1. Identity and Address of the Data Controller

Instalaciones y Servicios SACA, S.A. de C.V., hereinafter referred to as “SACA” or the “Data Controller,” with address at León Guzmán No. 1105, Colonia Nuevo Repueblo, Monterrey, Nuevo León, Zip Code 64700, telephone numbers (81) 4444 8975 and (81) 4444 8366, is responsible for the Processing of Personal Data collected from customers, prospects, suppliers, contractors, employees, candidates, visitors, and other individuals related to its construction, engineering, and fire protection system activities.

2. Scope of this Notice

This Privacy Notice applies to Personal Data collected physically, verbally, electronically, through documents, or digitally, including data obtained through forms, contracts, purchase orders, quotations, invoicing, human resources processes, facility access, video surveillance, email, Microsoft 365, SharePoint, ERP systems, document management platforms, and other technological tools used by SACA.

3. Personal Data Processed

Depending on the relationship the Data Subject maintains with SACA, the Data Controller may process the following categories of Personal Data, always under criteria of proportionality, necessity, and purpose:

• Identification data: full name, signature, official identification, nationality, date of birth, age, gender, marital status, and legal representation information.
• Contact information: address, email address, landline telephone number, mobile telephone number, delivery address, and preferred means of contact.
• Tax and billing information: RFC (Mexican Tax ID), Tax Status Certificate, tax address, tax regime, CFDI use, and information required to comply with tax obligations.
• Financial or property-related data: banking information, payment information, commercial references, credit information, or documentation necessary to assess commercial transactions, whenever applicable.
• Employment and professional data: position, company, department, professional experience, references, employment history, résumé documentation, and information related to recruitment, hiring, or personnel administration processes.
• Supplier, contractor, and customer data: business contact information, contractual documentation, purchase orders, quotations, supplier records, compliance information, and documentation for administrative, operational, and commercial management.
• Access and security data: entry and exit records, visitor identification, access logs, images captured through video surveillance, and records associated with physical security.
• Digital and system-use data: institutional user account, email address, metadata, activity logs, access permissions, document traceability, and records generated by ERP systems, Microsoft 365, SharePoint, or other authorized platforms.

4. Sensitive Personal Data

SACA will seek not to collect Sensitive Personal Data unless such information is strictly necessary for a legitimate and proportionate purpose associated with the corresponding legal relationship. If information related to health, medical conditions, occupational assessments, disabilities or medical leave, industrial safety, or occupational risk prevention is required, the corresponding consent will be requested whenever required by applicable law, and enhanced security and confidentiality measures will be implemented.

5. Primary Purposes of Processing

Personal Data will be processed for necessary purposes related to the legal, commercial, contractual, administrative, tax, operational, employment, or service relationship maintained by the Data Subject with SACA, including:

• Identifying and contacting the Data Subject.
• Preparing quotations, technical proposals, contracts, purchase orders, orders, invoices, payment supplements, and other administrative or tax documentation.
• Managing commercial, contractual, operational, and service relationships with customers, suppliers, contractors, and business partners.
• Following up on projects, deliveries, requisitions, payments, collections, warranties, services, clarifications, and compliance with agreed obligations.
• Evaluating, registering, validating, and managing suppliers, contractors, and third parties related to SACA’s operations.
• Creating and managing physical or digital records of customers, suppliers, employees, candidates, visitors, and contractors.
• Complying with legal, tax, labor, accounting, administrative, regulatory, contractual, and audit obligations.
• Managing recruitment, selection, hiring, personnel administration, training, industrial safety, and termination of employment relationships, whenever applicable.
• Controlling access to facilities and protecting individuals, assets, information, equipment, infrastructure, and SACA’s operations.
• Managing users, permissions, communications, files, workflows, approvals, and records within Microsoft 365, SharePoint, ERP systems, document management platforms, and other authorized technological tools.
• Preventing, investigating, and documenting security incidents, breaches, unauthorized access, contractual disputes, claims, or potential legal liabilities.

6. Secondary Purposes

Additionally, SACA may process Personal Data for purposes that are not essential to the primary relationship, such as sending institutional communications, event invitations, satisfaction surveys, service quality analyses, commercial studies, prospect follow-up, dissemination of corporate information, and promotional communications related to its services.

The Data Subject may refuse the Processing of their Personal Data for secondary purposes either at the time the data is collected or subsequently by sending a request to privacidad@saca.com.mx. Refusal regarding these purposes shall not be grounds for denying products, services, contractual relationships, employment relationships, or the corresponding assistance.

7. Domestic and International Transfers

SACA may transfer Personal Data, when necessary and in accordance with applicable law, to competent authorities, customers, suppliers, contractors, auditors, legal, accounting, or tax advisors, financial institutions, insurance companies, affiliated or related companies, technology platforms, cloud service providers, data processors, and third parties involved in the performance of legal, contractual, administrative, tax, labor, operational, or security obligations.

Domestic or international transfers shall only be carried out when there is a legitimate purpose, legal or contractual obligation, existing legal relationship, exception provided by law, or, where applicable, the Data Subject’s consent. SACA will not sell Personal Data to third parties.

8. Use of Digital Platforms, Cloud Services, ERP Systems, and Technological Tools

For administrative, document management, operational, tax, commercial, human resources, and project management purposes, SACA may use technological tools such as Microsoft 365, SharePoint, ERP systems, institutional email, cloud storage, collaboration platforms, document repositories, access control systems, and other authorized digital solutions.

Technology providers that process Personal Data on behalf of SACA shall act, as applicable, as Data Processors and shall be subject to confidentiality, security, limited-use obligations, and other conditions necessary to protect Personal Data in accordance with applicable law.

9. Occasional Use of Artificial Intelligence or Automation

SACA may use automation, analytics, or artificial intelligence tools in a controlled manner to support administrative, document-related, operational, analytical, classification, search, summarization, or process improvement activities. The use of these tools shall comply with principles of confidentiality, data minimization, access control, human review, and authorized institutional use.

SACA shall not use artificial intelligence tools to make decisions that significantly affect the Data Subject without human intervention, unless there is a legal or contractual basis or applicable consent. When the use of such tools involves relevant privacy risks, SACA shall evaluate those risks in advance and implement proportionate controls.

10. Video Surveillance and Access Control

SACA may use video surveillance cameras, visitor records, access logs, or other security mechanisms at its facilities, warehouses, offices, vehicles, construction sites, or areas under its control, for the purpose of protecting individuals, assets, information, facilities, equipment, operations, and documenting security incidents, breaches, or potential liabilities.

11. Administrative, Technical, and Physical Security Measures

SACA shall implement reasonable administrative, technical, and physical security measures proportionate to the type of Personal Data processed, the level of risk, the volume of information, the systems used, and the nature of its operations. These measures may include access controls, user profiles, authentication, information backups, document management, confidentiality measures, training, internal policies, physical safeguarding, file control, traceability, permission reviews, protection against unauthorized access, and security incident management.

Employees, suppliers, contractors, and third parties with access to Personal Data shall use such data solely for authorized purposes and shall remain subject to confidentiality obligations even after the corresponding relationship has ended.

12. Retention of Personal Data

Personal Data shall be retained for the period necessary to fulfill the purposes that justified its Processing and, subsequently, for the periods required to comply with legal, tax, labor, contractual, administrative, accounting, audit, or potential liability obligations. Once such purposes and retention periods have been fulfilled, SACA shall block, cancel, delete, or anonymize the data, as applicable.

13. ARCO Rights

The Data Subject has the right to Access their Personal Data, Rectify it when it is inaccurate or incomplete, request its Cancellation when appropriate, and Object to its Processing for legitimate reasons. These rights are known as ARCO Rights.

14. Revocation of Consent and Limitation of Use or Disclosure

The Data Subject may revoke the consent granted for the Processing of their Personal Data, as well as request limitations on the use or disclosure of their data, whenever legally applicable. Revocation shall not have retroactive effects and may not affect processing activities required to comply with legal, contractual, tax, labor, administrative, or security obligations.

15. Procedure for Exercising Rights

To exercise ARCO Rights, revoke consent, or limit the use or disclosure of Personal Data, the Data Subject may send a request to privacidad@saca.com.mx, contact SACA at (81) 4444 8975 or (81) 4444 8366, or submit the request at SACA’s address. The request must include, at a minimum: the Data Subject’s name, a means of receiving the response, documents proving their identity or legal representation, a clear description of the right they wish to exercise, and, where applicable, information that facilitates the location of the relevant data.

SACA shall respond within the timeframes established by applicable law. When the request is valid, it shall be implemented in accordance with the corresponding legal requirements. SACA may request additional information when the request is incomplete, unclear, or insufficient to verify the Data Subject’s identity or locate the Personal Data.

16. Changes to the Comprehensive Privacy Notice

SACA may modify or update this Comprehensive Privacy Notice to reflect legal, regulatory, operational, technological, security, service-related, corporate structure, or Personal Data Processing practice changes. Updated versions will be made available through the institutional means determined by SACA, including its website, internal communications, physical notices, or electronic means.

17. Institutional Contact Information

For any questions, comments, requests, or exercise of rights related to this Privacy Notice, the Data Subject may contact SACA at León Guzmán No. 1105, Colonia Nuevo Repueblo, Monterrey, Nuevo León, Zip Code 64700, by telephone at (81) 4444 8975 or (81) 4444 8366, or by email at privacidad@saca.com.mx.

Effective Date: January 15, 2026.