Privacy Notices

INFORMATION TO BE COLLECTED

We inform you that we collect your personal data, including data that may be considered sensitive personal data. Therefore, under no circumstances shall CIUDAD MADERAS process personal data for purposes other than, or incompatible with, those informed in this PRIVACY NOTICE, nor shall it obtain data that does not comply with the criteria stated herein.

For the purposes mentioned herein, we may need to obtain some or all of the following personal data, some of which may be classified as sensitive data under the aforementioned law:

• 1. Customer's full name
• 2. Gender
• 3. Age
• 4. Occupation
• 5. Telephone number
• 6. Email address
• 7. Date of birth
• 8. Address
• 9. Federal Taxpayer Registry (RFC)
• 10. Unique Population Registry Code (CURP)
• 11. Financial and/or banking data
• 12. Asset information
• 13. Additional personal data, such as marital status, nationality, and references

PRIMARY PURPOSES FOR THE PROCESSING OF PERSONAL DATA

CIUDAD MADERAS shall limit the use of the personal data referred to in this PRIVACY NOTICE to carrying out some or all activities necessary for the development and/or fulfillment of the obligations arising from the contractual relationship or relationships generated between CIUDAD MADERAS and you, the customer. Therefore, CIUDAD MADERAS shall only collect and legitimately use personal data that is adequate, necessary, and relevant for the provision of the services provided by CIUDAD MADERAS, as well as to comply with the purposes of this PRIVACY NOTICE, including, by way of example and not limitation:

• To verify your identity using the data provided and to identify you as the holder and/or user of the services provided by CIUDAD MADERAS before authorities and/or third parties with whom we have collaboration agreements.
• To comply with cooperation obligations before security and justice authorities, as well as with requests from competent authorities in legally provided cases under the laws of the United Mexican States.
• To verify with the National Electoral Institute (INE) the quality of the data contained in your voter identification card, including, where applicable, your biometric data.
• To carry out processes for security purposes and the prevention of unlawful conduct, such as fraud and/or identity theft, as well as customer identification in accordance with the Federal Law for the Prevention and Identification of Transactions with Resources of Illicit Origin, or any other requirements that must be addressed by law or court order.
• To contact you for commercial prospecting purposes and to respond to your requests for advertising purposes through various electronic means, including telephone calls, email communications, text messages, and other physical and/or electronic communication channels, carried out by CIUDAD MADERAS or third parties authorized by CIUDAD MADERAS. This includes any matter related to the use and management of the services provided, informing you of any benefit to which you may be entitled as a result thereof, and complying with obligations arising from any legal relationship with you.
• To formalize purchase agreements and commercialize goods or services offered by CIUDAD MADERAS.
• To validate the quality of the information provided by you and/or by authorized third parties.
• To carry out billing and collection procedures and/or process payments through the enabled methods and mechanisms.
• To prepare analyses and studies related to your consumption behavior, as well as periodic investigations and monitoring of your credit behavior, including providing information to the corresponding credit reporting companies.
• To quote and manage goods and/or services of CIUDAD MADERAS or its affiliates.
• To prepare reports, forecasts, surveys, research, and analyses in relation to the use and quality of the goods and/or services offered by CIUDAD MADERAS or its affiliates.
• To comply with obligations established under applicable regulations.

SECONDARY PURPOSES FOR THE PROCESSING OF PERSONAL DATA

If you do not object, CIUDAD MADERAS may process identification and contact data of third parties when you directly provide such information so that those third parties may be contacted as personal references for collection purposes, commercial prospecting, investigations, verification of the quality of the information provided by you, periodic monitoring of your credit history, performance of various procedures related to the services on your behalf, and/or compliance with legal obligations acquired by you.

By providing this information, you acknowledge that you have duly informed such third parties and previously obtained their consent so that CIUDAD MADERAS may process their data for the purposes stated herein, and that you have informed them of the means through which this PRIVACY NOTICE is made available.

MEANS FOR EXERCISING THE RIGHTS OF THE DATA SUBJECT

We inform you that, in accordance with the so-called ARCO rights (Access, Rectification, Cancellation, and Objection), you have the right to know what personal data we hold about you, what we use it for, the conditions of use we apply to it, and to obtain a copy of it in a legible and easy-to-read digital format. Therefore, you are informed that you may at any time request the correction, modification, or replacement of your own personal information if it needs to be updated due to any change. Likewise, you have the right to request the permanent removal of your information from our database when you deem it appropriate, and you may also object to the use of your personal data for specific purposes.

For any matter related to the exercise of the aforementioned rights, you may submit your request to the following email address: aviso.privacidad@ciudadmaderas.com. Such request will be answered by the current executive in charge of the personal data protection and privacy area through the same email address, providing a prompt response to your petition within a maximum period of 20 (twenty) business days counted from the date on which the request was received, sending the response electronically to the email address from which the request was made.

TRANSFERS OF PERSONAL DATA

• Transfers not subject to consent.

CIUDAD MADERAS may transfer your personal data to both national and foreign entities for the following purposes:

• To competent authorities and third parties in legally provided cases.
• To the National Electoral Institute (INE) to verify the quality of the data contained in your voter identification card, including biometric data where applicable.
• To credit reporting companies, surety companies, and insurance companies with whom we have legal agreements to guarantee compliance with obligations arising from the services or goods acquired or contracted.
• To affiliates of CIUDAD MADERAS operating under privacy policies that comply with the corresponding applicable provisions, so that they may contact you directly or indirectly to carry out segmentation, profiling, promotional activities, and, where applicable, offer products and/or services that such companies may commercialize and/or provide jointly with CIUDAD MADERAS or independently.
• To third-party service providers with whom CIUDAD MADERAS has binding legal agreements for the purposes set forth in this PRIVACY NOTICE.

• Transfers requiring your consent.

• If you do not object, CIUDAD MADERAS may transfer the necessary personal data to business partners and/or third parties with whom we have binding legal agreements, including financial sector institutions, so that they may contact you and offer you goods, products, and financial services.

Therefore, through this document, you, as data subject, grant full authority to CIUDAD MADERAS to transfer your information to any of the affiliated or subsidiary companies of FRACCIONADORA LA ROMITA S.A. DE C.V.. Likewise, you authorize CIUDAD MADERAS to share personal data, including email address, telephone number, and asset and/or financial information, with service providers, outsourcing companies, or companies with whom CIUDAD MADERAS has a collaboration, alliance, or commercial agreement that contributes to improving or facilitating the operations of its corporate purpose, respecting the morals and values of the company, and strictly adhering to the guidelines contained in the Federal Law on the Protection of Personal Data Held by Private Parties.

If users voluntarily provide additional information directly to such service providers, those providers will use such information in accordance with their own privacy policies.

AUTHORITY REQUESTS

CIUDAD MADERAS cooperates with competent authorities and other third parties to ensure compliance with the law, including matters related to the protection of industrial and intellectual property rights, fraud prevention, and other matters. Therefore, it may disclose users' personal data upon request from competent judicial or governmental authorities for investigations conducted by them, even if there is no executive or judicial order or subpoena, including, by way of example and not limitation, criminal or fraud investigations, computer piracy, or copyright infringement.

In such situations, CIUDAD MADERAS will cooperate with the competent authorities in order to safeguard the integrity and security of the community and its users. CIUDAD MADERAS may, and users expressly authorize it to, disclose any personal data of its users for the purpose of complying with applicable regulations and cooperating with competent authorities to the extent we discretionally deem necessary and appropriate in relation to any investigation of an unlawful act or any matter that may expose CIUDAD MADERAS, its affiliates, or its users to any legal liability. This right shall be used by CIUDAD MADERAS at its sole discretion when it deems it appropriate or necessary to maintain the integrity and security of the community and its users, and to enforce the General Terms and Conditions and other policies.

RETENTION OF YOUR PERSONAL DATA

CIUDAD MADERAS shall retain your personal data only for the time necessary to provide you with the services contracted with CIUDAD MADERAS and/or its affiliates, as well as during the term of any contractual relationship and/or any legal relationship you may have with CIUDAD MADERAS, provided that it maintains a legal basis that allows it, under applicable laws, to process your personal data. Once any relationship of any nature with CIUDAD MADERAS has ended, it shall proceed with the secure deletion of your data from any database or record in its possession.

CHANGES TO THE PRIVACY NOTICE

CIUDAD MADERAS and/or its affiliates reserve the right, at their sole discretion, to change, modify, add, or remove portions of this PRIVACY NOTICE. In such case, CIUDAD MADERAS shall keep its PRIVACY NOTICE updated at https://ciudadmaderas.com/aviso-de-privacidad. CIUDAD MADERAS shall notify you of any change or modification to this notice through one or more of the following means:

• 1. At the addresses of the various sales and customer service locations of CIUDAD MADERAS;
• 2. Through the website www.ciudadmaderas.com or directly through the link https://ciudadmaderas.com/aviso-de-privacidad/;
• 3. Through the official contracts or forms of CIUDAD MADERAS.

When the aforementioned changes involve a substantial change in the purposes or processing of personal data, CIUDAD MADERAS shall inform you at least 05 (five) business days before such changes take effect, through the direct notification mechanisms available for you, such as email, telephone number, or digital instant messaging. If legally required, CIUDAD MADERAS shall obtain your consent for the processing of your personal data, always informing you of the modification date of this PRIVACY NOTICE through said link.