FULL PRIVACY NOTICE

In order to fulfill the purposes outlined in this Privacy Notice, SCANDA may collect, directly or indirectly, the following categories of personal data:

1. Identification data: Name and surname.
2. Contact information: email, phone number and other information that the person providing the information provides to establish communication.
3. Professional or commercial data: company, position or area, sector, service of interest and the information included in the request or message.
4. Data on navigation and use of the site: IP address, device type and browser, operating system, online identifiers, pages visited, date and time of access, session duration, referral source and interactions made within the site.

SCANDA will collect personal data directly from the person in question or, when legally permissible, indirectly.

The data may be collected through forms, contact requests, information or demonstrations, electronic communications, support requests, cookies, tags and other technologies described in this Notice, as well as through other interactions with the SCANDA website and services.

In all cases, the treatment must be limited to the data that are necessary, appropriate and relevant for the corresponding purposes.

Personal data will be processed for the following primary purposes, which are necessary to handle the interaction with the website and, where appropriate, the commercial relationship:

1. Respond to contact requests and provide information about SCANDA services.
2. Follow up on commercial matters, provide demonstrations and respond to support requests when appropriate.
3. Manage the forms, messages and communications sent through the website.
4. Obtain navigation statistics and analyze site usage to improve its functionality, security, and browsing experience.
5. Comply with applicable legal obligations and meet requirements of the competent authority.

Secondary purposes:

1. Send promotional information, newsletters or invitations to events related to the services of Grupo Scanda, when applicable.

The person in charge may express their refusal to the processing of their personal data for secondary purposes through the procedure indicated in the corresponding section of this Notice.

SCANDA will establish and maintain reasonable and appropriate administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction, access, use or unauthorized processing.

To determine the applicable measures, among other factors, the nature and characteristics of the personal data processed, the existing risks, the possible consequences for the data subjects, the purposes of the processing and technological developments will be considered.

The persons involved in any phase of the treatment must maintain confidentiality regarding the personal data to which they have access, an obligation that will remain in effect even after the corresponding legal relationship has ended.

When a security breach occurs that significantly affects the patrimonial or moral rights of the persons concerned, SCANDA will make the communications that are legally required in order for them to take the necessary measures to protect their rights.

The SCANDA website uses cookies and similar technologies, including those associated with Google Analytics, HubSpot, and Hotjar, as well as tags managed through Google Tag Manager, to enable technical functions, obtain browsing statistics, understand user interaction with the site, manage forms and communications, and improve performance and the browsing experience. Depending on the tool and its configuration, these technologies may collect data such as IP address, device type and browser, operating system, online identifiers, visited pages, access date and time, session duration, referral source, and interactions within the site.

The user can configure their browser to accept, block, or delete cookies. Disabling certain cookies may limit some site features. When tools are provided by third parties, the corresponding processing will also be subject to their applicable privacy notices and policies.

For the fulfillment of the purposes indicated in this Notice, SCANDA may rely on service providers that process personal data on behalf of and in accordance with SCANDA’s instructions, including, where applicable, providers of analytics, customer relationship management, forms, digital experience, label management, storage, information hosting, email, support, infrastructure or related services.

These providers will, where appropriate, act as data controllers and will be subject to the applicable obligations regarding confidentiality, security and protection of personal data.

Likewise, SCANDA may carry out national or international transfers of personal data to third parties when these are necessary for the maintenance or fulfillment of a legal relationship with the person in question, when they are carried out between controlling companies, subsidiaries, affiliates, or members of the same group that operate under compatible internal processes and policies, when they result from a legal obligation or request from a competent authority, or when any of the other circumstances in which legislation allows a transfer without the consent of the person in question arise.

When SCANDA intends to carry out a transfer that requires the consent of the person concerned, the latter will be informed in advance and the corresponding consent will be obtained before the transfer is carried out.

Third-party recipients of personal data must, when legally required, comply with the purposes, limitations, and obligations applicable to the processing of such data.

The person in charge or, where applicable, their legal representative may at any time exercise the rights of Access, Rectification, Cancellation and Opposition ("ARCO Rights") regarding their personal data.

In particular, the person in charge shall have the right to:

• Access: to know the personal data that SCANDA holds about you, as well as the conditions and generalities of their processing.
• Correction: request the correction or update of your personal data when it is inaccurate, incomplete or out of date.
• Cancellation: request that your personal data be deleted or removed when legally required, subject, where applicable, to the corresponding blocking and retention period.
• Objection: request the cessation of the processing when there is a legitimate reason and your particular situation justifies it, in the terms provided for by the applicable legislation.

The exercise of any of the ARCO Rights will not be a prerequisite nor will it prevent the exercise of the others.

To exercise any of the ARCO Rights, the person entitled or their legal representative must submit an application to the legal department of SCANDA, addressed to Ximena Arcos Peñaflor, at the following email address: ximena.arcos@scanda.com.mx.

The request must contain at least:

1. The name of the person in charge and their address or any other means of receiving notifications.
2. Documents proving the identity of the person holding the title or, where applicable, the personality and identity of their representative.
3. The clear and precise description of the personal data regarding which one of the ARCO Rights is intended to be exercised, unless it is the right of access.
4. The description of the ARCO right that the person claiming it or the person requesting it specifically seeks to exercise.
5. Any other element or document that facilitates the location of the personal data.

In the case of requests for rectification, the person responsible must indicate the modifications requested and attach the documentation supporting the corresponding correction or update.

When the application is submitted through a representative, the documents that allow for the identification of the person holding the title, as well as the personality and identity of their representative, must be attached, in accordance with applicable legislation.

SCANDA will notify the person in charge of the decision within a maximum of twenty working days counted from the date of receipt of the request.

If it is deemed appropriate, SCANDA will effect the corresponding ARCO right within fifteen working days of the date on which the response is communicated.

The previous deadlines may be extended once for an equal period when the circumstances of the case justify it, in accordance with applicable legislation.

Regarding the right of access, personal data may be made available to the person entitled to it through simple copies, electronic documents or any other appropriate means, upon proof of their identity or, where appropriate, the personality and identity of their representative.

SCANDA may deny the exercise of the ARCO Rights in whole or in part only when one of the assumptions provided for in applicable legislation is met, including:

1. When the person holding the title or their legal representative are not properly accredited.
2. When the personal data regarding which the right is exercised is not in the possession of SCANDA.
3. When the exercise of the right could harm the rights of third parties.
4. When there is a legal impediment or a resolution from a competent authority that restricts the exercise of the requested right.
5. When the rectification, cancellation or opposition requested has previously been made.

When the refusal is partial, SCANDA will take the appropriate actions regarding the data or requests that are not covered by any cause of non-admissibility.

In all cases, SCANDA will inform the person in charge or their representative of the reason for its determination within the legally established deadlines.

The exercise of the ARCO Rights will be free of charge. Only the justified costs of reproduction, copies or shipping that may be necessary in accordance with applicable legislation will be charged. When the person in charge provides the electronic, magnetic or mechanical means necessary for the reproduction of their personal data, these will be delivered free of charge.

The person in charge may revoke the previously granted consent to the processing of their personal data at any time, provided that such processing is not necessary for the fulfillment of a legal obligation or to maintain or fulfill a legal relationship that justifies its retention. The revocation of the consent will not have retroactive effects.

SCANDA will analyze the request and notify the person in charge of the corresponding determination in accordance with the deadlines and requirements provided for in the applicable legislation.

The data subject may at any time request that the use or disclosure of their personal data be restricted, particularly regarding communications related to secondary purposes.

To do this, you can submit the application to the following email address: ximena.arcos@scanda.com.mx.

The request must identify the person holding the rights and clearly specify the processing, communication or purpose for which the limitation is requested.

SCANDA will retain personal data only for the period necessary to fulfill the purposes for which it was processed, to comply with applicable legal or contractual obligations, and, where applicable, for the corresponding statute of limitations.

Once the purposes of the processing have been fulfilled and when there is no legal or contractual obligation justifying its retention, SCANDA will block and subsequently delete or remove the personal data in accordance with applicable legislation.

SCANDA reserves the right to make changes or updates to this Privacy Notice at any time, which will be made known through the SCANDA website.