PRIVACY NOTICE INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE)

 At INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (hereinafter referred to as ISTONE), we believe that our most valuable asset is our clients. That’s why we implement strict privacy guidelines, policies, procedures, and programs to protect your information. As a client of INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE), you have access to a wide range of products and services, with the assurance that your personal data is secure. The protection of your information is a priority for us, which is why we safeguard it using high-level technical, physical, and administrative security measures. Furthermore, on July 5, 2010, the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter the “Law”) was published in the Official Gazette of the Federation. The provisions of this Law support our commitment to protecting your personal data. You may consult the full text of the Law at the following government websites:

http://www.ordenjuridico.gob.mx and http://www.diputados.gob.mx. In compliance with our Privacy Program and the Law, we inform you that the personal data obtained as part of the services you request or enter into with INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE) will be treated as confidential, following strict protocols and protection systems.

Data Controller INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE) is responsible for the processing of your personal data. We collect your data in order to provide professional, banking, or financial services, and to formalize any agreements or service contracts. We may also collect personal information to grant you access to our offices or facilities.

Controller’s Address For the purposes of this Privacy Notice, our legal address is: Avenida Ricardo Margain No. 575, Colonia Santa Engracia, C.P. 66267, San Pedro Garza García, Nuevo León, Mexico.

Personal Data CollectedINTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE) will collect the personal data necessary to provide you with the services you request and to formalize any agreements.

The categories of personal data that may be collected and processed include: I. Identification data II. Contact information III. Core personal data IV. Financial information; INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE) may carry out investigations or take actions it deems necessary to verify the accuracy of the information provided, including consulting third parties, authorities, or institutions.

 The personal data collected will be used to fulfill your service requests or to maintain and execute any legal relationships with INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE). Additionally, and with your prior consent, we may use your data for: I. Marketing, advertising, and commercial prospecting; II. Sending promotions or information on other related goods or services.

 Data Transfers INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE) may transfer your personal data to third parties, both domestic and foreign, when such transfer: I. Is permitted under applicable laws or treaties to which Mexico is a party; II. Is necessary for medical prevention, diagnosis, treatment, or healthcare services; III. Is made to holding companies, subsidiaries, affiliates, or associated entities under common control of INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE); IV. Is required due to a contract in the interest of the data subject, between INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE) and a third party.; V. Is necessary or legally required to safeguard public interest or ensure justice; VI. Is needed for the recognition, exercise, or defense of a right in legal proceedings; VII. Is necessary to maintain or fulfill a legal relationship between INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE) and the data subject.

Revocation of Consent If you wish to revoke your consent after entering into a product or service agreement with INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE), you may request a revocation form at our Customer Service Center or offices. Once the request is received and your identity is verified, we will exclude you within 35 business days from marketing, advertising, or commercial prospecting campaigns.

ARCO Rights (Access, Rectification, Cancellation, and Opposition) You or your duly authorized legal representative may limit the use or disclosure of your personal data, as well as exercise, when applicable, your rights of Access, Rectification, Cancellation, and Opposition, as provided by law. To do so, you must fill out the corresponding request form provided by INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE), and attach the documents that verify the identity of the data subject (official photo identification), or, where applicable, those that verify the legal representation of the requester, in accordance with applicable civil legislation. The request must be submitted in person at the offices of INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE).

 The request will be forwarded to the Personal Data Department of INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE), which will process the request within no more than 20 business days from the date of receipt. It is important to note that exercising any of these rights is not a prerequisite nor does it preclude the exercise of any other legal right. Responses to duly submitted requests may be delivered to the requester via email (if an email address is provided), from the address cdelgado@istone.com.mx, by courier, or made available for pickup at INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE) offices, upon verification of identity through any of the aforementioned means. For security reasons, ARCO rights requests sent directly to the above-mentioned email address will not be processed, as it is not possible to verify the identity of the requester through that channel. Additionally, please note that you are entitled to file a Rights Protection Procedure with the Federal Institute for Access to Information and Data Protection (INAI) at www.ifai.gob.mx, within 15 business days from the date you receive INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE) response, or if no response is received, after the 20-business-day period has elapsed since your original request.

 Modifications to the Privacy Notice Any modification to this Privacy Notice will be communicated to you through any of the following means: a written notice sent to your registered address or delivered at any authorized office of INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE); a message included in your account statement; a message sent to your email address or mobile phone; an announcement made through INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE) official communication channels or any electronic platform used to carry out transactions with INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE); or through notices posted at any INTERGIA PROJECTS & RISK MANAGEMENT, S.A. DE C.V. (ISTONE) office. In the event that you are an individual supplier, or a legal representative or shareholder of a supplier and also a natural person, this Privacy Notice shall likewise apply to you. The processing of your personal data will be limited to the purposes established in the agreement or medium through which the legal relationship was formalized.