Privacy Notice

ALSEA® INTERNET PRIVACY NOTICE

I. THE COMPANY

In compliance with the Federal Law Protection of Personal Data Held by Private Parties (“Law”) and it´s Regulation, the controller fot the processing and protection of your personal data is ALSEA, S.A.B. de C.V. (hereinafter, the “Company”), with address at Avenida Revolución No. 1267, Corporate Tower, 21st Floor, Colonia Los Alpes, Álvaro Obregón Borough, Postal Code 01040, Mexico City

II. PERSONAL DATA

The Company will collect and process the following personal data:

GENERAL	SENSITIVE
a) Full name b) Address (street, city, state, borough/municipality, postal code) c) Landline or mobile telephone number d) Official identification number e) Email address f) Company where you are employed, including job title or position g) Federal Taxpayer Registry (RFC) h) Tax domicile	The Company will not process any sensitive personal data

If you contact us through social media (X or LinkedIn), we may collect information available on your public social media profile to address your inquiries and/or requests for information related to the products we offer.

III. PURPOSES

The personal data collected will be used by the Company for the following purposes:

PRIMARY

SECONDARY

a) To provide information and establish contact regarding social and corporate events b) To verify the identity of users c) To provide information about employment vacancies offered by the company d) To provide information about the company to analysts, investors, financial entities, and the general public e) To provide corporate information about the company f) To receive and address complaints and reports related to breaches of the Code of Ethics (“Right Line”) g) To process and respond to your ARCO Rights request h) To process and respond to your request for revocation of consent

a) Sending promotional, advertising, or marketing information b) Dissemination of the Company's products, services, benefits, campaigns, or events c) Conducting satisfaction surveys, market studies, or statistical analyses for commercial purposes

IV. LIMITATION ON THE USE OR DISCLOSURE OF PERSONAL DATA AND REVOCATION OF CONSENT

You may, at any time, exercise control mechanisms over the processing of your personal data, as follows:

a) Revocation of Consent: You may revoke, in whole or in part, the consent previously granted for the processing of your personal data, provided such revocation does not impede compliance with legal or contractual obligations binding upon the Company. Revocation concerning primary purposes may render the continuation of the existing legal relationship impossible.

b) Limitation on the Use of Personal Data: You may request that the use of your personal data be limited for secondary purposes, which may restrict its processing for internal processes or specific business areas of the Company, provided that such limitation doesn't contravene legal or contractual obligations

c) Limitation on the Disclosure of Personal Data: You may request a limitation on the disclosure of your personal data for secondary purposes so that such data isn't shared or transferred to third parties, except in the cases permitted under Article 36 of the Law

To exercise any of these options, you must submit a request to the Company's Information Privacy Department via email at privacidadinfo@alsea.net, specifying your name and the option you wish to exercise (revocation of consent, limitation on the use, or limitation on the disclosure).

The Company will review your request and, where applicable, inform you of it's admissibility and any consequences arising from the exercise of the selected option.

V. EXERCISE OF ARCO RIGHTS

At any time, you or your duly authorized legal representative may exercise any of the following rights: i) to access the personal data we hold about you (Access), ii) to rectify your personal data if it is inaccurate, incomplete, or outdated (Rectification), iii) to request the deletion of your personal data (Cancellation), and iv) to object to the processing of your data for specific purposes (Objection), collectively known as “ARCO Rights.”

To exercise your ARCO Rights, you must submit your request to our Information Privacy Department at privacidadinfo@alsea.net, specifying that you seek to exercise one of your rights and that your request corresponds to ALSEA, S.A.B. de C.V.

.

Once your request is received, we will provide you with the ARCO Request Form and the applicable procedure. Your request must include: (i) name of the data subject (ii) e-mail address for receiving notifications (iii) clear and precise identification of the personal data concerned (iv) the ARCO right you wish to exercise, (v) any information that facilitates locating the personal data, you must also attach a copy of your identification or, where applicable, the document evidencing legal representation.

The response period is 20 business days from the date on which the request for access, rectification, cancellation, or objection is received. The response will be communicated to the e-mail address provided. Once notified, the Company will have 15 business days to comply with the request, if it is admissible. These time periods may be extended once, for an equal period, when justified by the circumstances or when there is inactivity by the data subject.

VI. UPDATES

This Privacy Notice may be amended or updated at any time to address legislative developments, internal policies, or new requirements for the provision of our services. Should substantial modifications be made, the updated version will be made available through the Company’s official website. Data subjects are encouraged to review this Privacy Notice periodically to stay informed of any changes or updates.

VII. TRANSFERS

The Company may transfer your personal data in the cases established under article 36 of the Federal Law on the Protection of Personal Data Held by Private Parties, specifically when: i) provided by a law or treaty to which Mexico is a party; iii) the transfer is made to parent companies, subsidiaries, affiliates, or entities under common control of the Company, or any company belonging to the same corporate group operating under the same internal processes and policies; iv) necessary due to a contract executed or to be executed in your interest between the Company and a third party; v) legally required or necessary to safeguard public interest or for the administration of justice; vi) necessary for the recognition, exercise, or defense of a right in judicial proceedings; vii) necessary for the maintenance or fulfillment of a legal relationship between the Company and the data subject.

Outside these cases, your personal data will not be transferred to third parties without your prior consent, which will be obtained in accordance with applicable legislation.

VIII. USE OF TRACKING TECHNOLOGIES ON OUR WEBSITE

We inform you that our website uses cookies, web beacons, and other similar technologies, which enable monitoring of your online behavior to enhance your browsing experience and improve our website’s functionality.

The personal data collected through these technologies may include: (i) type of browser used, (ii) Server name, (iii) IP address, (iv) date, time, and duration of browsing on the Internet and on our website or mobile application, (v) sections visited, (vi) webpages accessed prior to visiting our website.

These technologies may be disabled directly through your browser settings.

IX. ACCEPTANCE OF THE PRIVACY NOTICE

In accordance with Article 7 of the Law, you will be deemed to have granted your consent to the processing of your personal data for the purposes described herein when this Privacy Notice is made available to you and you don’t express objection.

Updated: 2026.