A. Identity and Domicile of the Data Controller

Pursuant of the provisions of the Federal Law on Protection of Personal Data Held by Individuals (the "LFPD"), and the remaining applicable provisions, Bello, Gallardo, Bonequi y García, S.C. (hereinafter and indistinctly, "BGBG" or the "Data Controller"), with domicile for service of process in Agustín Manuel Chávez, número 1-001, Centro de Ciudad de Santa Fe, Zip Code: 01210, Mexico City, Mexico, explicitly informs that:

B. Personal Data Collected and Submitted to Processing

For the development of the purposes described in this Privacy Notice, we collect the following categories of personal data:

• Identification data;
• Personal data;
• Employment details;
• Commercial information data;
• Economic, financial, and insurance data.

C. Sensitive personal data processing. Health data

The Data Controller will not collect sensitive personal data for the purposes listed in the next section.

D. Processing purposes

• Origine and necessary purposes
  • Supplier registration and payment.
  • Compliance with the tax obligations related to suppliers.
  • Service contracting.
• Additional purposes
  • There are none.

E. Personal data transfer

The Data Controller may carry out the transfer of your personal data to the corresponding authorities to comply with the current tax legislation.

F. Data transfer consent

Your personal data will not be transferred to third parties without your consent, except on the cases foreseen in Article 37 of the LFPD and all cases in compliance with the conditions foreseen in Article 17 of the LFPD Regulations.

H. Consent revocation

You may revoke your consent to the processing of your personal data, without any retroactive effect, if such revocation does not imply the impossibility of complying with obligations arising from a legal relationship in force between you and the Data Controller.

The procedure for the revocation of consent will be the same as the procedure established in the section above for the exercise of ARCO rights, if applicable.

G. ARCO rights exercise

In all legally proceeding cases, you may exercise at all moments your rights to access, rectify, cancel, and Oppose (ARCO Rights) through the procedures that we have implemented.

The corresponding request must fulfill the requirements established by the current legislation, through a written document addressed to our Personal data Controller, with domicile in Agustín Manuel Chávez, # 1-001, Centro de Ciudad de Santa Fe, Zipcode 01210, Mexico City, Mexico.

The request must contain and be accompanied by the following:

1. Your name and domicile or another mean to inform you the response to your request;
2. The documents proving your identity or, when applicable, the legal representation;
3. The clear and precise description of the personal data from which the intention is to exercise some of the ARCO Rights; and
4. Any other element or document that facilitates the localization of the personal data.

The Data Controller will inform you of the decision taken within a maximum of 20 (twenty) business days from the date it receives the relevant request. If the request is applicable, it will be effective within fifteen business days from the date on which the Data Controller communicates the response. In case the information provided in your request is incorrect or insufficient, or the necessary documents to prove your identity or the relevant legal representation are not attached, the Data Controller, within 5 (five) business days following the receipt of your request, will require the amendment of the deficiencies to be able to process it. In these cases, you will have ten business days to respond to the request for amendment, counted from the day after you have received this request. The request will be deemed as not filed if you do not respond within that period.

You may obtain the requested information or personal data through uncertified copies, electronic documents in conventional formats (Word, PDF, etc.), or through restricted and authorized access to the system processing your personal data (access) or through any legitimate means guaranteeing and accrediting the effective exercise of the requested right.

Alternatively, the Owner may direct your request through our email address datospersonales@bgbg.mx, in compliance with all the requirements previously numbered, established as Subject of the communication "ARCO Rights and/or consent withdrawal." The procedure terms will be the same as the ones mentioned in this section. The use of electronic means for the exercise of the ARCO Rights authorizes the Data Controller to answer the corresponding request through the same means unless the owner clearly and expressively points to another means.

You will be responsible for keeping updated your personal data in possession of the Data Controller. Therefore, you guarantee and are responsible, in any case, for the truthfulness, accuracy, validity, and authenticity of the personal data provided and undertake to keep them duly updated, communicating any changes to the Data Controller.

I. Limitations on Disclosure of Your Personal Data.

You may limit the use or disclosure of your personal data by addressing the relevant request to our Personal Data Area. The requirements for proving your identity, as well as the procedure for dealing with your request, will be the same as those indicated in section G. of this Privacy Notice (ARCO rights exercise).

J. Amendments or Updates to this Comprehensive Privacy Notice

The Data Controller may modify, update, extend, or otherwise change the content and scope of this Privacy Notice at any time and at its complete discretion. In such cases, the Data Controller will communicate such changes through an email, when such means had been established as a communication channel between you and the Data Controller due to the legal relationship linking you with the company.

The current Comprehensive Privacy Notice can also be read on www.bgbg.com.mx in the "Privacy Notice" section.