors (accountants, lawyers, IT services), under confidentiality conditions.

The Controller commits to not transferring your personal data to third parties outside the aforementioned cases, except in the cases provided for in Article 37 of the LFPDPPP, in which case transfers will be carried out in accordance with said Law.

The aforementioned transfers do not require your consent pursuant to Article 37 of the LFPDPPP.

5. ARCO Rights (Access, Rectification, Cancellation, and Opposition)

You have the right to:

• Access your personal data held by the Controller and know the details of its processing.
• Rectify your data if it is inaccurate or incomplete.
• Cancel your data when you consider it is no longer required for the stated purposes, is being used for purposes not consented to, or the relationship has concluded.
• Oppose the processing of your data for specific purposes.

To exercise your ARCO rights, you must submit a request to the Controller's Personal Data Department, which must include:

• Full name of the data subject and address or email for communication of the response.
• Documents proving your identity (copy of valid official identification).
• Clear and precise description of the personal data for which you seek to exercise an ARCO right.
• Any other element or document that facilitates the location of your data.

The Controller will communicate the determination adopted to the data subject within a maximum period of 20 business days from receipt of the complete request. If the response is favorable, it will be made effective within the following 15 business days.

6. Means to Exercise ARCO Rights and Limit Data Use

To exercise your ARCO rights, revoke your consent, or limit the use or disclosure of your personal data, you may contact the Controller's Personal Data Department:

Data processing officer: Ms. Salomé Noemí Mendoza Pérez Address: Calle Hidalgo, number 105, Colonia Rafael Ávila Camacho, San Pedro Cholula, State of Puebla, Zip Code 72757 Email: [email protected] Phone: +52 222 285 0572 Business hours: Monday to Friday, 9:00 AM to 5:00 PM

7. Revocation of Consent

At any time, you may revoke the consent you may have granted to the Controller for the processing of your personal data. However, please note that we may not be able to fulfill your request or immediately cease processing in all cases, as it is possible that due to a legal obligation we need to continue processing your personal data.

Additionally, you should consider that for certain purposes, the revocation of your consent will mean that we can no longer provide the service you requested, or the conclusion of your relationship with the Controller.

To revoke your consent, please contact the Personal Data Department through the means indicated in section 6 of this notice.

8. Use of Cookies and Tracking Technologies

This website uses cookies and similar technologies to improve your browsing experience, remember your preferences (such as the visual theme), and analyze site traffic. To learn what cookies we use, how we use them, and how to manage them, please refer to our Cookie Policy available on this website.

9. Security Measures

To protect your personal data, we have implemented administrative, physical, and technical security measures to prevent loss, misuse, alteration, unauthorized access, or theft of your information. These measures include:

• Access control to information through user profiles.
• Physical safeguarding of documents containing personal data.
• Information backup and recovery procedures.
• Staff training on proper handling of personal data.

10. Changes to this Privacy Notice

This privacy notice may be modified, changed, or updated due to new legal requirements, the Controller's own needs, privacy practices, or other causes.

The Controller reserves the right to make any necessary modifications or updates to this privacy notice at any time. The updated version will be available at: www.transformacionpuebla.com

We recommend that you periodically review this notice to stay informed about how we protect your information.

11. Right to File Complaints with INAI

If you believe your right to personal data protection has been violated by any conduct or omission of the Controller, or if you suspect any violation of the provisions of the LFPDPPP and its Regulations, you may file a complaint or report with the National Institute of Transparency, Access to Information, and Personal Data Protection (INAI).

For more information, visit www.inai.org.mx or call 800 835 4324 (INAI).

12. Contact

For any questions or clarifications regarding this privacy notice, you may contact us at:

Transformación Puebla, S.A. de C.V. Calle Hidalgo, number 105, Colonia Rafael Ávila Camacho San Pedro Cholula, Puebla, Zip Code 72757, Mexico

Personal Data Department: Officer: Ms. Salomé Noemí Mendoza Pérez Email: [email protected] Phone: +52 222 285 0572 Hours: Monday to Friday, 9:00 AM to 5:00 PM

Sales and general inquiries: Email: [email protected]