INTEGRAL

Comprehensive Privacy Notice for Employees of Transportes Garza Leal, SA de CV

Dear colleague:

At Transportes Garza Leal, SA de CV, hereinafter referred to as “the Company”, we recognize that our employees are the fundamental axis of our operations, and that the information they entrust to us within the framework of the employment relationship deserves the highest level of protection, respect and responsibility.

Privacy is not only a recognized human right under Mexican law, but also an essential institutional value in our organizational culture. Therefore, we reaffirm our commitment to processing your personal data in strict accordance with the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality, and accountability, as provided by the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) , its Regulations , and other applicable provisions issued by the Secretariat of Anti-Corruption and Good Governance through "Transparency for the People . "

This Comprehensive Privacy Notice aims to inform you, in a clear, precise and accessible manner, about the personal data that will be collected during your recruitment, hiring and employment process with the Company; the legitimate and proportionate use that will be given to said information; the means to exercise your rights of access, rectification, cancellation and opposition (ARCO); as well as the mechanisms implemented for its safeguarding and protection.

We also inform you that our Internal Personal Data Protection Policies , approved by the General Management through our Central Compliance Unit and available for your consultation at all times, detail the applicable procedures, the data controllers, and the technical and administrative criteria under which your personal information will be managed, including employment, financial, sensitive and health data, when necessary in accordance with current labor or health legislation.

Identity and address of the data controller

The entity responsible for processing your personal data is Transportes Garza Leal, SA de CV , a company legally constituted under Mexican law, with address located at Periférico Raúl López Sánchez Km. 14.5, Colonia Centro , postal code 35159, in the municipality of Lerdo, Durango, Mexico , which will act in accordance with the provisions of the legislation on the protection of personal data, and will observe at all times the principles and duties established in the LFPDPPP and its Regulations.

For any questions, comments, to exercise your ARCO rights, or requests related to the processing of your personal data, you may contact the institutional email address protecciondedatos@tgarzaleal.com , the official channel designated for addressing this matter.

Personal Data We Collect and Its Origin

To comply with our legal and contractual obligations as an employer, as well as to provide you with safe, efficient and rights-respecting labor management, at Transportes Garza Leal, SA de CV we collect and process a series of personal data that allow us to know you, protect your well-being, and guarantee compliance with our tax, labor and administrative responsibilities.

We know your personal information is valuable and confidential. That's why we want you to clearly understand what kind of data we collect, why we need it, and how we protect it. Below, we explain the categories of personal data we may request and process:

At all times, this data is treated with the utmost responsibility, under strict administrative, technical, and physical security measures, and in accordance with the principles of confidentiality, purpose limitation, and proportionality. We do not collect more information than necessary, nor do we use it for purposes other than those set forth in this Notice.

Sensitive Personal Data that we collect and the enhanced processing

With full respect for your dignity and fundamental rights, and in consideration of the nature of our functions as a responsible employer, we inform you that Transportes Garza Leal, SA de CV may collect and process certain sensitive personal data , exclusively when strictly necessary for the fulfillment of legitimate and specific purposes related to your safety, health, work well-being or compliance with applicable legal provisions.

In accordance with Article 8 of the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and Article 15 of its Regulations, the processing of this data will require your express written consent , which will be obtained through a specific form or authentication mechanism that reliably proves your consent. This consent will always be given prior to processing, except in the cases of exception provided for by law.

In this context, the Company may collect the following categories of sensitive data:

1. Health information : relevant medical history for the position, blood type, allergies, results of pre-employment medical examinations, periodic check-ups, toxicology or drug tests, temporary or permanent disabilities, and medical diagnoses related to your work.
   This information is essential to comply with occupational health and safety regulations and to protect your physical well-being and that of your colleagues.
2. Biometric data , such as your fingerprint used for attendance control purposes, as well as images captured by video surveillance systems that may identify facial features or physical patterns,
   are used as part of our institutional security measures to safeguard the integrity of the company's people, facilities, and assets, and always within proportionate and authorized parameters.
3. Images and voice recordings related to your activity within the company. This includes video recordings taken in common areas for security purposes, institutional photographs for issuing credentials, creating organizational charts or training materials, and in some cases, voice recordings of calls related to work or service processes, always with prior notice and your consent.
   
   Under no circumstances will covert recordings or recordings without your knowledge be permitted.

It is important to note that the Company does not create databases with sensitive information unless there is a legitimate, proportionate need directly linked to specific purposes . All processing of this nature will be audited, documented, and limited to the minimum necessary, in accordance with our principles of ethics, legality, and proactive responsibility. Your privacy is a firm and ongoing commitment to us.

Purposes of processing your Personal Data

Aware of the confidential nature and value of your personal information, at Transportes Garza Leal, SA de CV , we collect and process your personal data only for legitimate, proportionate purposes aligned with our responsibilities as an employer. These purposes fall into two categories: those essential to the employment relationship, and others that, while not mandatory, contribute to strengthening the organizational environment and your overall well-being.

• Primary Purposes (Essential for the Employment Relationship)
  These purposes are essential to formalize, develop, maintain, and conclude the legal relationship that binds us as a company and employee. Their processing is essential and does not require your additional consent.
• Comprehensive management of the recruitment, selection, hiring and integration process into the work team.
• Preparation and administration of the employment file , including internal transfers, evaluations and legal documentation.
• Payroll and payment administration , legal and extra-legal benefits, bonuses, commissions, travel expenses, reimbursements, tax withholdings and other financial obligations.
• Compliance with provisions before labor, tax and social security authorities , such as IMSS, INFONAVIT, SAT and STPS.
• Processing and administration of life, health, car insurance , among others in which you are a beneficiary or insured by virtue of your employment relationship.
• Control of attendance, punctuality, permits, licenses and disabilities , in accordance with applicable legislation.
• Registration and access control to facilities using credentials, biometrics and video surveillance (CCTV) , for institutional security purposes.
• Monitoring and geolocation of units and personnel in the field or in transit, focused on operational safety and logistical efficiency.
• Implementation of training programs, professional development and performance evaluation .
• Assignment, management and control of the use of vehicles, tools, technological devices, institutional emails and other work resources .
• Handling and resolving security incidents, complaints, reports and internal disciplinary procedures.
• Conducting internal and external audits , labor investigations, regulatory reviews or regulatory compliance processes.
• Management of occupational risks , monitoring of working conditions and application of preventive measures in occupational health and safety.
• In the case of organizational transformation processes (mergers, spin-offs, acquisitions), transfer of personal data in order to guarantee job continuity , in accordance with the provisions of the applicable regulations.
• Secondary purposes (Not essential for the employment relationship)
  

  These activities are intended to enhance your experience within the Company, promote organizational integration, and strengthen your sense of belonging. Your consent for these purposes is entirely voluntary and in no way conditions or affects your employment relationship with us.

  • Sending internal or external communications related to institutional events, welfare campaigns, awards, cultural, sports or informational programs.
  • Participation in organizational climate surveys , talent studies, satisfaction diagnoses or social responsibility initiatives.
  • Use of your image or voice in graphic materials, photographs, videos or recordings for internal publications (such as bulletin boards, intranet or newsletters) or external publications (such as social media, corporate website or institutional campaigns), provided that your specific written consent is obtained .
  • Commercial prospecting activities regarding products or services of the Company or of third-party allies, which generate benefits, discounts or agreements directed exclusively to the staff.

If you do not wish your personal data to be processed for any of these secondary purposes, you may indicate this from this moment, or at any later time, through the means designated by the Company for the exercise of your rights.

Our commitment is to respect your privacy and treat your data ethically, legally and transparently at all times.

Mechanisms to express your refusal to the processing of data for secondary purposes

In full respect of your rights as the data subject, you are free to decide whether or not to consent to the processing of your information for the secondary purposes described above.
Granting such consent is not a requirement for initiating or maintaining your employment relationship with the Company.

If you do not wish your personal data to be used for any or all of the secondary purposes , you may express your refusal at any time, through any of the following means:

• In writing , by submitting an application to the area called Central Control Department , in our offices.
• Electronically , by sending an email to the institutional mailbox protecciondedatos@tgarzaleal.com clearly indicating the purposes to which you wish to object.
• Using the ARCO rights exercise form , available in the same area or by electronic request.

The data controller will process your request according to the current internal procedure and, if applicable, will record your refusal in the corresponding systems to ensure that your data is not processed for the stated purposes. We reiterate that your decision will not affect your contractual relationship with the Company in any way , nor will it condition your employment rights or benefits.

Means of obtaining your personal data

In the performance of our duties and to fulfill the aforementioned purposes, Transportes Garza Leal, SA de CV collects your personal data through various means, all of which are lawful and aligned with the principles of transparency and fairness. The sources through which we obtain your information are as follows:

• Directly:
  This occurs when you voluntarily provide us with your information through:
• Physical or digital job application forms.
• Personal, telephone or electronic interviews.
• Documentation submitted during the hiring or integration process.
• Institutional or work communications (emails, letters, requests, forms).
• Internal surveys, performance evaluations, security forms, and other documents related to your employment record.
• Indirectly:

In certain cases, the Company may obtain information from you through:

• Employment or academic references , provided by third parties, provided that you have expressly authorized it or have provided the corresponding contact details.
• Publicly accessible sources , such as institutional websites, professional social networks, public directories, RFC or CURP records, provided that their consultation is not restricted by a specific rule and their reasonable expectation of privacy is respected.
• Third parties with whom we maintain a contractual relationship , such as recruitment agencies, human resources platforms, or providers of psychometric assessment services, who transfer your information to us for legitimate purposes related to the selection process or personnel administration.

The Company undertakes to verify that all information received by indirect means is obtained in accordance with legality, confidentiality and the corresponding consent, and to integrate it responsibly into the authorized processing systems.

Transfers of Personal Data

Your personal data may be communicated to third parties, both national and foreign, without the need for your consent , provided that it is one of the cases permitted by Article 37 of the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) , which include the following:

• Government authorities : When the transfer is necessary or legally required to safeguard the public interest, the exercise or defense of a right before a competent authority, or to comply with judicial or administrative requirements.
• Companies of the same corporate group : To other controlling companies, subsidiaries or affiliates of Transportes Garza Leal, SA de CV, that operate under equivalent internal data protection policies.
• External service providers (processors) : Those who, in compliance with a contract with the Company, need access to your data to provide specific services. In all cases, these providers are legally obligated to process your data under confidentiality and protection clauses.
• Third parties with a legal relationship : When the transfer is necessary by virtue of a contract entered into or to be entered into in their interest.
• Emergencies : In situations that put your physical integrity, property or health at risk, and that require immediate action by authorities, paramedics or other involved actors.
• Medical care : When your data is essential to provide medical care, diagnosis, treatment or health services, and you are unable to give your consent, provided that the treatment is carried out by a professional subject to medical secrecy.

Important: In all the aforementioned transfers, the Company will require the third-party recipients to assume the same confidentiality obligations and protection measures established in this Privacy Notice and in the applicable regulations.

Your ARCO rights

As the data subject, you have the right to:

• Access the personal data we hold about you, as well as learn about the processing to which it is subjected.
• Correct your data if it is incorrect, inaccurate, or outdated.
• Cancel your data when it is no longer necessary for the purposes described, unless otherwise provided by law.
• To object to the processing of your data for specific purposes, provided there is a legitimate reason or when you wish the processing to be suspended.

To exercise your ARCO rights, in accordance with the Company's policies, you may submit your request:

• In writing, at the office of the Central Department of Transportation Control Garza Leal, SA de CV, located at our main address.
• Via email, to the address: protecciondedatos@tgarzaleal.com Your request must contain:
  • Full name and method for receiving notifications.
  • Identity documents or proof of legal representation.
  • Clear description of the personal data regarding which you wish to exercise any ARCO rights.
  • Any element that facilitates its location.
  • In case of rectification , documentation justifying the requested modification.

The Company will process your request within a maximum of 20 business days. If applicable, it will implement the action within a maximum of 15 business days following the decision. These timeframes may be extended once for justified reasons.

Exercising your ARCO rights is free of charge. Only in the case of physical reproduction might recovery costs be generated, which will be covered by you if you do not provide an electronic means for delivery.

Security measures implemented to protect your Personal Data

At Transportes Garza Leal, SA de CV, we are committed to protecting your personal data. We have implemented and maintain a robust set of administrative, physical, and technical security measures designed to protect your information against damage, loss, alteration, destruction, or unauthorized use, access, or processing. These measures are based on the inherent risk of the data type, its sensitivity, technological advancements, and the potential consequences of a breach.

Our measures include, but are not limited to:

• Administrative measures
  1. Implementation and mandatory compliance with internal data protection and information security policies for all staff.
  2. Designation of a Central Compliance Cell as responsible for the supervision and management of the privacy program.
  3. Continuous and mandatory training and awareness programs for all staff on the proper handling of personal data, including sensitive data.
  4. Establishment of an internal monitoring system and periodic audits to verify compliance with policies and the effectiveness of controls.
  5. Clear definition of roles and responsibilities for staff who handle personal data.
• Physical measurements:
  • Restricted access control to facilities and critical areas where sensitive information or servers are stored.
  • Secure storage of files and physical documents under lock and key.
  • Protection of computer equipment and storage media against unauthorized access or theft.
  • Procedures for the secure deletion of data on physical media.
• Technical measurements:
  1. Implementation of logical access controls based on the principle of "least privilege", access only to essential personnel with the necessary permissions.
  2. Strict prohibition and elimination of shared passwords, with the use of unique and personal credentials.
  3. Mandatory encryption of sensitive personal and financial data, both at rest and in transit.
  4. Use of updated antivirus and antimalware software and active firewalls on all computers.
  5. Implementation of regular, automated, and secure data backup systems, with copies in separate and protected locations.
  6. Active monitoring of data access and information flow to detect anomalous activities.
  7. Procedures for the secure and permanent deletion of data on digital media.
  8. Restriction of the use of personal devices for the storage or processing of Company information, and prohibition of the use of personal emails for work purposes involving sensitive data.

Modifications to this Privacy Notice

This Privacy Notice may be modified, updated or adjusted at any time, when required:

• New regulatory requirements or changes in the applicable legal framework.
• Internal reforms resulting from the implementation of improvements in our processes.
• Updates to institutional privacy practices.
• Technological innovations that involve new ways of processing personal data.
• Structural changes in the company's business model.
• Or, for any other reason that, within the scope of our powers and obligations, justifies its review.

In all cases, Transportes Garza Leal, SA de CV undertakes to keep you duly informed about any substantial modification to the content of this Notice , ensuring that such updates are transparent, accessible and timely.

The channels through which these changes will be communicated are:

• Institutional email addressed to staff.
• Information boards located in common areas of our facilities.
• Company's official internal portal or labor management systems.
• Any other internal or external means of communication that is considered effective for these purposes.

We recommend that you periodically review this document to stay informed about the current version and the conditions under which your personal information is collected, used, and protected. This Privacy Notice was prepared in accordance with the institutional data privacy policies of Transportes Garza Leal, SA de CV. It corresponds to its current version dated July 7, 2025 .

SIMPLIFIED

PRIVACY NOTICE FOR EMPLOYEES

At Transportes Garza Leal, SA de CV, a company legally constituted under Mexican law, with address at Periférico Raúl López Sánchez Km. 14.5, Colonia Centro, CP 35159, Lerdo, Durango, Mexico, we are responsible for the processing and protection of your personal data.

Main purposes of the treatment:

We use your data to integrate your employment file, manage your hiring, payroll and benefits, social security, training, performance evaluation, access control, attendance, compliance with tax and labor obligations, and facility security.

Secondary purposes:

With your consent, we may use your information for internal communications, institutional dissemination (photographs or videos in campaigns), and workplace climate or well-being surveys.

If you do not wish your data to be processed for these secondary purposes, you can indicate this at any time.

Consult the full Privacy Notice:

To learn in detail what data we collect (including sensitive data such as health, biometrics, and geolocation), the transfers permitted by law, your ARCO rights (Access, Rectification, Cancellation, or Opposition), and the mechanisms to exercise them, please consult our Comprehensive Privacy Notice available in the Central Control Department area, on our intranet, or by requesting it directly at: protecciondedatos@tgarzaleal.com

Last updated: July 2025.

SHORT

PRIVACY NOTICE FOR EMPLOYEES

Transportes Garza Leal, SA de CV located at Periférico Raúl López Sánchez Km. 14.5, Lerdo, Durango, Mexico.

Your personal data is processed for employment, administrative, access control and compliance with legal obligations purposes.

To view the full Privacy Notice, please consult the Central Control Department or write to: protecciondedatos@tgarzaleal.com

Last updated: July 2025.

INTEGRAL

Comprehensive Privacy Notice for Suppliers of Transportes Garza Leal, SA de CV

Dear supplier, contractor or legal representative:

At Transportes Garza Leal, SA de CV, hereinafter referred to as “the Company ,” we recognize the importance of the privacy and security of the personal data you provide to us within the framework of our business relationship. The trust you place in us is highly valued, and protecting your information is a top priority and ongoing commitment in all our operations.

This Privacy Notice aims to inform you, clearly, transparently, and accessibly, about how we collect, use, store, share, and protect your personal data. All processing is carried out in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) , its Regulations , and our Internal Personal Data Protection Policies , which are available for your review upon request.

We invite you to read this document carefully, as it contains information that guarantees your privacy will be respected at all times.

Identity and address of the party responsible for processing your Personal Data

Transportes Garza Leal, SA de CV , a company legally constituted under Mexican law, with address located at Periférico Raúl López Sánchez Km. 14.5, Colonia Centro with postal code 35159 in the municipality of Lerdo, Durango, Mexico , is responsible for the processing of personal data that it collects from you in your capacity as a supplier, contractor, service provider or legal representative of a legal entity that provides services or supplies products to this Company.

Your data is processed based on commercial, operational, administrative and legal purposes derived from the contractual relationship that is established, or is in the process of being established, between you and our organization.

If you have any questions, comments, or wish to exercise any of your rights regarding personal data protection, you can contact us at the following email address: protecciondedatos@tgarzaleal.com

Purposes of processing your Personal Data

The personal data we collect from you, whether in your capacity as a supplier, contractor, independent service provider, legal representative, or contact person of a legal entity with which we maintain a business relationship, will be processed for the purposes described below. We distinguish between primary purposes , which are essential to establish, maintain, and fulfill the contractual relationship, and secondary purposes , which, while not necessary for the execution of the legal relationship, contribute to improving long-term communication and cooperation with our business partners.

• Primary Purposes
  These purposes are essential for Transportes Garza Leal, SA de CV to evaluate, establish, maintain, and manage a valid, legitimate, and secure legal relationship with you or the company you represent. The processing of your personal data for these purposes does not require your consent, in accordance with Article 10 of the LFPDPPP , since its use is justified within the framework of a contractual relationship and regulatory compliance.
  • Pre-contractual verification and evaluation: Before formalizing any contractual relationship, the Company may collect and analyze personal data to verify your identity, tax status, regulatory compliance, professional and commercial background, and the technical or operational capacity of you or your represented party.
    This includes:
    • Verification of the Federal Taxpayer Registry (RFC) and proof of tax status.
    • Consultation of professional or commercial references.
    • Analysis of previous experience, reputational history, or applicable certifications.

    This phase seeks to minimize legal, operational, or reputational risks, ensuring that the Company collaborates only with reliable and qualified suppliers and service providers.

  • Formalization of the legal and commercial relationship: Use of personal data for:
    • Preparation, review and formalization of service provision, purchase and sale, lease, collaboration contracts, among others.
    • Issuance of purchase orders, requests for quotations, confidentiality agreements, and other binding documents.
    • Integration into internal administrative systems, including the digitization of files, signature control, and secure contractual storage.
  • Administrative, operational, and logistical management: Processing of your data to internally coordinate the execution of contracted services or product deliveries.
    Includes:
    • Tracking physical or digital deliveries, monitoring times and compliance with specifications.
    • Inventory control related to your products or services.
    • Assignment of technical or logistical personnel to joint projects.
    • Coordination with various areas such as Purchasing, Warehouse, Logistics and Maintenance.
  • Financial and tax management: In order to make the corresponding payments, manage tax obligations and maintain the accounting traceability of each transaction, data such as the following will be processed:
    • Bank details (CLABE, account).
    • Tax documents (invoices, withholdings, tax status certificates).
    • Making payments by electronic transfer or checks.
    • Generation of accounting reports, reconciliations and tax audits.
    • Handling requests from the Tax Administration Service (SAT) or other authorities.
  • Facility control and security: We collect personal information (name, company of origin, official identification number, CCTV image) for the purpose of:
    1. Register and control physical access to our facilities.
    2. Monitor the entry and exit of external personnel in operational or restricted areas.
    3. Protecting the integrity of our employees, assets, sensitive information, and technological resources.

  This control may include taking institutional photographs for temporary badges or issuing access credentials.

  • Audit, internal control and regulatory compliance: Use of data to address internal and external reviews, such as:
    • Accounting or tax audits.
    • Verification of compliance with contractual clauses.
    • Investigation of complaints, controversies or conflicts arising from the business relationship.
    • Attention to requirements of competent authorities.
    • Compliance with regulations regarding subcontracting, industrial safety, personal data protection, or applicable sectoral laws.
  • Operational and commercial communication: Your data will be used to facilitate efficient communication regarding:
    1. Product deliveries, service provision, or incident resolution.
    2. Urgent notifications, contractual modifications or payment terms.
    3. Coordination between different operational areas of the Company and its technical or administrative staff.
• Secondary Purposes
  These purposes are complementary in nature and allow us to foster a stronger, more strategic, and long-term business relationship. For processing your data, we require your prior consent, either express or implied, which you may revoke at any time in accordance with the mechanisms described below.
  • Invitations to tenders and future projects: The Company may use your contact details for:
    • Extend invitations to future private tenders, price competitions, technical calls for proposals, or new business opportunities that match your profile, experience, or business focus.
    • Maintain a proactive communication channel with suppliers with outstanding performance or a satisfactory track record.
  • Inclusion in internal directories or databases of frequent suppliers: Incorporate your information (name or company name, specialty, contact person, email, phone number) into internal databases of recurring or trusted suppliers. This allows other departments to more easily locate strategic partners, reducing time and increasing operational efficiency.
  • Institutional dissemination and project recognition: If your collaboration with the Company is part of a success story, innovative project, or outstanding initiative, your business information (company name, brand, service description) may be used in institutional dissemination materials such as:
  • Annual reports, internal or external campaigns.
  • Posts on corporate social media or website.
  • Participation in events, exhibitions or fairs for recognition purposes.

  For this type of public dissemination, your specific and documented consent will always be requested.

Mechanisms to express their refusal to secondary purposes

You have the right to refuse the processing of your data for secondary purposes without this affecting your contractual or commercial relationship with the Company. You may exercise this right at any time by:

• Send your request to the following email address: protecciondedatos@tgarzaleal.com
• Physical delivery of a written request to the Central Control Department or Personal Data area in our offices.
• Use of the ARCO rights exercise form , available upon request, which may be submitted in physical form or electronically.

Any expression of refusal will be recorded and respected by all departments of the Company involved in the processing of your data.




Personal Data collected by the responsible party

For the purposes described in this Privacy Notice, Transportes Garza Leal, SA de CV collects only personal data that is relevant, adequate, and strictly necessary in accordance with the principle of proportionality established in our policies and applicable federal legislation. The processing of such data is carried out under high standards of confidentiality, security, and legality.

The following details the categories and examples of personal data that may be requested, either directly, through documents, electronic means, physical forms, or from sources permitted by law:

Personal Data Collected
Data Type	Reason or justification	List of data
ID	They include the basic information that allows verification of the identity of the individual acting on their own behalf or as a legal representative of a legal entity. This data is primarily used to verify your identity, provide legal certainty to the acts we carry out, and maintain effective communication channels.	Full name(s) Tax and/or private address. Telephone numbers (landline and mobile). Personal or corporate email address. Federal Taxpayer Registry (RFC). Unique Population Registry Code (CURP). Number and type of valid official identification (INE voter credential, passport, professional license, driver's license). Handwritten or electronic signature (when applicable).
Work or professional	When dealing with individuals acting on behalf of supplier companies or individuals engaged in business activities, data related to their experience, functions and professional profile may be collected. This data allows for the evaluation of the supplier's suitability, verification of specific technical or legal requirements, and the objective and traceable documentation of the contract.	Name or business name of the represented company. Position, role or function within the organization. Business activity or sector to which it belongs. Professional specialty or type of service/product offered. Relevant career path and professional experience. Employment, business or banking references. Certifications, licenses or proof of regulatory compliance. Proof of membership in business chambers, guilds or associations.
Assets and financial	To comply with tax, contractual and payment obligations arising from the business relationship. Its processing is justified under Article 10 of federal legislation. However, the Company applies enhanced security measures and document controls to prevent unauthorized access, misuse, or disclosure of this information.	Updated Tax Status Certificate. Billing information (company name, tax address, tax regime). Clave Interbancaria (CLABE). Bank account number and type. Name and branch of the bank. SWIFT/BIC code (for international payments). Account statement to verify ownership.
Access and security data in facilities	When you or your staff physically access our facilities for the purpose of providing services, technical supervision, work meetings, or logistical deliveries. The data allows us to guarantee the safety of personnel, assets, confidential information and the traceability of events within the Company, in accordance with our internal access control and video surveillance policies.	Date and time of entry/exit. Visitor log. Vehicle details (license plate, type, contracting company). Photograph or image captured by video surveillance cameras (CCTV). Electronic entry or registration signature. Assigned temporary badge or credential. Record of the area visited and reason.

Transportes Garza Leal, SA de CV does not require or collect, as a general rule, sensitive personal data (such as health status, ideology, union affiliation, ethnic origin or biometric data) from suppliers, contractors or their legal representatives.

In the event that, due to an extraordinary and fully justified situation (such as the execution of a critical project that requires medical certifications, access to classified areas or handling of strategic confidential information), sensitive data must be collected, you will be informed promptly and formally, and your express written consent will be requested, in accordance with the provisions of Article 8 of the Federal Law and Article 15 of its Regulations.

In those cases, the following details are provided:

• The specific purpose of the treatment.
• The type of sensitive data collected.
• The technical, physical and administrative security measures that will be applied.
• The storage period and its eventual safe disposal.

Transfers of Personal Data

Your personal data may be transferred to the following entities, national or foreign, without requiring your consent, in the cases provided for in Article 37 of the LFPDPPP:

• Competent authorities: To administrative or judicial authorities for the fulfillment of legal, tax, labor, contractual obligations, or for the attention of judicial requirements.
• External auditors and advisors: To external audit firms, accounting, legal, industrial safety, quality control or regulatory compliance advisors, when indispensable for the review, evaluation or defense of the interests of the Company and for the fulfillment of contractual obligations.
• Companies of the Same Corporate Group: To controlling companies, subsidiaries or affiliates of Transportes Garza Leal, SA de CV that operate under similar internal data protection processes and policies, for the purpose of managing shared administrative or corporate processes.
• Third parties with a legal relationship: To banking entities, financial institutions or other entities with which we have a contractual relationship for the management of payments, electronic transfers, financing or any other economic operation derived from our contracts.
• Business partners for co-execution of projects: To other carriers or logistics partners when indispensable for the execution of a service or project that you provide and that involves coordination between multiple parties, provided that the transfer is necessary for the fulfillment of your contract.

In all data transfers, Transportes Garza Leal ensures that third-party recipients assume the same confidentiality, security, and data protection obligations as the Company and commit to processing your information in accordance with this Privacy Notice and for the stated purposes. Relationships with suppliers acting as data processors, meaning those who process data on our behalf, are formalized through contracts that define their actions and obligations, prohibiting them from subcontracting without our express authorization, as established in Articles 51 and 54 of the LFPDPPP Regulations.

Means to exercise your ARCO Rights and revocation of consent

You have the right to:

• Access your personal data held in our databases, as well as information related to the conditions and generalities of its processing.
• Rectify or correct your personal data when it is inaccurate, incomplete or not up to date.
• Cancel your personal data from our files, records, and systems once they are no longer needed for the purposes of processing. This will result in a blocking period and subsequent secure deletion.
• To object to the processing of your personal data for specific purposes, when there is a legitimate reason that justifies the cessation of such processing, or to stop the automated processing that produces unwanted legal effects.

You also have the right to withdraw your consent to the processing of your personal data at any time, without retroactive effect.

To exercise any of your ARCO rights or revoke your consent, you must submit a written request through the following channels:

• Via email: By sending your request to protecciondedatos@tgarzaleal.com
• In person: By going directly to the Central Compliance Department or the designated area in our offices, located at the Company's address (Periférico Raúl López Sánchez Km. 14.5, Colonia Centro, CP [Insert Postal Code], Lerdo, Durango, Mexico).

Your application must contain and be accompanied by the following:

• Your full name or the company name you represent, contact information (full address, telephone, email) and any other means you authorize to receive notifications related to your application.
• Documents that prove your identity (copy of current official identification: voter ID, passport) or, if applicable, the personality and identity of your legal representative (copy of current official identification of the representative and copy of public instrument or simple power of attorney signed before two witnesses).
• A clear and precise description of the personal data regarding which you seek to exercise any of the ARCO rights, unless it is the general right of access.
• The description of the ARCO right you intend to exercise, or what you are requesting.
• Any other element or document that facilitates the location of personal data.
• In the case of requests for rectification of personal data, you must indicate the modifications to be made and provide the documentation that supports your request.

The company's response times, in accordance with federal legislation and internal policies, are:

• The Company will communicate the decision made regarding your request within a maximum period of 20 business days , starting from the date of receipt of the complete request.
• If the decision is deemed appropriate, it will be implemented within 15 business days following the date on which the response is communicated to you.
• These deadlines may be extended once and for an equal period, provided that the circumstances of the case justify it.

Exercising your ARCO rights is free of charge. Fees may only be charged to cover the costs of reproduction, copies, or shipping, if required. If you provide the magnetic or electronic media, or the mechanism necessary to reproduce the data, it must be provided free of charge.

Security measures implemented to protect your Personal Data

At Transportes Garza Leal, SA de CV, we have implemented and maintain rigorous administrative, physical, and technical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing. These measures are consistent with our internal data protection policies and aim to ensure the confidentiality, integrity, and availability of your information.

Our measures include, but are not limited to:

• Access controls: Use of unique and individualized credentials for access to systems, databases and files, applying the principle of "least privilege".
• Data encryption: Encryption of sensitive or financial information both in storage and in transit.
• Infrastructure protection: Implementation of antivirus, firewalls and intrusion detection systems.
• Backups and recovery: Performing regular and secure backups to ensure the availability of information.
• Physical security: Strict access control to facilities and locking of physical documents.
• Vulnerability management: A continuous process of identifying and mitigating weaknesses in our systems.
• Training and awareness: Mandatory training programs for our staff on best practices in information security and personal data protection.
• Monitoring: Constant surveillance of systems and information flows to detect unusual activities or unauthorized access.
• Secure disposal: Documented procedures for the secure and permanent blocking and deletion of data when they have fulfilled their purpose.

Modifications to this Privacy Notice

This Privacy Notice may be modified, changed or updated due to new legal requirements, our own needs related to the services we offer, our privacy practices, changes in our business model, or other reasons.

We are committed to keeping you informed of any changes to this Privacy Notice. Updates will be communicated to you through the electronic or physical means previously agreed upon with you, such as the email address you have provided, or by posting them on our official website in the suppliers section.

This Privacy Notice was prepared in accordance with the institutional data privacy policies of Transportes Garza Leal, SA de CV. It corresponds to its current version dated July 7, 2025 .

SIMPLIFIED

PRIVACY NOTICE FOR SUPPLIERS AND CONTRACTORS

At Transportes Garza Leal, SA de CV, a company legally constituted under Mexican law, with address at Periférico Raúl López Sánchez Km. 14.5, Colonia Centro, CP 35159, Lerdo, Durango, Mexico, we are responsible for the processing and protection of your personal data.

Main purposes of the treatment:

We collect your data to verify your identity and legal or professional capacity, formalize the contractual relationship, process orders, coordinate deliveries, issue payments and invoices, manage administrative communications and comply with our tax, accounting and corporate security obligations.

Secondary purposes:

With your consent, we may use your data to invite you to future events, integrate you into internal directories of frequent suppliers, or mention your collaboration for institutional purposes (with prior authorization).

If you do not wish your data to be processed for these secondary purposes, you can indicate this at any time.

Consult the full Privacy Notice:

To learn in detail what data we collect (including identification, tax, and financial data), possible transfers, your ARCO rights (Access, Rectification, Cancellation, or Opposition), and the mechanisms to exercise them, please consult our Comprehensive Privacy Notice available in the Purchases area or request it directly at: protecciondedatos@tgarzaleal.com

Last updated: July 2025.

SHORT

PRIVACY NOTICE FOR SUPPLIERS AND CONTRACTORS

Transportes Garza Leal, SA de CV , located at Periférico Raúl López Sánchez Km. 14.5, Lerdo, Durango, Mexico.

We process your personal data for recruitment, operational management, tax, accounting and internal security purposes.

Please see our full Privacy Notice in the Purchases section or write to: protecciondedatos@tgarzaleal.com

Last updated: July 2025.

INTEGRAL

Comprehensive Privacy Notice for Customers of Transportes Garza Leal, SA de CV

Dear customer, prospect or legal representative:

At Transportes Garza Leal, SA de CV, hereinafter referred to as “the Company ,” we recognize that your trust is our most valuable asset. Protecting your personal data is not only a legal obligation, but also an ethical conviction and a daily practice that forms part of our standards of excellence.

We understand that in the context of contracting, providing, or managing our freight transport and logistics services, you share relevant data with us for the formalization, execution, and monitoring of the business relationship. Therefore, we reiterate our commitment to the confidentiality, integrity, and traceability of all information that you or your representative provide to us.

This Privacy Notice aims to provide a clear, understandable, and complete explanation of how we collect, use, store, share, and protect your personal data , both as a client and as a prospective client, in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) , its Regulations , the Privacy Notice Guidelines issued by the Secretariat of Anti-Corruption and Good Governance through "Transparency for the People ," and our Internal Policies on the Protection of Personal Data .

Reading this document will allow you to understand not only the purposes of the processing, but also the mechanisms we provide to you to exercise your rights and maintain control over your personal information.

We invite you to read it carefully.

Identity and address of the party responsible for processing your Personal Data

Transportes Garza Leal, SA de CV , a company legally constituted under Mexican law, with its registered office located at Periférico Raúl López Sánchez Km. 14.5, Colonia Centro , postal code 35159 , in the municipality of Lerdo, Durango, Mexico , is the legal entity responsible for the processing of personal data collected from you as a consequence of your status as:

• Direct client who contracts our transport, logistics or operational consulting services;
• Prospect or potential client with whom we maintain commercial contact;
• Legal representative or agent of a legal entity with which we establish or seek to establish a legal relationship of a commercial nature.

As the data controller, the Company undertakes to process your data under the principles of lawfulness, purpose, proportionality, quality, consent and information , and to implement technical, administrative and physical measures that guarantee its protection at all stages of the data life cycle.

For any matter related to this Privacy Notice, including exercising your ARCO rights or to submit a revocation of consent , you can contact our Central Compliance Unit (Privacy Department) at: protecciondedatos@tgarzaleal.com

This channel is exclusively for issues related to personal data protection, and has internal support processes to ensure timely responses in accordance with regulations.

Purposes of processing your Personal Data

The personal data we collect from you will be used for the following purposes, clearly differentiating between those that are essential to our business relationship and those that seek to improve your experience:

• Primary purposes: The processing of your data for these purposes is strictly necessary for the existence, maintenance and fulfillment of the legal and commercial relationship that we establish with you or with the entity you represent:
  1. Identification and verification: Verify your identity or the legal personality of the company you represent, as well as your ability to enter into contracts and assess your business profile for the viability of the business relationship.
  2. Formalization of the business relationship: Preparation, negotiation, formalization and administration of quotations, service proposals, transport service provision contracts, agreements, purchase orders, and/or sales contracts.
  3. Operational and logistical management of the service: Administration and execution of contracted freight transport services. This includes order management, route planning, unit allocation, logistical tracking of your goods, delivery confirmation, service quality control, and handling of operational incidents.
  4. Financial and tax management: Billing of services provided, collection management, payment administration, application of credit notes and compliance with all applicable tax and accounting obligations.
  5. Commercial and operational communication: Establish direct and effective contact for monitoring the contractual relationship, clarifying doubts, notifying the status of your shipments, addressing specific requirements, resolving complaints or claims, and for any essential communication related to the contracted services.
  6. Evaluation and continuous improvement: Evaluating your satisfaction with our services, monitoring compliance with contractual terms, and conducting internal and external audits to improve our processes and services.
  7. Security and access to facilities: Where applicable, register your access or that of your staff to our facilities, through entry/exit logs and video surveillance systems (CCTV), in order to safeguard the security of people, property and information within our facilities.
• Secondary purposes: These purposes are not strictly necessary for the fulfillment of our primary business relationship, but they allow us to offer you a better experience, keep you informed about new developments, and strengthen our relationship. For these purposes, we require your consent , which may be express or implied.
  1. Marketing and advertising: Sending communications with promotions, advertising, commercial information about new services or routes, special offers, invitations to webinars or launches of Transportes Garza Leal.
  2. Institutional communication: Inclusion in our newsletters, loyalty campaigns, invitations to corporate events, trade fairs or relationship activities.
  3. Market analysis and research: Conducting opinion surveys about our services, market analysis or statistical studies to understand your needs and industry trends, in order to develop new products and services.
  4. Testimonials and success stories: With your specific written authorization, include your testimonial or that of your company, as well as your logo information or the general description of the service provided, in promotional materials (website, social media, business presentations) for dissemination and promotion purposes.

Mechanism for expressing your refusal to secondary purposes: If you do not wish for your personal data to be processed for any or all of the secondary purposes described, you may express your refusal at any time. To do so, please send an email to protecciondedatos@tgarzaleal.com or submit a written request directly to the Central Compliance Department or the designated area in our offices, using our ARCO rights exercise form. Your refusal to these purposes will not affect the provision of contracted services or the main contractual relationship you have with the Company.

Personal Data that is collected

To fulfill the purposes detailed above, we collect the following categories of personal data:

• Identification data:
  • Full name or company name.
  • Federal Taxpayer Registry (RFC).
  • Name and contact details of your legal representative.
  • Official identification of the legal representative.
• Contact information:
  • Billing address.
  • Delivery address for goods
  • Contact phone numbers (operational, commercial, administrative)
  • Contact emails
  • Number of clients assigned by the Company.
• Financial and asset data:
  • Banking information:
    • Bank account number.
    • CLABE interbancaria.
    • Bank name.
    • SWIFT/BIC, and apply.
  • Payment history.
  • Credits with the Company.
• Contractual and service details:
  • Information contained in orders.
  • Quotes.
  • Agreements, service provision contracts or purchase and sale agreements.
  • Details of the goods to be transported: type, value, origin, destination.
  • Service history.
  • Complaints or incidents.
• Access and security data, in facilities:
  • Access records to our facilities: physical or digital logs, CCTV video surveillance recordings.
  • Access vehicle information.

Transportes Garza Leal, SA de CV, does not collect or process sensitive personal data from its clients or their legal representatives in the ordinary course of business for freight transportation services. In the event that, due to an exceptional situation or a specific service requiring it, the processing of any data that could be considered sensitive becomes necessary, you will be promptly informed and your express written consent will be requested for its processing, specifying the specific purpose and the enhanced security measures applied, in accordance with our Sensitive Personal Data Processing Policy.

Transfers of Personal Data

Your personal data may be transferred to third parties, national or foreign, without requiring your consent, in the following cases that are necessary for the fulfillment of our obligations or that are provided for by Article 37 of the LFPDPPP:

• Competent authorities: To tax or administrative authorities, when the transfer is necessary or legally required for compliance with legal, tax or contractual obligations, or for the handling of judicial requirements.
• Complementary or logistical service providers (processors): These are subcontracted companies that participate in fulfilling the transport contract or managing our administrative processes. In these cases, these third parties act as "processors" on our behalf, and their relationship is formalized through contracts that define their actions and obligations, ensuring that they only process your data under our instructions and with appropriate security measures.
• Companies of the same corporate group: To controlling companies, subsidiaries or affiliates of Transportes Garza Leal, SA de CV that operate under similar internal data protection processes and policies, for the purpose of managing shared administrative, accounting, commercial or financial processes.
• Third parties with a legal relationship: To banking entities or financial institutions for the management of payments, electronic transfers, collection or any other economic operation derived from our contracts.
• External auditors and consultants: To external audit firms or legal and compliance consultants , when indispensable for the review, evaluation or defense of the interests of the Company and for compliance with its legal obligations.
• For compliance with contractual obligations: When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the Controller and you as the Data Subject.

In all transfers of personal data, Transportes Garza Leal ensures that the third-party recipients assume the same confidentiality, security and data protection obligations as the Company, and commit to treating your information in accordance with this Privacy Notice and for the stated purposes.

Means to exercise your ARCO rights and revocation of consent

You, as the owner of the personal data, or your legal representative, have the right to:

• Access your personal data held in our databases, as well as information related to the conditions and generalities of its processing.
• Rectify or correct your personal data when it is inaccurate, incomplete or not up to date.
• Cancel your personal data from our files, records, and systems once they are no longer needed for the purposes of processing. This will result in a blocking period and subsequent secure deletion.
• To object to the processing of your personal data for specific purposes, when there is a legitimate reason that justifies the cessation of such processing, or to stop the automated processing that produces unwanted legal effects.

Likewise, you have the right to revoke your consent for the processing of your personal data at any time, without retroactive effect.

Means to submit your ARCO request or revocation of consent: To exercise any of your ARCO rights or revoke your consent, you must submit a written request through the following channels:

• Via email: By sending your request to protecciondedatos@tgarzaleal.com
• In person: By submitting your written request to the Company's address: Periférico Raúl López Sánchez Km. 14.5, Colonia Centro, Lerdo, Durango, Mexico , at the Central Compliance Department or to the area indicated at reception, from Monday to Friday, 9:00 am to 5:00 pm

Your application must include:

• Your full name or the company name you represent, and a means to receive notifications (full address, email or telephone number).
• Documents that prove your identity (simple copy of current official identification such as voter ID, passport, professional license) or, where applicable, the personality and powers of your legal representative (simple copy of official identification of the representative and copy of public instrument or simple power of attorney signed before two witnesses).
• A clear and precise description of the personal data regarding which you seek to exercise any of the ARCO rights.
• The description of the ARCO right you wish to exercise (Access, Rectification, Cancellation or Opposition) or the statement of revocation of consent.
• Any other element or document that facilitates the location of your personal data.
• In the case of requests for rectification, you must indicate the modifications to be made and provide the supporting documentation that supports your request.

The Company will communicate its decision regarding your request within a maximum of 20 business days , starting from the date of receipt of the complete and duly documented request. If the decision is approved, it will take effect within 15 business days following the date on which the response is communicated to you.

These deadlines may be extended once, for an equal period, provided that the circumstances of the case justify it and you are notified of this extension within the original deadline. Exercising your ARCO rights is free of charge. Charges may only be levied to recover reproduction or shipping costs, if necessary. If you provide the magnetic or electronic media, or the mechanism necessary to reproduce the data, it must be provided free of charge.

Security measures implemented to protect your personal data

At Transportes Garza Leal, SA de CV, we have implemented and maintain a comprehensive information security management system, which includes robust administrative, physical, and technical measures designed to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing. These measures are applied consistently with our internal data protection policies and aim to ensure the confidentiality, integrity, and availability of your information at all times, from its collection to its deletion.

Our security measures include, but are not limited to:

• Logical access controls: Implementation of user permissions and profiles based on the "least privilege" principle, ensuring that only authorized personnel access the information necessary for their roles. Elimination of shared passwords.
• Data encryption: Application of encryption technologies to protect sensitive and financial information both in storage (data at rest) and during transmission (data in transit).
• Technological infrastructure protection: Use of firewalls , updated antivirus and antimalware systems, intrusion detection and prevention, and vulnerability management to protect our systems and networks.
• Backups and recovery plans: Performing regular, automated and secure backups of critical information, with copies stored in protected locations and with disaster recovery plans.
• Physical security: Strict control of access to our facilities through visitor logs and video surveillance (CCTV), and locking of physical documents in restricted areas.
• Document and media management: Procedures for the secure handling of documents and storage devices, including the prohibition of storing business data on unauthorized personal equipment and the secure disposal of information on physical and digital media.
• Ongoing training: Mandatory training programs for all our staff on the importance of privacy, data protection policies, secure handling of information, and procedures to follow in the event of any incident.
• Monitoring and audits: Constant supervision of systems to detect anomalous activities and conducting periodic internal and external audits to evaluate the effectiveness of our security measures and regulatory compliance.

Modifications to this Privacy Notice

This Privacy Notice may be modified, changed, or updated periodically to reflect new legal requirements, changes in our business operations, the technologies we use, our internal privacy policies, or for other reasons.

We are committed to keeping you informed of any relevant changes or updates to this Privacy Notice. Updates will be communicated to you through your usual contact methods, by posting the updated version in the customer section of our official company website, or through visible notices in our offices.

This Privacy Notice was prepared in accordance with the institutional data privacy policies of Transportes Garza Leal, SA de CV. It corresponds to its current version dated July 7, 2025 .

SIMPLIFIED

PRIVACY NOTICE FOR CLIENTS AND PROSPECTS

At Transportes Garza Leal, SA de CV, a company legally constituted under Mexican law, with address at Periférico Raúl López Sánchez Km. 14.5, Colonia Centro, CP 35159, Lerdo, Durango, Mexico, we are responsible for the processing and protection of your personal data.

Main purposes of the treatment:

We collect your data to identify you as a client or prospect, establish and manage business relationships, manage quotes, contracts, service orders, transport logistics, billing, collections and payments, as well as for compliance with applicable tax and legal obligations.

Secondary purposes:

With your consent, we may use your data to send you promotions, invitations to corporate events, or satisfaction surveys about our services.

If you do not wish your data to be processed for these secondary purposes, you can indicate this at any time without affecting the business relationship.

Consult the full Privacy Notice:

To learn in detail what data we collect (including identification, tax, and asset information), permitted transfers, your ARCO rights (Access, Rectification, Cancellation, or Opposition) and how to exercise them, please consult our Comprehensive Privacy Notice available at our offices or request it at: protecciondedatos@tgarzaleal.com

Last updated: July 2025.

SHORT

PRIVACY NOTICE FOR CLIENTS AND PROSPECTS

Transportes Garza Leal, SA de CV , with address at Periférico Raúl López Sánchez Km. 14.5, Lerdo, Durango, Mexico.

Your personal data is used for commercial, administrative, logistical and tax purposes related to the provision of our services.

Please see our full Privacy Notice at our offices or write to us at: protecciondedatos@tgarzaleal.com

Last updated: July 2025.

INTEGRAL

Comprehensive Privacy Notice for Visitors and External Parties of Transportes Garza Leal, SA de CV

Dear visitor or external person:

At Transportes Garza Leal, SA de CV ( hereinafter, “the Company”) , your security, privacy, and respect for your personal information are fundamental to us. We recognize that your visit to or presence at our facilities may involve the processing of certain personal data. Therefore, we have developed this Privacy Notice to inform you clearly, simply, and transparently about how we collect, use, store, and protect this information during your interaction with our physical environment or our staff.

This notice applies to any individual who enters our offices, yards, operational areas, control points, parking lots or other corporate or logistics facilities, whether as an occasional visitor, occasional supplier, external technician, family member, representative of authority (fiscal, labor, administrative), client without a formalized legal relationship, applicant in recruitment processes, among others.

Our commitment is to ensure that your data is processed in accordance with the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality, and accountability , as established by the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations. We also adhere to our Internal Personal Data Protection Policies, with an emphasis on the principle of minimal intrusion and maximum protection.

We invite you to read this Privacy Notice carefully before entering our facilities. Your presence on our premises or your participation in activities or interactions with our staff implies your knowledge of the terms set forth herein.

Identity and address of the party responsible for processing your Personal Data

Transportes Garza Leal, SA de CV , a company legally constituted under Mexican law, with address located at Periférico Raúl López Sánchez Km. 14.5, Colonia Centro with postal code 35159 in the municipality of Lerdo, Durango, Mexico , is the legal entity responsible for the processing of personal data collected from you as a result of your physical entry to our facilities or your participation in any activity related to the operation, security or institutional management.

This treatment applies to all cases in which you identify as:

• Visitor for personal, institutional or social reasons;
• Temporary or external technical supplier , who comes to provide a specific service without a continuous contractual relationship;
• Authority , representative of a government agency on an official visit or inspection;
• Client or potential user , without a formalized legal relationship yet;
• Family member or companion of workers or managers;
• Applicant in face-to-face recruitment processes;
• Non-permanent service provider , or any other category considered external.

The processing of your data is limited exclusively to those purposes necessary to ensure the safety of the Company's people, facilities, assets and systems , as well as compliance with our access control, traceability, incident prevention and identity verification policies.

For any comments, clarifications, or requests related to this Privacy Notice, as well as to exercise your ARCO rights , you can contact our Central Compliance Unit (Personal Data Protection Department) through the following official channel: protecciondedatos@tgarzaleal.com

We have defined internal procedures to provide timely, clear responses in accordance with applicable legislation and our institutional policies.

Purposes of processing your Personal Data

The personal data we collect from you will be used for the following purposes, differentiating between those that are strictly necessary for your access and security, and those that support it:

• Primary purposes: The processing of your data for these purposes is essential for the control, security and management of your access to our facilities:
  1. Registration and access control: Register and control your entry and exit from our facilities, offices, operating yards or loading and unloading areas.
  2. Identity verification and protocol compliance: Verify your identity and ensure compliance with our internal safety, health, prevention and compliance protocols for visitors.
  3. Protection of people, property and assets: Safeguarding the safety of people: employees, visitors, external personnel, our property (merchandise, vehicles, equipment) and Company assets, through video surveillance systems (CCTV) in common and restricted areas.
  4. Traffic monitoring: Monitoring the movement of people in security or restricted areas, in accordance with our internal asset security policies.
  5. Specific visit management: Attending and coordinating visits, scheduled meetings, inspections by authorities, guided tours, work tours or any other activity that requires your presence at our facilities.
  6. Delivery and collection control: Manage the delivery and collection of merchandise, packages, documents or materials, including verifying the identity of the person making or receiving such shipments.
  7. Emergency assistance: In the event of an emergency situation within our facilities, use your contact information to notify the person or institution designated by you or to provide you with the necessary assistance.
  8. Compliance with legal requirements: To attend to and comply with requirements of competent authorities in the event of investigations or litigation related to an incident that occurred at our facilities.
• Secondary purposes: These purposes are not strictly necessary for your access to our facilities or for the service of your visit, but they allow us to improve our processes and services. For these purposes, we require your express or implied consent .
  1. Statistical recording and analysis: We will use your data for internal statistical purposes to analyze visitor patterns, peak times, and visitor types, in order to improve operational efficiency and security.
  2. Satisfaction surveys: We invite you to participate in institutional satisfaction surveys related to your experience at our facilities or the service you received.
  3. Graphic documentation of public events: In the event that your visit coincides with institutional events or public activities held at our facilities, your image may be captured in photographs or videos for internal documentation or promotional dissemination of the event, always with your specific and express consent for such purposes.

Mechanism to express your refusal to secondary purposes: You may express your refusal to the processing of your personal data for any or all of these secondary purposes at the time of your access registration, or at any other time, by sending an email to protecciondedatos@tgarzaleal.com or by submitting a written request at the entrance or reception of our facilities. Your refusal of these purposes will not affect your access or the service provided for the primary purpose of your visit.

Personal Data We Collect

To fulfill the purposes detailed above, we collect the following categories of personal data upon your registration:

• Identification Data:
  1. Full name
  2. Official identification number: will be for visual verification only, without retention
  3. Company or institution of origin
  4. Reason for the visit.
• Contact information:
  1. Landline and mobile phone number
  2. Email.
  3. Home
• Image and voice:
  1. CCTV recordings in common areas of our facilities. These recordings are solely for the security of people and property.
• Access log data:
  1. Check-in time.
  2. Departure time.
  3. Name of the person or area of ​​Transportes Garza Leal that authorizes or receives your access.
  4. area or person to which it is addressed.

In strict compliance with our Third-Party Visit and Registration Policy, and to protect your personal data and avoid liability, we will NOT retain or require you to leave your voter ID card (INE), passport, or any other official identification document as a condition of entry to our facilities. For identity verification, you will only be asked to show your document to verify the minimum information required for registration.

Transfers of Personal Data

The personal data collected from you as a visitor or external party will not be shared or transferred to third parties, except in the following cases which are necessary for compliance with a legal obligation, the defense of our interests or security:

• Competent authorities: To administrative or judicial authorities, when there is a legal obligation, a court order, a duly founded and motivated request, or a legal procedure that requires it, especially in the case of security incidents, accidents or investigations.
• Companies of the same corporate group: To controlling companies, subsidiaries or affiliates of Transportes Garza Leal, SA de CV that operate under similar internal data protection processes and policies, when the visitor accesses shared facilities or where joint operations are carried out for logistical, administrative or security reasons.
• External security service providers: Subcontracted companies that provide physical security or CCTV monitoring services at our facilities will act as data processors. In these cases, the relationship is formalized through contracts that include strict confidentiality and security clauses, and a commitment to process your data only under our instructions.

In all cases of transfer, Transportes Garza Leal ensures that the third-party recipients assume confidentiality, security and data protection obligations equivalent to ours, and commit to treating your information in accordance with this Privacy Notice and for the stated purposes.

Means to exercise your ARCO Rights (Access, Rectification, Cancellation or Opposition) and revocation of consent

As the data subject, you have the right to:

• Access your personal data held in our visitor databases.
• Rectify or correct your personal data if it is inaccurate or incomplete.
• Cancel your personal data from our records, once the purpose of its storage has concluded and there are no legal obligations that prevent its deletion.
• To object to the processing of your personal data for specific purposes other than those necessary for your access and security.

You also have the right to withdraw your consent to the processing of your personal data at any time, without retroactive effect.

To exercise any of your ARCO rights or revoke your consent, you must submit a written request through the following channels:

• Via email: By sending your request to protecciondedatos@tgarzaleal.com
• Written request: Submit your request directly at the access control point or at the reception of our facilities, at the Company's address (Periférico Raúl López Sánchez Km. 14.5, Colonia Centro, Lerdo, Durango, Mexico), from Monday to Friday from 9:00 am to 5:00 pm

Your application must include:

• Your full name and a means to receive notifications (full address, email address, or telephone number).
• Documents that prove your identity (simple copy of current official identification).
• A clear and precise description of the personal data regarding which you seek to exercise any of the ARCO rights.
• The description of the ARCO right you wish to exercise or the statement of revocation of consent.
• Any other element or document that facilitates the location of your personal data.
• In the case of requests for rectification, you must indicate the modifications to be made and provide the supporting documentation that supports your request.

The Company will notify you of its decision regarding your request within a maximum of 20 business days from the date of receipt of the complete request. If the decision is approved, it will take effect within 15 business days following the date on which the response is communicated to you.

These deadlines may be extended once, for an equal period, provided the circumstances of the case justify it. Exercising ARCO rights is free of charge. Charges may only be levied to recover reproduction or shipping costs, if necessary.

Security measures implemented to protect your Personal Data

At Transportes Garza Leal, SA de CV, we have implemented and maintain a comprehensive information security management system to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing. These measures, established in our Internal Personal Data Protection Policies, aim to ensure the confidentiality, integrity, and availability of your information.

Our security measures include, but are not limited to:

• Physical and logical access controls: Restricting access to areas where visitor information is stored and the systems that manage it.
• Video surveillance (CCTV): Use of security cameras with visible notice, intended for the protection of people and property.
• Staff confidentiality: Obligation of all staff involved in registration and access control to maintain strict confidentiality regarding the information collected.
• Secure safekeeping: Visitor records (physical or digital) are kept under strict security measures.
• Retention limitation: Your data will only be kept for the time strictly necessary for security and traceability purposes, and will subsequently be securely blocked and deleted.

Modifications to this Privacy Notice

This Privacy Notice may be modified, changed, or updated periodically to reflect new legal requirements, changes in our access control processes, our security technologies, or for other reasons.

We are committed to keeping you informed of any relevant changes or updates to this Privacy Notice. Updates will be communicated by posting the updated version in a visible location at the access control point of our facilities, or through notices in our offices.

This Privacy Notice was prepared in accordance with the institutional data privacy policies of Transportes Garza Leal, SA de CV. It corresponds to its current version dated July 7, 2025 .

SIMPLIFIED

PRIVACY NOTICE FOR VISITORS AND EXTERNAL PERSONS

At Transportes Garza Leal, SA de CV, a company legally constituted under Mexican law, with address at Periférico Raúl López Sánchez Km. 14.5, Colonia Centro, CP 35159, Lerdo, Durango, Mexico, we are responsible for the processing and protection of your personal data.

Main purposes of the treatment:

We collect and process your personal data to register your entry to our facilities, verify your identity, maintain the safety of our people, property and information, and comply with our access control policies and security protocols.

This may include video recording via security cameras (CCTV), recording your identification data, and in some cases, your vehicle or represented company.

Secondary purposes:

In exceptional circumstances and with your consent, we may use your information for statistical purposes or to improve access control processes.

You may express your refusal for these secondary purposes at any time, without affecting your income or care.

Consult the full Privacy Notice:

To learn more about the categories of data collected, permitted transfers, security measures, and the procedure for exercising your ARCO rights (Access, Rectification, Cancellation or Opposition), please consult our Comprehensive Privacy Notice available at our offices or write to us at: protecciondedatos@tgarzaleal.com

Last updated: July 2025.

SHORT

PRIVACY NOTICE FOR VISITORS AND EXTERNAL PERSONS

Transportes Garza Leal, SA de CV , with address at Periférico Raúl López Sánchez Km. 14.5, Lerdo, Durango, Mexico.

Your personal data is processed for the purposes of access control, facility security and compliance with internal policies.

To view the full Privacy Notice, please request it at our offices or via: protecciondedatos@tgarzaleal.com

Last updated: July 2025.