Privacy Notice

Dear Customer,

The protection of your personal data is very important to ALUS, S.A. DE C.V., (hereinafter referred to as "ALUS" with address at Av. Circuito Interior Melchor Ocampo No. 469, Piso 3, Col. Anzures, Miguel Hidalgo, C.P. 11590, Mexico City, with website: https://www.alus.com.mx/, who makes available to you the present:

The purpose of which is to inform you about the type of personal data (the "Personal Data") that we may collect from you, how we use, handle and use them; in compliance with the provisions of the Federal Law for the Protection of Personal Data in Possession of Individuals, its regulations and applicable guidelines (the "Law").

Our customers provide Personal Data to ALUS, directly, indirectly, personally or through its subsidiaries, subsidiaries, affiliates, affiliates, controllers and/or business allies, through offices, telephone, email, mobile applications, website, WhatsApp, SMS and/or at corporate offices; which may include:

i. Simple Personal Data:

1. Full name, official identification, CURP, address, email, phone; and
2. Invoicing: name of individual or legal entity to invoice, Federal Taxpayers Registry (RFC) / Tax Identification Number (CIF), email.

ii. Sensitive Personal Data:

1. From your payment: (i) bank account (for payment of services and/or products) which may be credit card, debit card (bank institution, account number, bank CLABE and branch).

Also, our website may contain hyperlinks (links), banners and/or buttons that may redirect users to other portals or Internet sites owned or operated by third parties and other services that may be shared with third parties. Personal data provided by users on such portals or Internet sites are not covered by this privacy notice, therefore their treatment is not the responsibility of ALUS. Any information provided by users on third party sites or portals will be subject to the respective privacy notices contained in each of them.

To obtain more information from you, we may use cookies, web beacons and/or similar technological elements to obtain information such as: browser type and operating system; web pages you visit; links you follow; IP address; sites you visited before entering our site; user recognition; detect salient information; and measure certain traffic parameters. These technologies can be disabled by following the procedures indicated below according to the type of browser you use:

Internet Edge: https://privacy.microsoft.com/es-ES/windows-10-microsoft-edge-and-privacy;

Internet Explorer: https://support.microsoft.com/es-mx/help/17442/windows-internet-explorer-delete-manage-cookies;

Firefox:http://support.mozilla.org/es/kb/Habilitar%20y%20deshabilitar%20cookies?s=deshabilitar+cookies&r=0&e=en&as=s;

Opera: http://help.opera.com/Windows/11.50/es-ES/cookies.html;

Safari for IPHONE, IPAD, and IPOD TOUCH: https://support.apple.com/es-es/HT201265;

Safari for MAC: https://support.apple.com/es-mx/guide/safari/sfri11471/mac ; and

Chrome: http://support.google.com/chrome/bin/answer.py?hl=es&answer=95647

For more information about cookies, visit http://www.allaboutcookies.org.

We understand that the Personal Data of third parties (such as data of senders and/or recipients, personal and/or commercial references) that you provide us, already have the authorization of its owner to be delivered and processed by us in accordance with this PRIVACY NOTICE.

1. Primary Purposes:
   The primary purposes applicable to the Personal Data (the "Primary Purposes") will be: to identify you as a customer, to know your needs, to contact you and be able to follow up on your interest in the services of design, development and/or administration of digital platforms for loyalty programs, purchase of products; to prepare documents, contracts, agreements, invoices, receipts and/or documentation related to our products and linked to our relationship; to receive and/or process payments; storage; and to comply with terms and conditions that we have established with you.
2. Secondary Purposes:
   The secondary purposes applicable to the Personal Data (the "Secondary Purposes") will be: statistics; marketing and prospecting.

The Personal Data and its confidentiality are protected by administrative, technical and/or physical security measures to prevent damage, loss, alteration, destruction, use, access or improper disclosure, for example, the Personal Data is stored in an internal database, whose administration is through passwords that change periodically and whose access is restricted to authorized persons; confidentiality agreements with its personnel, among others.

ALUS may transfer your Personal Data inside and outside the country, in order to comply with the contracted services, and this transfer may be to:

1. Companies of the same group of ALUS;
2. Courier and/or parcel delivery companies for the purpose of complying with the services contracted by you or for the redemption programs that we are contracted by our clients;
3. our service providers and subcontractors engaged to perform functions on our behalf or provide services to us (such as warehousing and delivery; marketing and advertising; legal, auditing, accounting and other professional service providers; and other services related to our business), provided that such service providers do not collect, use or disclose personal information for any purpose other than to perform such functions on our behalf to provide services to us, or as otherwise required by law;
4. carefully selected third parties, including our affiliates, to send you marketing information and promotions from third parties that may be of interest. In such circumstances these organizations may be governed by confidentiality obligations and restrictions on the use of your personal information. We will obtain your express permission before allowing a non-affiliated third party to send such marketing and/or promotional information; and
5. law enforcement, governmental or regulatory agencies or other third parties in order to comply with applicable law.

You have the right to access, rectification and cancellation of your Personal Data, to oppose the processing thereof or to revoke your consent (collectively "ARCO Right(s)").ARCO Right(s)"). To do so, it is necessary that you submit a written request for the exercise of the ARCO Right addressed to the Legal Department of ALUS, responsible for the protection of Personal Data, located at the address indicated above, or, alternatively, you may contact us via email at legal@alus.com.mx ("Request"); in both cases, acknowledgement of receipt must be received in order for ALUS to be bound in this regard. Such Request shall contain the following information: your full name; e-mail address to receive notifications; a simple copy of your official identification with photograph; a clear and precise description of the Personal Data with respect to which you seek to exercise some of the ARCO Rights; a description of any element or document that facilitates the location of your Personal Data; and your signature on the Request .

In case of requesting the exercise of the right of: Rectification, you must indicate the modifications to be made and provide the documentation that accredits and supports the request; and Access; ALUS will provide the Personal Data via email and/or by appointment at corporate offices, at ALUS' choice.

Within a maximum period of 20 (twenty) business days from the acknowledgment of receipt of the Request, the request must be answered and you will be informed about the merits or not of the request by means of a notice sent to the e-mail address provided to receive the notification. In case your Request is accepted, ALUS shall make it effective within the following 15 (fifteen) business days, counted from the receipt via e-mail of the acceptance of your Request.

In addition to the procedure for the exercise of the ARCO Right, you have the right, in relation to the Secondary Purposes to: revoke or express your refusal to process your Personal Data; and/or to be included in the "Exclusion List" enabled and owned by ALUS that allows us to limit the use and disclosure of Personal Data. For both effects just send us the request to revoke or be excluded, which must contain: name(s) and surname(s); and e-mail account to answer your request, it must be addressed to the Legal Department of ALUS, responsible for the protection of Personal Data, to the following e-mail legal@alus.com.mx and you must receive acknowledgement of receipt so that ALUS is bound in this regard. The acknowledgement of receipt includes proof of revocation and/or registration in the "Exclusion List". ALUS has a maximum of 5 (five) business days to respond.

All documentation must be sent in PDF file format, legible and complete, so that ALUS can attend the Request.

In case of acting through a representative in any of the above mentioned requests, you must prove the existence of the representation, by means of a public instrument or power of attorney signed before two witnesses, if applicable, and also send a simple copy of the official identification of your representative.

If you consider that your right to protection of Personal Data has been violated by ALUS or presume that in the processing of your Personal Data there is any violation of the provisions of the Law, you may file a complaint or denunciation before the National Institute of Transparency, Access to Information and Protection of Personal Data, INAI(www.inai.org.mx), within 15 (fifteen) days from the date you receive the response from ALUS or from the end of the period of 20 (twenty) days from the date of the acknowledgement of receipt of the Request for exercise of rights.

1. Important: Any modification to this PRIVACY NOTICE will be made known to you on this same Internet site:https://www.alus.com.mx/, located at the bottom of the home page in the PRIVACY NOTICE section, without it being necessary to communicate such modification to you individually.

NONDISCLOSURE AGREEMENT