Privacy Notice

NAVESCO, hereinafter THE CONTROLLER, with address at Av. Naciones Unidas #6780, Level 2, Offices A, Loma Real, Zapopan, Jalisco C.P. 45129.

DESCRIPTION OF THE NOTICE

The terms used in this privacy notice shall have the meaning assigned to them by the Federal Law on Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on 5 July 2010, hereinafter “THE LAW”.

PERSONAL DATA COLLECTED BY THE CONTROLLER

The personal data that THE CONTROLLER may collect includes: a) For individuals: full name, date of birth, place of birth, nationality, CURP, address, tax ID (RFC); b) For legal entities: corporate name; incorporation details, such as the number of the deed or instrument containing it, date of incorporation, the notary before whom it was incorporated, date of registration with the public property registry; full name of the legal representative and details of their representation, such as the number of the deed or instrument containing it, the date of that deed or instrument, the notary who attested it; and date of registration with the public property registry; c) Payment method information; d) all information the user has provided and/or provides throughout the contractual or commercial relationship established between them; e) data belonging to and related to the services THE CONTROLLER provides in fulfilling the obligations agreed with THE DATA SUBJECT; and e) as well as any other data collected from time to time in connection with the provision of the Services.

The data collection carried out by THE CONTROLLER is made in good faith and it is therefore presumed that the data is truthful, correct and complete and identifies the data subject who supplies and/or provides it. It is therefore the data subject's responsibility to ensure that the data provided to THE CONTROLLER meets those criteria and is updated as required.

THE CONTROLLER reserves the right to take whatever action it deems appropriate in the event of false data.

PURPOSE OF DATA PROCESSING

Please be advised that the personal data of THE DATA SUBJECT currently held or held in future in our databases will be processed and/or used by THE CONTROLLER solely to provide the services requested from and/or contracted with THE CONTROLLER by THE DATA SUBJECT, as well as to carry out the actions necessary to fulfill the obligations arising from the contractual and/or commercial relationship between you as the data subject and THE CONTROLLER. That is, the personal data of THE DATA SUBJECT will only be processed and/or used for the existence, maintenance and fulfillment of the legal relationship between the controller and the data subject.

The user acknowledges that, pursuant to article 10, section IV of the Law, the user's consent is not required for the processing of personal data where the purpose is to fulfill obligations arising from a legal relationship between the data subject and the controller.

Consequently, the user acknowledges and accepts that they may not cancel and/or object to the processing of personal data where doing so may affect and/or restrict the fulfillment of obligations arising from the legal relationship between the data subject and the controller, or the performance of acts necessary to fulfill the obligations arising from the contractual and/or commercial relationship between you as the data subject and THE CONTROLLER.

DATA TRANSFERS

Please be advised that your personal data may be transferred and processed inside and outside the country. Accordingly, your information may be shared with third parties who, given the nature of the legal and/or contractual relationship they hold with THE CONTROLLER, or by reason of their work or duties, need to process and/or use your personal data. Such transfer will be for the sole purpose of enabling THE CONTROLLER to fulfill the obligations arising from the contractual and/or commercial relationship existing between you as the data subject and THE CONTROLLER.

Please be advised that, pursuant to article 37, section IV of the Federal Law on Protection of Personal Data Held by Private Parties, your consent is not required for those data transfers necessary by virtue of a contract entered into in the data subject's interest by the controller and a third party, nor for those data transfers necessary in order to fulfill the obligations arising from the legal relationship between the data subject and the controller, such as those described above.

OPTIONS AND MEANS FOR LIMITING THE USE OR DISCLOSURE OF PERSONAL DATA:

THE DATA SUBJECT is advised that the personal data provided will be handled confidentially, limiting its use to the purposes described in this Privacy Notice.

THE CONTROLLER will maintain security and confidentiality policies and procedures to ensure that all of your personal data is kept secure. In addition, THE CONTROLLER will take technological, physical and administrative security measures to prevent damage, loss, alteration and/or destruction of the user's personal data, as well as its improper use, access, disclosure or processing. These measures will also be adopted so that this privacy notice is respected at all times, both by THE CONTROLLER and by the third parties (holding a legal relationship with the data subject) to whom personal data of the data subject has had to be transferred in order to fulfill the obligations arising from the legal relationship between the controller and the data subject.

Under no circumstances will THE CONTROLLER market, sell or rent the personal information of THE DATA SUBJECT, nor will we transfer your personal information to third parties without your consent, except for the cases provided for in article 37 of the Federal Law on Protection of Personal Data Held by Private Parties.

Nevertheless, should you have any questions regarding the procedures relating to the options and means for limiting the use or disclosure of your personal data, you may write to contacto@gruponavesco.com

MEANS FOR REVOKING CONSENT TO THE PROCESSING OF YOUR DATA, LIMITING ITS USE OR DISCLOSURE, OBJECTING TO ITS PROCESSING; AND EXERCISING ARCO RIGHTS (ACCESS, RECTIFICATION, CANCELLATION AND OBJECTION)

Under the terms set out in the Federal Law on Protection of Personal Data Held by Private Parties, the Data Subject has the right at any time to state their refusal to have their personal data processed, as well as to revoke the consent granted to THE CONTROLLER for the processing of their personal data, to limit its use or disclosure and to object to its processing. Likewise, the data subject may at any time exercise their rights of Access, Rectification, Cancellation and Objection (“ARCO”).

This is done by sending the corresponding written request to the PERSONAL DATA DEPARTMENT at the following email address: contacto@gruponavesco.com

It is understood that, in order for THE CONTROLLER to address any of the requests referred to in this section correctly and promptly, the data subject's request must satisfy and/or contain at minimum: the data subject's full name, address, mobile phone number or other means of communicating the response to their request, documents proving the identity or, where applicable, the legal representation of the data subject, a brief description of the purpose of the request, and the reasons behind it. In the case of rectification of data, the data subject must additionally indicate the changes to be made and provide documentation supporting their request.

The response to the aforementioned request will be sent to the sender's email address within a maximum of twenty days from the date the request was received. Should your request concern the right of access, the information or personal data requested will be provided in electronic form.

Should you have any questions regarding the exercise of the rights mentioned in this section, you may write to contacto@gruponavesco.com

PROCEDURE AND MEANS BY WHICH THE CONTROLLER WILL NOTIFY DATA SUBJECTS OF CHANGES TO THE PRIVACY NOTICE.

THE CONTROLLER expressly reserves the right, at its sole discretion, to change, modify, add to or remove parts of this Notice at any time, in which case THE DATA SUBJECT will be notified in printed form, which will be sent to the address of THE DATA SUBJECT held in our database.

I hereby state that the privacy notice of NAVESCO, has been made available to me, and that I have no objection to the processing THE CONTROLLER will give to my personal data.

The consent now given does not imply waiving the right to revoke it in future, nor waiving the rights of Access, Rectification, Cancellation and Objection (“ARCO”), which may be exercised at any time and under the terms set out in the aforementioned PRIVACY NOTICE.