At Amistad Group, that is, Corporativo Amistad, S.A. de C.V. or any of its affiliates and/or subsidiaries (hereinafter “Grupo Amistad”), we conduct ourselves with high ethical standards. Therefore, in strict adherence to our values and our commitment to legality and transparency, the protection of your personal data, your privacy, and your trust are of utmost importance to us. To guarantee this, we have implemented administrative, physical, and technological security measures that allow us to responsibly safeguard your information, and we continuously review our processes to ensure compliance with high data protection standards.

In this regard, we provide you with this Privacy Notice, through which we inform you how we protect the integrity, confidentiality, and availability of your personal data, in compliance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on March 20th, 2025. This Privacy Notice is permanently available for consultation on our website: Home – Amistad, and you can access the full text of the aforementioned law at: Ley Federal de Protección de Datos Personales en Posesión de los Particulares.

It is important to note that you may, at any time, limit the use or disclosure of your personal data, as well as exercise your rights of access, rectification, cancellation, or opposition (ARCO rights), by submitting a written request in accordance with the procedures established in this notice. It shall be understood that you, as the data subject, tacitly consent to the processing of your data in accordance with the terms set forth in this Privacy Notice, when, having this notice available without limitation, you do not expressly express your opposition through the means provided herein.

I. Identity and Address of the Data Controller

Amistad Group acts as the controller responsible for the safekeeping and custody of the collected data and is located at Hidalgo 900, Zona Centro, Cd. Acuña, Coahuila, Mexico.

II. Purposes of Data Processing

Amistad Group informs you that it holds, has collected, or will collect from you the personal data deemed necessary, primarily to properly and formally carry out business activities related to the services we offer, as well as for the execution of other activities that, in accordance with the law and our corporate bylaws, fall within our powers.

The personal information may have been obtained directly from you, whether in person or through alternative means including technology, through third parties, and/or through other sources permitted by law.

The following personal data may include, but is not limited to:

• Identification and contact data: full name, address, mobile and/or work/home phone numbers, marital status, email, username and password, tax ID (R.F.C.), C.U.R.P., place and date of birth, age, names of relatives, dependents and beneficiaries, their addresses, and other data at the discretion of Amistad Group.
• Employment and social security data: previous employer, occupation, job title, department, work address, work phone and email, professional and commercial references, payment compliance records, among others at the discretion of Amistad Group.

• Financial or asset-related data: credit history, financial statements, movable and immovable property, bank accounts, insurance, retirement funds (AFORES), sureties, contracted services, payment compliance records, among others at the discretion of Amistad Group.

The collected personal data will be used for the following purposes:

• Identification and contact with data subjects: Personal data will be used to fully identify the data subject, verify identity, and establish effective contact by phone, email, in writing, or in person. This includes identity verification for facility access, participation in events, meetings, and to respond to requests, inquiries, complaints, or comments from the data subject.
• Provision of contracted products and services: The collected information will be used to fulfill obligations arising from the legal relationship between the data subject and Amistad Group, whether as a client, supplier, tenant, contractual counterparty, service beneficiary, or any other role that may apply. This includes activities such as the provision of industrial or real estate services, quotations, invoicing, contract execution, project implementation, and other acts related to the delivery of goods or services.
• Administrative, commercial, and operational management of the relationship with the data subject: Data will be processed for internal administrative purposes, including file integration, access control, accounting records, compliance with internal policies, quality control, service evaluation, contract monitoring, collections, reporting, statistical analysis, personalized attention, and continuous improvement. It may also be used for internal or external audits, process reviews, and performance evaluations of providers or clients.
• Compliance with legal obligations: Amistad Group may process personal data to comply with applicable legal, regulatory, or administrative obligations, both domestic and international. This includes tax, accounting, labor, anti-money laundering, and security obligations, or those required by competent authorities. If necessary, the data may be shared with authorities to comply with official requirements or to exercise legal rights.
• Sending information about Amistad Group products, services, promotions, or events: With the data subject’s consent, Amistad Group may use the personal data to send commercial, promotional, or advertising information related to its own products or services or those of affiliated or subsidiary companies, or companies within the same corporate group. This may include event invitations, product launches, newsletters, satisfaction surveys, or any commercial communication that strengthens the relationship with the data subject.

III. Options and Means to Limit the Use or Disclosure of Personal Data

The use and processing of the collected personal data will be limited to:

• The fulfillment of the purposes outlined in this Privacy Notice or other related or compatible purposes.
• The use and processing of personal data will be strictly limited to what is necessary, proper, ethical, and required in accordance with the purposes and execution of business relationships between the interested parties.

IV. Means to Exercise ARCO Rights (Access, Rectification, Cancellation, and Opposition)

To exercise your ARCO rights, you may submit a written request to the Legal Department. The request must meet the requirements set forth in the Federal Law on the Protection of Personal Data Held by Private Parties.

V. Data Transfers

The collected personal data may be shared with third parties only in the cases provided for in the applicable Law and Regulations. Specifically, they may be shared with service providers related to the purposes stated in this Privacy Notice, under appropriate security measures.

To fulfill the purposes of this Privacy Notice, as well as any compatible or analogous purposes, Amistad Group may transfer personal data within and even outside of Mexico. Amistad Group commits to ensuring that all legal principles for data protection are observed during any transfer and agrees that this Privacy Notice shall be respected at all times by us and by our business partners.

By virtue of this Privacy Notice, the data subject consents to the transfer of their data, understanding that:

• The controller may transfer personal data to national or international third parties, other than the processor, to whom this Privacy Notice and its purposes will be communicated.
• The recipient third party will assume the same obligations as the transferring controller, and the data will be processed under the terms agreed upon in this Privacy Notice.

Transfers may occur without the data subject’s consent, among others, in the following cases:

• To subsidiaries or affiliates of the controller, or to a parent company or any company within the same group;
• When necessary for the performance of a contract entered into or to be entered into in the interest of the data subject;
• When required for the maintenance or fulfillment of a legal relationship between the controller and the data subject.

Additionally, data may be transferred, including but not limited to:

• Companies that jointly operate products or services with Amistad Group;
• Third parties that work with Amistad Group to provide services;
• External professionals, advisors, or consultants for the administration of services and other acts that AMISTAD GROUP may carry out in accordance with the law and its bylaws, or for the legal defense of its interests in case of disputes, such as collection agencies or external legal/accounting auditors.

VI. Procedure and Means for Communicating Changes to the Privacy Notice

We reserve the right to make changes or updates to this Privacy Notice at any time for reasons that best serve Amistad Group, including legislative, regulatory, or jurisprudential changes, corporate policy updates, or industry best practices. All updates will be reflected and made visible on our website: Home – Amistad.

If sensitive personal data is collected, we will inform you expressly and request your explicit consent, in accordance with the law.