Comprehensive Privacy Notice – Vendors and Vendor Personnel

Bello, Gallardo, Bonequi y García, S.C. (hereinafter “bgbg”) is the data controller for your personal data. Bgbg designates the following address for service of process and receipt of notifications: Avenida Santa Fe, No. 428, Tower 1, 14th Floor, Cuajimalpa de Morelos Municipality, Postal Code 05348, Mexico City, Mexico.

To fulfill the purposes described in this Privacy Notice, bgbg will process the following categories of personal data:

• Identifying and contact information.
• Employment data.
• Financial and asset information.

In order to fulfill the purposes set forth in this Privacy Notice, bgbg does not process sensitive personal data. As the data subject, you should refrain from providing this type of information to bgbg.

If you provide bgbg with personal data belonging to third parties (such as professional references) for the purposes identified in this Privacy Notice, you must inform them that their personal data is being processed and provide them with the contents of this Notice. By providing such information, you also declare that you have obtained the prior consent of the data subjects to provide their information to bgbg and that the information is accurate and complete.

Bgbg will process your personal data for the following purposes:

Primary objectives:

1. Identify the individual as a natural person acting as a supplier, or as a legal representative, employee, or contact person of a legal entity acting as a supplier.
2. If applicable, verify your legal status as a legal representative and confirm that you have the necessary authority to represent your principal.
3. Request information about the products or services offered.
4. Analyze the conditions under which the service or product in question operates.
5. Request, review, and evaluate your profile, experience, and compliance with applicable legal requirements in relation to the proposals submitted for the goods or services you provide.
6. Management, oversight, and administration of the bidding processes in which you choose to participate.
7. Analysis and research of commercial, financial, quality, safety, and liability aspects related to the products and services offered.
8. Prepare, manage, formalize, and serve the documents or instruments that set forth the obligations between the parties and their status or compliance.
9. Exchange of physical or electronic documents between bgbg and the supplier.
10. Creation and management of supplier records.
11. If hired, register them as a supplier or professional service provider in our systems and complete the termination or deactivation process when the business relationship ends.
12. To provide you with the necessary assistance if you contact us by phone, email, instant messaging, social media, or through the communication channels established by bgbg.
13. Management and fulfillment of the relevant payment obligations.
14. Ensure compliance with legal provisions regarding the prevention and identification of transactions involving funds of illicit origin, anti-corruption measures, and other applicable regulations; through the implementation of administrative and technical procedures established for such purposes.
15. Monitoring and tracking of physical or digital communications between the supplier and bgbg.
16. Preparation of reports related to activities carried out with the supplier.
17. Statistics and historical records of suppliers

Secondary purposes:

• They don't exist.

Your personal data may be transferred within or outside of Mexico to the recipients and for the purposes identified below:

• Federal, state, and/or municipal governments and authorities; commissions; institutes; regulatory agencies; judicial or administrative authorities; and domestic and/or foreign government entities; in compliance with obligations established under applicable law and/or in response to well-founded and substantiated requests made by any of such entities.
• In such cases, subsidiaries and/or affiliates of bgbg that operate under the same internal processes and policies; for the purpose of centralized information management.
• Banks or other financial institutions, for the purpose of fulfilling payment obligations.

The transfers of personal data described above do not require your consent, as they fall under the exceptions set forth in Article 36 of the Law. Any transfer of your personal data that does require your consent will be disclosed in advance through the appropriate notice and by updating this Privacy Notice.

As the subject of personal data, you may exercise any of your rights of access, rectification, erasure, or objection (hereinafter, “ARCO Rights”). These rights include:

• Access: the right to know what personal data we hold about you, as well as information about how we process or share it.
• Correction: the right to request, at any time, the correction of your data if it is inaccurate or incomplete.
• Deletion: the right to have the processing of your personal data ceased, beginning with the blocking of such data and followed by its deletion.
• Right to object: the right to object, on legitimate grounds, to the processing of your personal data.
  To exercise any of your ARCO rights, you may submit a request by sending an email to datospersonales@bgbg.mx

Your application must include:

1. Your full name and address, or another way to receive a response to your request.
2. A copy of a document proving your identity and, if applicable, proof of legal representation if someone is exercising this right on your behalf.
3. A clear and precise description of the ARCO rights you wish to exercise and the personal data related to your request; and
4. If applicable, any other information or documents that help us identify your personal data or support your request in cases where you are requesting a correction or objecting to the processing.

Bgbg will respond to your request within 20 (twenty) business days of the date it is submitted and received. If the request is deemed valid, we will process it within 15 (fifteen) business days of the date we communicate our response. If the information and/or documentation provided in your request is incomplete, erroneous, and/or insufficient, or if the necessary documents to verify your identity or legal representation are not included, we will request that you correct and remedy these deficiencies so that we may process your request. You will have 10 (ten) business days to comply with the request and correct the application; otherwise, it will be deemed not to have been submitted.

The use of electronic means to exercise your ARCO rights authorizes bgbg to respond to your request via the same means, unless you clearly and explicitly specify another method of contact in your request.

The right to erasure is not absolute. Please note that bgbg must retain certain information to comply with various legal obligations and, in doing so, may share your personal data with other entities or organizations. In such cases, you may need to exercise your right to erasure by contacting the entity that received your personal data.

In some cases, you may withdraw your consent to the processing of your personal data; however, this withdrawal cannot have retroactive effect, meaning it cannot affect situations, procedures, or transfers that took place before you withdrew your consent.

Please note that there may be public policy provisions requiring bgbg to retain your information for a minimum legal period; in such cases, we will retain your information solely to comply with those legal provisions.

If you wish to withdraw your consent, you may submit a request by following the instructions for exercising your ARCO rights and sending an email to datospersonales@bgbg.mx

You may restrict the use or disclosure of your personal data by submitting a request to our Personal Data Department, following the procedure and instructions applicable to the exercise of ARCO rights.

Bgbg has the means and procedures in place to ensure that certain data is included in its own opt-out lists, thereby preventing the disclosure of such data. In such cases, we will provide data subjects who request to be added to the list with the corresponding proof of registration.

Bgbg reserves the right to modify, update, expand, and/or change the content and scope of this Privacy Notice at any time and at its sole discretion. In such cases, you may request the most recent version of the Privacy Notice from our Personal Data Department by emailing: datospersonales@bgbg.mx