Privacy Notice

English Version — Courtesy Translation

This English version is provided for the convenience of our customers, suppliers, business partners, employees, visitors, and other interested parties. The Spanish version of this Privacy Notice is the official version for purposes of compliance with applicable Mexican data protection laws. In the event of any discrepancy or inconsistency between the Spanish and English versions, the Spanish version shall prevail.

PRIVACY NOTICE

VITTI LOGISTICS, S. DE R.L. DE C.V., hereinafter referred to as “VITTI,” with address at Boulevard Campestre No. 302, Parque Industrial Server, C.P. 25354, Arteaga, Coahuila, Mexico, is responsible for the processing and protection of the personal data it collects. Accordingly, and in compliance with the applicable legislation governing the protection of personal data held by private entities in Mexico, VITTI makes this Comprehensive Privacy Notice available to you.

For any matter related to the processing of your personal data, you may contact VITTI through:

Email: auditora@vittilog.com
Email: mzertuche@vittilog.com
Telephone: 844 133 00 96
Website: www.vittilog.com

1. WHAT PERSONAL DATA DO WE COLLECT?

For the purposes described in this Privacy Notice, VITTI may collect and process the following categories of personal data, depending on the nature of the relationship you have with VITTI:

Identification data.
Contact information.
Nationality.
Home address.
Federal Taxpayer Registry (RFC).
Tax information.
Employment-related information.
Asset and/or financial information.
Bank account information.
Insurance-related information.
Credit history information, when necessary for the corresponding commercial relationship.
Images obtained through video surveillance systems installed in certain areas of VITTI's facilities.

VITTI will process only those personal data that are necessary, appropriate, and relevant for the purposes established in this Privacy Notice.

If VITTI needs to collect sensitive personal data, the applicable consent will be obtained in accordance with applicable law, and the necessary measures will be implemented to ensure its appropriate processing.

2. FOR WHAT PURPOSES WILL WE USE YOUR PERSONAL DATA?

The personal data collected by VITTI will be used for the following purposes:

Primary Purposes

These purposes are necessary for the provision of services and for establishing and maintaining the legal or commercial relationship with you:

To identify and contact customers, prospects, suppliers, representatives, and business contacts.
To conduct commercial prospecting and business development activities.
To prepare quotations, commercial proposals, agreements, contracts, and documentation related to our services.
To provide logistics services and services related to supply chain management and foreign trade.
To coordinate transportation, warehousing, distribution, logistics, and related operations.
To manage and administer commercial relationships with customers and suppliers.
To carry out billing, collection, payment, and administrative processes.
To verify tax, commercial, and financial information when necessary for the commercial relationship.
To conduct credit assessments and credit analyses, when applicable.
To manage insurance related to contracted services or operations.
To comply with legal, tax, administrative, contractual, and regulatory obligations applicable to VITTI.
To respond to requests from competent authorities.
To prevent and detect potential fraud, abuse, non-compliance, or unlawful activities.
To maintain internal records and controls related to VITTI's operations.
To respond to inquiries, requests, complaints, clarifications, and claims.
To protect the safety and security of persons, facilities, vehicles, merchandise, equipment, and other VITTI assets.
To control and administer access to VITTI facilities.
To prevent, detect, investigate, and document security incidents through video surveillance systems.
To exercise or defend VITTI's rights in connection with potential disputes, administrative proceedings, or judicial proceedings.
Any other purpose that is necessary for the performance of the applicable legal or commercial relationship.

Secondary Purposes

In addition, VITTI may use your personal data for:

Sending commercial information.
Conducting marketing and advertising activities.
Informing you about VITTI products, services, promotions, events, news, and commercial communications.

If you do not wish your personal data to be used for the secondary purposes described above, you may express your refusal by submitting a request to:

Email: auditora@vittilog.com
Email: mzertuche@vittilog.com
Telephone: 844 133 00 96

Your refusal to allow the use of your personal data for secondary purposes will not be grounds for VITTI to deny the products or services you request or contract.

3. HOW CAN YOU REFUSE THE USE OF YOUR PERSONAL DATA FOR SECONDARY PURPOSES?

You may request at any time that your personal data not be used for marketing, advertising, or commercial communications.

To do so, you may submit a request to either of the following email addresses:

auditora@vittilog.com
mzertuche@vittilog.com

Your request should clearly indicate that you wish to stop receiving commercial communications.

VITTI will process your request in accordance with its internal procedures and applicable law.

4. TRANSFERS OF PERSONAL DATA

In connection with the provision of its services, VITTI may need to share personal data with third parties, whether located in Mexico or abroad, when necessary to fulfill the purposes described in this Privacy Notice or when required or permitted by applicable law.

Depending on the particular transaction or service, the recipients or categories of third parties to whom personal data may be transferred may include:

Related or affiliated companies.
Customers and suppliers involved in logistics operations.
Carriers and logistics service providers.
Customs brokers and service providers related to foreign trade.
Warehouses and logistics facility operators.
Insurance companies and insurance-related service providers.
Financial institutions and payment service providers.
Technology, systems, platform, and communications service providers.
Companies or service providers responsible for security and video surveillance services.
Tax, customs, administrative, judicial, or regulatory authorities, when required or permitted by law.
Other third parties directly involved in the provision of contracted services.

Where applicable law requires the consent of the data subject for a transfer of personal data, VITTI will obtain such consent in accordance with applicable law, except where a legal exception applies.

5. VIDEO SURVEILLANCE AT VITTI FACILITIES

5.1 Use of Video Surveillance Systems

VITTI LOGISTICS, S. DE R.L. DE C.V. operates video surveillance systems through cameras installed in certain areas of its facilities for the purpose of protecting people, facilities, property, and VITTI's assets, as well as preventing, detecting, and, where applicable, investigating security incidents.

The cameras may capture images of employees, customers, suppliers, visitors, carriers, contractors, and other individuals who enter or pass through areas subject to video surveillance.

Images in which an individual can be identified will be treated as personal data and will be subject to the applicable data protection and security measures.

5.2 Purposes of Video Surveillance

Images obtained through video surveillance systems may be used for the following purposes:

Protecting the safety and security of individuals located within VITTI's facilities.
Protecting facilities, vehicles, equipment, merchandise, property, and other VITTI assets.
Preventing, detecting, and documenting security incidents.
Preventing and, where applicable, investigating unauthorized access, theft, damage, accidents, unlawful acts, or other incidents.
Controlling and strengthening physical security measures at VITTI facilities.
Supporting internal investigations related to security incidents.
Providing information to competent authorities when required by law or pursuant to a valid legal request.
Exercising or defending VITTI's rights in connection with potential disputes, administrative proceedings, or judicial proceedings.

The images will not be used for purposes incompatible with those described in this Privacy Notice.

5.3 Areas Subject to Video Surveillance

Cameras may be installed, among other areas, in:

Facility entrances and exits.
Reception and access-control areas.
Parking areas.
Yards and maneuvering areas.
Warehousing and logistics operation areas.
Facility perimeters.
Common areas.
Other areas where security measures require video surveillance.

Cameras will not be installed in locations where individuals have a reasonable expectation of privacy, such as restrooms, changing rooms, or areas designated for changing clothes.

5.4 Retention of Video Images

Images obtained through video surveillance systems will be retained only for the period necessary to fulfill the security purposes described in this Privacy Notice and in accordance with VITTI's internal information-retention policies.

When a recording is related to a security incident, internal investigation, administrative or judicial proceeding, or request from a competent authority, it may be retained for the period necessary to address such matter and comply with applicable legal obligations.

Once the applicable retention period has expired, the images will be deleted, overwritten, or destroyed using mechanisms designed to prevent their recovery, unless applicable law requires their continued retention.

5.5 Access to Video Images

Access to video images will be restricted to authorized VITTI personnel and, when necessary, to service providers or contractors involved in the security and operation of the video surveillance systems. Such parties will be subject to the applicable confidentiality and security obligations.

Images may also be disclosed to competent authorities when required by law, pursuant to a valid request, or in connection with a lawful proceeding.

5.6 Rights Related to Video Images

Individuals who believe that their personal data have been captured through VITTI's video surveillance systems may exercise the rights available to them under applicable law, including the Access, Rectification, Cancellation, and Opposition rights (ARCO Rights), in accordance with this Privacy Notice.

To facilitate the identification and retrieval of a recording, the request should include, to the extent possible, information regarding the date, approximate time, and location or area of the facilities where the individual believes they were recorded.

Access to video images will be subject to identity verification and applicable restrictions where recordings contain images of third parties, confidential information, security-related information, or information whose disclosure could affect the rights of third parties or an ongoing investigation.

Requests may be submitted through:

Email: auditora@vittilog.com
Email: mzertuche@vittilog.com
Telephone: 844 133 00 96

5.7 Video Surveillance Notices

VITTI will place visible notices at entrances and/or in areas subject to video surveillance, informing individuals entering such areas that cameras are in operation and directing them to this Privacy Notice for additional information regarding the processing of their personal data.

The simplified notice may contain the following wording:

VIDEO SURVEILLANCE NOTICE

VIDEO-SURVEILLED AREA

VITTI LOGISTICS, S. DE R.L. DE C.V. uses video surveillance systems in certain areas of its facilities for security purposes, including the protection of individuals, facilities, and property, prevention of incidents, and compliance with requests from competent authorities.

To review the Comprehensive Privacy Notice and learn how to exercise your rights, please visit:

www.vittilog.com

Contact:
auditora@vittilog.com
mzertuche@vittilog.com
844 133 00 96

6. USE OF COOKIES AND TRACKING TECHNOLOGIES

The VITTI website may use tracking technologies, such as cookies, session identifiers, or similar technologies, depending on the configuration and tools implemented on the website.

These technologies may collect information related to browsing activity and use of the website, including, as applicable:

Session or user identifiers.
The date and time a session begins.
The date and time a session ends.
Technical information necessary for the operation, security, and analysis of the website.

Information obtained through these technologies may be used to:

Improve website functionality and the browsing experience.
Maintain website security.
Obtain website usage statistics.
Conduct analysis and improvement activities.
Support commercial prospecting, marketing, and advertising activities, where applicable.

VITTI will provide information, where applicable, regarding the tracking technologies used and the mechanisms available to users to manage or limit their use.

7. ARCO RIGHTS

You have the right to:

Access: know what personal data we have about you, the purposes for which we use it, and the conditions under which it is processed.

Rectification: request correction of your personal data when it is inaccurate, incomplete, or outdated.

Cancellation: request the deletion of your personal data from our records or databases when you believe that its processing is not being carried out in accordance with applicable law.

Opposition: object to the processing of your personal data for specific purposes, where applicable.

These rights are known as ARCO Rights.

8. HOW CAN YOU EXERCISE YOUR ARCO RIGHTS?

To exercise any of your ARCO Rights, you may submit a request through:

Email: auditora@vittilog.com
Email: mzertuche@vittilog.com
Telephone: 844 133 00 96

The request should include, at a minimum:

The name of the personal data subject.
The means through which VITTI may communicate its response.
A clear and precise description of the personal data in relation to which you wish to exercise an ARCO Right.
The specific ARCO Right you wish to exercise.
Any other information or documentation that may facilitate the identification or location of the relevant personal data.
Where applicable, documentation proving the identity of the data subject.
Where applicable, documentation proving the authority or legal representation of the representative, as well as the identity of both the data subject and representative, in accordance with applicable law.

VITTI may request official identification to verify the identity of the data subject. If a request is submitted through a representative, VITTI may request documentation establishing the representative's legal authority.

Once the request has been received, VITTI will determine whether it is admissible and will respond within the time periods established by applicable law.

As a general rule, VITTI will communicate its determination within a maximum period of 20 business days from receipt of the request. If the request is approved, VITTI will make the corresponding right effective within 15 business days following the date on which the determination is communicated.

These periods may be extended once when justified, in accordance with applicable law.

The response will be communicated to the data subject through the means specified in the request.

Where access to personal data is granted, the information may be provided electronically or through other legally applicable means, subject to verification of the applicant's identity.

9. REVOCATION OF CONSENT

You may revoke, at any time, the consent you may have provided for the processing of your personal data.

To request revocation of consent, you may submit a request to:

Email: auditora@vittilog.com
Email: mzertuche@vittilog.com
Telephone: 844 133 00 96

The request should clearly identify the processing for which you wish to revoke your consent.

Revocation of consent will not have retroactive effects, and its applicability will be subject to legal, contractual, and other applicable obligations.

Please note that VITTI may not be able to immediately comply with every revocation request because VITTI may be legally required to retain or continue processing certain personal data.

Where processing is necessary for the provision of a service or compliance with a legal or contractual obligation, revocation of consent may result in VITTI being unable to continue providing certain services or maintaining a particular commercial relationship.

10. LIMITATION OF THE USE OR DISCLOSURE OF YOUR PERSONAL DATA

You may request that VITTI limit the use or disclosure of your personal data for certain purposes, particularly for marketing and advertising activities.

To submit such a request, please contact:

Email: auditora@vittilog.com
Email: mzertuche@vittilog.com
Telephone: 844 133 00 96

VITTI will maintain internal mechanisms for processing requests to limit the use or disclosure of personal data.

VITTI may also maintain an exclusion list to register individuals who have requested not to receive commercial or advertising communications.

11. RETENTION OF PERSONAL DATA

VITTI will retain personal data for the period necessary to fulfill the purposes described in this Privacy Notice, as well as for the periods necessary to comply with legal, tax, contractual, or administrative obligations or to address potential liabilities arising from the processing of personal data.

Once personal data is no longer necessary and there is no legal obligation requiring their retention, VITTI will implement the appropriate measures for their deletion, blocking, or anonymization, as applicable.

12. SECURITY MEASURES

VITTI will implement the administrative, technical, and physical safeguards necessary to protect personal data against damage, loss, alteration, destruction, or unauthorized processing, access, or use.

If a security breach occurs that significantly affects the property or moral rights of data subjects, VITTI will take the actions required under applicable law.

13. CHANGES AND UPDATES TO THIS PRIVACY NOTICE

This Privacy Notice may be modified, updated, or supplemented because of changes in legislation or regulations, VITTI's business needs, changes to its services, privacy practices, business model, or for any other reason.

Any modification or update will be published on the VITTI website:

www.vittilog.com

The version published on the website will be considered the current version of this Privacy Notice.

14. LAST UPDATED

Last updated: Sep 2026.

For questions regarding this Privacy Notice or the processing of your personal data, you may contact VITTI through:

VITTI LOGISTICS, S. DE R.L. DE C.V.

Email: auditora@vittilog.com
Email: mzertuche@vittilog.com
Telephone: 844 133 00 96
Website: www.vittilog.com