Privacy Notice

INSTALLATIONS, WEBSITES, MOBILE APPLICATIONS AND PROMOTIONS

In compliance with the provisions of the Federal Law for the Protection of Personal Data in Possession of Individuals (the “Law”), its regulations and applicable guidelines, we inform you of the following: xxxxxxxxxxxxxxxxx (hereinafter the “Group”), indicating for the purposes of this privacy notice the address located at xxxxxxxxxxxxxxxxxxxxxxxxxxxx, will be responsible for collecting your personal data. It will also be responsible for the use and protection given to such data and to those data collected by any of the companies that are its controlling companies, subsidiaries or affiliates, or by third parties contracted to perform services on behalf of the Group, in accordance with this privacy notice (“the Privacy Notice”).

The processing of your personal data will be carried out in accordance with these terms and conditions, so, from this moment it is understood that you give your consent to such processing.

By virtue of your access to the facilities, websites and/or mobile applications of Grupo xxxxxxxxx as well as your participation in any promotion of the Group, you may provide or provide us with all or some of the following personal data: (i) Identification data: full name, place and date of birth, nationality, age, marital status, gender and image; (ii) Contact data: address, landline and cell phone, and e-mail (hereinafter, “Personal Data”).

Your Personal Data may also be collected by the Group, through:

Automatic devices such as video cameras installed in any of the Group’s facilities.

All social networks (Facebook, Instagram, among others), Short Message Services (SMS) and instant messaging systems over the Internet (WhatsApp, among others).

The Group will not collect Sensitive Personal Data.

Personal Data will be used for any of the following primary purposes:

1. Identify, contact and communicate with you.
2. Send you information and/or merchandise.

Review and address your comments.

3. Communicate with you and participate in promotions of the Group, based on its Terms and Conditions.
4. Record you at any of the Group’s virtual events.
5. Record you and give you access to any of the Group’s facilities.
6. Statistical and advertising purposes.
7. Invite you to participate in Grupo Bimbo’s social networks.
8. Publish anecdotes you wish to share.
9. Allow the download of the Group’s press release.
10. Ensure compliance with all types of legal obligations.
11. Send you notices regarding changes to this Privacy Notice.

The Group will not collect your Personal Data for secondary purposes.

We may collect your Personal Data in different ways: when you provide it to us directly or when we obtain information through other sources that are permitted by law, complying at all times with the purposes stated in the Privacy Notice.

The Group will not collect personal data directly from children under the age of 18. Only persons over the age of 18 will be able to consent to the Data collected. It is recommended that parents/guardians regularly review and monitor their children’s email usage and other online activities so that they do not share personally identifiable information with us without their prior consent.

At any time, you may request us to delete any Personal Data about your children by sending us a deletion request by e-mail to the following e-mail address:xxxxxxxxxx.

Your Personal Data may be transferred to the controlling companies, subsidiaries, affiliates or any other belonging to the Group, in Mexico or abroad; to third parties, national or foreign, for the fulfillment of the aforementioned purposes, or when such communication of data is provided for in a Law or Treaty, or when required by the competent authority. Through the signing of agreements and/or the adoption of other binding documents, we will ensure that such third parties maintain adequate security, administrative, technical and physical measures to safeguard your personal data, as well as that such third parties only use your Personal Data for the purposes for which they were collected and in accordance with the present.

The Group will not collect your Personal Data for secondary purposes.

We may collect your Personal Data in different ways: when you provide it to us directly or when we obtain information through other sources that are permitted by law, complying at all times with the purposes stated in the Privacy Notice.

The Group will not collect personal data directly from children under the age of 18. Only persons over the age of 18 will be able to consent to the Data collected. It is recommended that parents/guardians regularly review and monitor their children’s email usage and other online activities so that they do not share personally identifiable information with us without their prior consent.

At any time, you may request us to delete any Personal Data about your children by sending us a deletion request by e-mail to the following e-mail address:xxxxxxxxxx.

Your Personal Data may be transferred to the controlling companies, subsidiaries, affiliates or any other belonging to the Group, in Mexico or abroad; to third parties, national or foreign, for the fulfillment of the aforementioned purposes, or when such communication of data is provided for in a Law or Treaty, or when required by the competent authority. Through the signing of agreements and/or the adoption of other binding documents, we will ensure that such third parties maintain adequate security, administrative, technical and physical measures to safeguard your personal data, as well as that such third parties only use your Personal Data for the purposes for which they were collected and in accordance with this Privacy Policy.

Privacy Notice. Notwithstanding the foregoing, we will not assign or transfer your Data to third parties unrelated to the company, except in the cases mentioned above and those provided by law.

We will implement the necessary technical, administrative and physical security measures to ensure the integrity of your Personal Data and prevent its damage, loss, alteration, destruction or unauthorized use, access or processing. Only authorized personnel, who have complied and observed the corresponding confidentiality requirements, will be able to participate in its treatment.

Authorized personnel are prohibited from allowing access to unauthorized persons and from using your Personal Data for purposes other than those set forth in this Privacy Notice. The obligation of confidentiality of the persons involved in the processing of your Personal Data subsists even after the termination of the relationship with the Group.

It is your responsibility, as the Data Subject, to ensure that the Data provided to the Group is accurate and complete, as well as to inform the Group of any changes in the same so that it can comply with the obligation to keep the information updated.

During your visit to websites and mobile applications, the Group may automatically collect the following information regarding your computer and/or cell phone and your visit: (i) the domain and server from which you access the Internet, (ii) the Internet address of the page from which you linked directly to our websites and mobile applications, if any, (iii) the date and time you accessed our websites and mobile applications and how long you stayed on them and which areas you visited, (iv) your Internet Protocol (IP) address, and (v) your computer and/or cell phone’s operating system and browser software. We may employ third parties to handle these enforcement measures, however, in no event do we obtain information about the individual identity of any visitor. Such third parties must observe our privacy standards and provide us only with the information in its entirety, to use the information collected only for the purposes for which the third party was engaged, and then destroy the information.

Web sites and mobile applications may use cookies that send information to your computer while you are browsing them. Cookies are unique to your computer and cell phone and allow the Internet server to collect information that will make your use of the websites and mobile applications easier and more convenient. Cookies add convenience that allows you to save time when you return to our Web sites and mobile applications. They can only be recorded by your web server in the domain that issued the cookie to you. Cookies cannot be used to run programs or deliver viruses to your computer and/or cell phone.

We use our own and third-party cookies to collect non-personal information from online visitors. Cookies track browser type, operating system and Internet service provider and allow us to tabulate the total number of visitors to our websites and mobile applications. The types of cookies we use are security, statistical and advertising cookies. You can disable the cookie on your computer and/or cell phone or set it to notify you when cookies are being sent to you through your browser’s preferences icon.

The temporality of the handling of your Personal Data in all cases will be only for a reasonable time and to comply with the obligations arising from the link you have with the Group.

It is important to inform you that as a Data Subject you have the right to access your Personal Data in our possession and the details of their treatment, as well as to rectify them in case they are inaccurate or incomplete; cancel them when you consider that they are not required for any of the purposes indicated in this Privacy Notice or are being used for non-consented purposes; and oppose the treatment of them for specific purposes or limit their use or disclosure.

To exercise these rights, you must submit a written request to the Data Department of xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx between the hours of 10:00 a.m. and 5:00 p.m. on business days.

In order to be processed, all applications must contain and be accompanied by the following:

In case the Holder does not provide an address to receive the response, the request will be considered as not submitted, for which the pertinent record will be issued.

Documents proving identity (voting card with photo, passport, military ID or driver’s license), in simple copy and having exhibited the original for comparison or, if applicable, the legal representation of the Holder (by means of a public deed or power of attorney signed before two witnesses).

The clear and precise description of the personal data in respect of which the exercise of any of the rights is sought.

Any other element or document that facilitates the location of personal data.

The response to your request will be given, at your choice as Data Subject, by means of e-mail, or by means of a written response when you go directly to the Group’s offices at the address indicated to pick it up, being able to reproduce the response in electronic documents, simple copies, or verbally. The Group will have a term of twenty working days, counted from the date on which the request was received or from the date on which the Holder solved the request for information, to communicate to the Holder if the request is appropriate. In the event that the request is admissible, it shall be effective within fifteen days from the date on which the response is communicated. The referred deadlines may be extended only once for an equal period when justified.

In order to learn more about the requirements of the requests, their origin or forms, the Data Subject may contact the Personal Data Department in any of the following ways: directly at the company’s domicile or at the e-mail address xxxxxxxxxxxxxxxxxxxxxxxxxxx.

At any time, you have the right to revoke your consent to the processing of your Personal Data, so that we stop using them, for which you must submit your request in accordance with the procedure and requirements set forth in the preceding paragraphs.

The Group reserves the right to modify at any time this Privacy Notice to comply with legislative updates, jurisprudence, internal policies, new requirements for the provision of services or any other cause. Any modification, as well as this updated document will be available on the platforms or facilities where it is used.

This Privacy Notice, as well as the handling in general by the Group, is governed by the legislation in force and applicable in the United Mexican States, so that any dispute arising from its application must be ventilated before the competent jurisdictional bodies in Mexico City.

In compliance with the provisions of the Federal Law for the Protection of Personal Data in Possession of Individuals (the “Law”), its regulations and applicable guidelines, we inform you of the following: XXXXXXXXXXXXXXXXXXX, S.A. de C.V. (hereinafter the “XXXXXXXX”), indicating for purposes of this privacy notice the address located at XXXXXXXXXXXXXXXXXXXXXXXXXXXXX, will be responsible for collecting your personal data. It shall also be responsible for the use and protection given to such data and to those data collected by any of the commercial companies that are its controlling companies, subsidiaries or affiliates, or by third parties hired to perform services on behalf of the XXXXX, in accordance with this privacy notice (“the Privacy Notice”).

By virtue of your existing or future business relationship with XXXXXXXXXX, you may provide or provide us with all or some of the following personal data: (i) Customer and legal representative identification data: official identification, image, articles of incorporation and power of attorney of the legal representative; (ii) Contact data: telephone and e-mail (hereinafter, “the Personal Data”).

In addition to the personal data mentioned above, for the purposes informed in this privacy notice, you may provide us with the following personal data considered as sensitive: (i) Geolocation data: exact location coordinates of the establishment (hereinafter, “Sensitive Personal Data”).

Personal Data and Sensitive Personal Data will be used for any of the following main purposes:

Identify, contact and communicate with you.

1. Generate your customer file.
2. Conduct credit and due diligence reviews.
3. Grant credit and commercial terms, if applicable.
4. Comply with the delivery of products and services.
5. Ensure compliance with all types of legal obligations.
6. Send you notices regarding changes to this Privacy Notice.

In addition to the above purposes, XXXXXXX may use your Personal Data for any of the following secondary purposes:

1. For the control, surveillance and access to XXXXXXXXXXX facilities, if applicable.
2. Statistical purposes.
3. Invite you to participate in XXXXXXX events, training and promotions.
4. Record you at any virtual event.
5. Advertising purposes.

We may collect your Personal Data and Sensitive Personal Data in different ways: when you provide it to us directly or when we obtain information through other sources that are permitted by law, complying at all times with the purposes stated in the Privacy Notice.

Your Data and Sensitive Personal Data may be transferred to the controlling companies, subsidiaries, affiliates or any other company belonging to XXXXXXXXXX, in Mexico or abroad; to third parties, national or foreign, for the fulfillment of the aforementioned purposes, or when such communication of data is provided for in a Law or Treaty, or when required by the competent authority.

Through the signing of agreements and/or the adoption of other binding documents, we will ensure that such third parties maintain adequate security, administrative, technical and physical measures to safeguard your personal data, as well as that such third parties only use your Personal Data and Sensitive Personal Data for the purposes for which they were collected and in accordance with this Privacy Notice. Notwithstanding the foregoing, we will not assign or transfer your Data to third parties unrelated to the company, except in the cases mentioned above and those provided by law.

We will implement the necessary technical, administrative and physical security measures to ensure the integrity of your Personal Data and Sensitive Personal Data, and to prevent their damage, loss, alteration, destruction or unauthorized use, access or processing. Only authorized personnel, who have complied with and observed the corresponding confidentiality requirements, may participate in their processing.

Authorized personnel are prohibited from allowing access to unauthorized persons and from using your Personal Data and Sensitive Personal Data for purposes other than those set forth in this Privacy Notice. The obligation of confidentiality of the persons involved in the processing of your Personal Data and Sensitive Personal Data subsists even after the relationship with xxxxxxxx is terminated.

It is your responsibility, as the Data Subject of the Personal Data and Sensitive Personal Data, to ensure that the Data provided to XXXXXXX are true and complete, as well as to inform xxxxxxxx of any changes in such data in order to comply with the obligation to keep the information updated.

It is important to inform you that as a Data Subject you have the right to access your Personal Data and Sensitive Personal Data in our possession and the details of their processing, as well as to rectify them in case they are inaccurate or incomplete; to cancel them when you consider that they are not required for any of the purposes indicated in this Privacy Notice or are being used for non-consensual purposes; and to oppose their processing for specific purposes or limit their use or disclosure.

To exercise these rights, it is necessary to submit a written request addressed to xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, between the hours of 10:00 am to 5:00 pm, on business days.

In order to be processed, all applications must contain and be accompanied by the following:

• The name of the Holder and address or other means to communicate the response to the request. In case the Holder does not provide an address to receive the response, the request will be considered as not submitted, for which the relevant record will be issued.
• Documents proving identity (voting card with photograph, passport, military ID card or driver’s license), in simple copy and having exhibited the original for comparison or, if applicable, the legal representation of the Holder (by means of a public deed).
• The clear and precise description of the personal data in respect of which the exercise of any of the rights is sought.
• Any other element or document that facilitates the location of personal data.

The response to your request will be given, at your choice as Holder, by e-mail, or by written response when you go directly to the offices of the company or at the address indicated to pick it up, being able to reproduce the response in electronic documents, simple copies, or verbally. The company will have a term of twenty working days, counted from the date on which the request was received or from the date on which the Holder solved the request for information, to inform the Holder if the request is appropriate. In the event that the request is admissible, it shall be effective within fifteen days from the date on which the response is communicated. The referred deadlines may be extended only once for an equal period when justified.

In order to learn more about the requirements of the requests, their origin or forms, the Data Subject may contact the Personal Data and Sensitive Personal Data Department in any of the following ways: directly at the company’s domicile or at the e-mail address xxxxxxxxxx.

At any time, you have the right to revoke your consent for the processing of your Personal Data and Sensitive Personal Data, so that we stop using them, for which you must submit your request in accordance with the procedure and requirements set forth in the preceding paragraphs.

The company reserves the right to modify at any time this Privacy Notice to comply with legislative updates, jurisprudence, internal policies, new requirements for the provision of services or any other cause. Any modification, as well as this updated document will be available on the platforms or facilities where it is used.

This Privacy Notice, as well as the general handling made by The Company, is governed by the legislation in force and applicable in the United Mexican States, so that any dispute arising from its application must be ventilated before the competent jurisdictional bodies in Mexico City.