Privacy Notice

In compliance with the provisions of the Federal Law for the Protection of Personal Data in Possession of Individuals (hereinafter the “Law”), the Regulations of the Federal Law for the Protection of Personal Data in Possession of Individuals (hereinafter the “Regulations”) and the Privacy Notice Guidelines published in the Official Gazette of the Federation on January 17th, 2013 (hereinafter the “Guidelines”) and other applicable provisions, DEACERO, S.A.P.I. de C.V., its affiliates and/or subsidiaries (hereinafter “DEACERO”) wishes to inform the User of the domains or websites www.deacero.com, (hereinafter the “User”), its Privacy Notice regarding the treatment and protection of personal data of those individuals or legal entities that voluntarily communicate via email, telephone or any other electronic, oral or written means with DEACERO, fill out forms that collect personal data or enter and/or access the website mentioned herein, if this involves the communication of their personal data.

For all purposes related to this Privacy Notice, DEACERO is responsible for the treatment and can be located at its address located at Avenida Lázaro Cárdenas #2333, Zona Loma Larga Oriente Neighborhood, in the municipality of San Pedro Garza García, Nuevo León, México, Zip Code 66266, issuing and making available to the User this Privacy Notice, under the following terms:

I. Purpose of the processing of your personal data.- The personal information provided by the User will be used only to provide services related to, but not limited to, the purchase and sale of products and services of the steel industry, steel derivatives and other related industries.

Also, your personal data will be used for the following secondary activities: (i) analysis for internal use and preparation of statistical reports, (ii) control of files of customers, suppliers, service providers and third parties related to DEACERO, (iii) marketing, offers and promotions, (iv) determine their creditworthiness and if applicable granting credit, (v) commercial prospecting; (vi) sales and after-sales services related to the collection and administration, such as: invoicing, cancellations, and delivery arrangements; (vii) preparation and formulation of commercial agreements (contracts, agreements and other similar documents; (viii) Knowing the User's purchase experience through surveys, evaluations or similar; (ix) analysis for internal use of the Corporate; (x) statistical reports; (xi) human resources planning; (xii) control of internal and/or external personnel files, suppliers, collaborators and any analogous figure; (xiii) informative, commercial or leisure events managed or in which DEACERO may participate; and/or (xiv) any other activity related to DEACERO's corporate purpose.

DEACERO will always provide the User with adequate guarantees regarding the processing of personal and sensitive data. If you do not agree with the secondary purposes, you may at any time express your refusal by following the mechanism provided in section “VIII” of this Notice. It is necessary to point out that in case of the above-mentioned assumption, DEACERO will not be able to provide you with the services it renders in a correct manner, and it will not be responsible for such situation.

II. Personal data requested.- For the purposes of this Privacy Notice, personal data shall be understood as any information collected concerning individuals or legal entities identified or identifiable; and by “User” refers to any identified or identifiable individual or legal entity that communicates personal data through the website mentioned herein by any of the following means: i) e-mail; ii) filling out forms through which personal data is collected; iii) participation in campaigns; iv) creation of User profiles or accounts; v) use of blogs, chats, forums; vi) publication of content; and vii) in general, the use of any service present on the website that involves the communication of personal data.

The personal data that DEACERO will collect from the User are: i) full name; ii) alias; iii) date of birth; iv) country of origin; v) marital status; vi) nationality; vii) gender; vii) fiscal address; ix) home address; x) e-mail; xi) RFC and tax identification number (for foreigners); xii) CURP and equivalents (for foreigners); xiii) Official Identification and equivalents (for foreigners); and xiv) telephone; committing that the personal or sensitive information will be treated under security measures, always guaranteeing the confidentiality of the User.

DEACERO may request from legal entities personal data of its employees, collaborators, legal representatives, agents, necessary for the performance of the activities indicated in section “I” above, as well as contact data and reference to the User, such as name, mail, telephone, country, position, company and similar, in order to facilitate the reference in DEACERO's internal databases, cooperation and future communications.

For the performance of the secondary activities listed in the second paragraph of section I of this Privacy Notice, personal data may be collected indirectly through Cookies, Web Beacons, and/or Pixel Tags, to obtain data on IP addresses, browser types, operating systems, web pages visited, duration of browsing time, monitor user behavior and purchase preferences. If the user wishes so, it may remove or disable these tools, and may request DEACERO's advice by sending an e-mail to privacidad@deacero.com for such purpose.

III. Sensitive personal data.- It shall be understood as those personal data that affect the most intimate sphere of its owner or that its improper use may generate discrimination or lead to a serious risk for him/her. Being data related to health, as well as those that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical, and moral beliefs, union affiliation, political opinions, sexual preference.

IV. About Social Networks.-DEACERO informs the User that it is present in social networks such as Instagram, Facebook and Twitter. The treatment of the User's data that become followers of the official pages of DEACERO shall be governed by the conditions provided in the terms and conditions of the social network that corresponds by means of any data that the social network requires to be collected is the responsibility of it and not DEACERO, so it is recommended access to the privacy policy and conditions of use of the aforementioned pages or in its case, of the social network itself, in order to know the information derived from the treatment of personal data and especially the conditions and purposes for which the data that form part of the User's profile will be used.

V. Safekeeping and preservation of personal data.- The User's personal data will be safeguarded based on the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility, which are established in the Law. However, for the protection of the User, the Site has security certificates, which allow the transmission of data between the server and the User, and in feedback, to be private, which means that DEACERO acts diligently in protecting the exchange of information.

DEACERO shall ensure at all times, the effective protection and safeguarding of the personal and sensitive data collected and shall offer the User adequate guarantees for the safeguarding of such data.

DEACERO informs the User that the personal and sensitive data provided will be kept as long as the commercial relationship between both parties is maintained and until the User has not exercised its right of limitation and/or cancellation, in accordance with paragraph “X”. DEACERO will consider the legal terms applicable in each specific case, considering the type of data and the purpose of its processing. You may request further details on the retention period by sending an e-mail to privacidad@deacero.com with the subject heading “Consultation on retention periods”.

VI. Transfer and communication of data.- DEACERO may transfer and/or communicate the User's personal data to third parties other than this company. DEACERO informs the User that its consent shall not be required for the transfer of personal and sensitive data to its controlling companies, subsidiaries or affiliates, whether national or foreign, that belong to or are integrated to DEACERO's business group; research agencies, credit associations, credit reference applicants, as well as any individual or legal entity that may, at its discretion, provide such information; the foregoing, for credit investigation and/or celebration and compliance of contracts, agreements and related documents where the Parties have a common interest; medical institutions and/or third parties that require to know it for prevention or medical diagnosis, health care, medical treatment or management of health services; authorities or government agencies of any level that is necessary or legally required for the safeguarding of the public interest, procurement and administration of justice or by express mandate of the authority, including but not limited to, but not limited to, such as: Mexican Federal Consumer Protection Agency (Procuraduría Federal del Consumidor), Mexican Ministry of Finance and Public Credit (Secretaría de Hacienda y Crédito Público), Mexican Tax Administration Service (Servicio de Administración Tributaria); only, when such situation is imperative by an official request, both administrative and judicial. If the User does not express his opposition for his personal data to be transferred, it will be understood that he or she has given his consent to do so.

Moreover, DEACERO may communicate your personal data to employees and collaborators in charge of the processing and for the execution of contracts and/or specific operations related to the purposes indicated in section “I”, based on instructions and guarantees of security and confidentiality established by DEACERO. DEACERO shall ensure that third party recipients have their respective privacy notices and rules for the treatment and safeguarding of personal and sensitive data in accordance with the applicable legislation, and the third-party recipient shall assume the same obligations applicable to DEACERO for the treatment and safeguarding of personal and sensitive data.

VII. Data collection.- DEACERO states that it may obtain User's information from other sources permitted by law, such as printed and/or digital telephone directories, DEACERO's own data forms, among other applicable sources, therefore DEACERO and its affiliates and subsidiaries are not and shall not be liable for the accuracy of the personal information provided by the User, nor of its verification and/or updating, so if the User does not request the change or modification of information, it shall be assumed that the information is accurate and true with all the implications that this entails, being the User the only responsible for the personal information provided and its consequences.

VIII. Changes or amendments to the Notice.- DEACERO reserves the right to amend the present Notice and therefore informs you that any change or modification to the content of this Notice will be published in a generalized manner on the web page: www.deacero.com

IX. ARCO rights.- In accordance with the provisions of the Law, the User has the right to access, rectify and cancel its personal data as well as to oppose the disclosure and limitation of the use thereof. For such purpose, he or she may:

Access at all times to its personal data held by DEACERO, learn about the Privacy Notice to which the treatment is subject, as well as to rectify the data when they are inaccurate or incomplete and to request their cancellation.

In case of cancellation pursued by the User, notice will be given to the User, and this will result in a blocking period after which the data will be deleted. DEACERO, as the data controller, may keep the data exclusively for the purposes of the liabilities arising from the processing. The blocking period shall be equivalent to the statute of limitations period for actions arising from the legal relationship underlying the processing under the terms of the applicable law.

DEACERO shall not be obliged to cancel personal and sensitive data when: (i) they refer to the parties to a private, social or administrative agreement and are necessary for its due compliance; (ii) must be processed by legal provision; (iii) may hinder judicial or administrative actions linked to tax or criminal obligations, prosecution of crimes or the updating of administrative sanctions; (iv) are necessary to shield the legally protected interests of the User; v) are required to carry out an action in the public interest; vi) are necessary to comply with an obligation legally acquired by the User; and vii) are the object of treatment for prevention or for medical diagnosis or the management of health services, provided that such treatment is carried out by a health professional subject to a duty of secrecy.

The User has the right to object, at any time and with legitimate cause, to the processing of its data and in the event that such objection is justified, DEACERO undertakes to comply with and avoid processing the applicable personal data.

X. Means to exercise ARCO rights.- The User may exercise its rights of Access, Rectification, Cancellation and Opposition (“ARCO” Rights), oppose the disclosure and limitation of use of its data, as well as revoke its consent or express refusal to the processing thereof, by contacting our personal data department, which is located at: Avenida Lázaro Cárdenas #2333, Zona Loma Larga Oriente Neighborhood, in the municipality of San Pedro Garza García, Nuevo León, Zip Code 66266, or through our website www.deacero.com/aviso-de-privacidad, or by sending an e-mail to privacidad@deacero.com, addressed to DEACERO, S.A.P.I. de C.V., indicating the following:

i. Full name of the holder of the personal data.

ii. Address or e-mail address to which all communications related to the request may be sent.

iii. Digitalized copy of an official document proving the identity of the applicant, which may be: voting identification card, driver's license, passport, and/or any other document that facilitates the location of personal data.

iv. Clear and precise description of the personal data in respect of which you are seeking to exercise any of your rights or the activity for which you wish to limit the use of the personal data.

v. The express manifestation to revoke their consent to the processing of their personal data and therefore for them not to be used; and

vi. Any other element that facilitates the location of personal data.

DEACERO shall have a period of no more than 20 (twenty) business days to respond to the request by the means indicated by the User, counted from the date on which the request was received, to make the request effective, if applicable, within fifteen days from the date on which the response is communicated.

DEACERO may in its whole or partially deny access, rectification, cancellation or opposition when: (i) the applicant is not the owner of the personal data, or the legal representative is not duly accredited to do so; (ii) the applicant's personal data is not found in its databases; (iii) the rights of a third party are harmed; (iv) there is a legal impediment, or the resolution of a competent authority, which restricts access to personal data, or does not allow the rectification, cancellation or opposition thereof; and, (v) the rectification, cancellation or opposition has been previously made.

In case of a partial refusal, DEACERO shall carry out the access, rectification, cancellation or opposition requested by the User. DEACERO shall inform at all times to the User, the reason for its decision and notify the User within the corresponding term, together with the relevant evidence. However, if the User considers that its rights with respect to the protection of personal data have been undermined, he or she has the right to appear before the relevant authority to enforce the exercise of such rights. The authority is the Mexican National Institute of Transparency, Access to Information and Protection of Personal Data (INAI by its Spanish acronym).

In accordance with article eight of the Law, by the simple fact of not expressing opposition when reading this Notice, it shall be understood that the User accepts its terms. If the User wishes to stop receiving promotional messages from DEACERO by telephone or e-mail, he or she may request it at privacidad@deacero.com.

Any changes to this privacy notice may be consulted at www.deacero.com/aviso-de-privacidad.

Date of last update: January 15, 2024.