Comprehensive Privacy Notice

Comprehensive Privacy Notice - Customers and website users

In accordance with the Federal Law on Protection of Personal Data Held by Private Parties ("LFPD"), its Regulations and all other provisions applicable to the processing of personal data, we provide this Comprehensive Privacy Notice to inform you of the terms under which we will process your personal data. This includes identifying the entity responsible for your information; the purposes or activities for which your personal data is collected, used and stored; the third parties to whom your personal data will or may be transferred; and the mechanisms available for exercising your rights, among other information that will allow you to make informed decisions about the use of your personal data.

Identity and address of the Data Controller

Vialterna Comunicaciones, S.A. de C.V. (the "Data Controller") is responsible for your personal data. For all purposes, the Data Controller's address for receiving notices is C. Montes Urales 720-PB Col, Lomas - Virreyes, Lomas de Chapultepec, Miguel Hidalgo, 11000 Ciudad de México, CDMX.

Personal data processed by the Data Controller

To fulfill the purposes described in this Privacy Notice, the Data Controller will process the following categories of personal data:

• Identification and contact information.

• Asset and/or financial information.

• Browsing, device and geolocation information.

Processing of sensitive personal data

The Data Controller does not collect sensitive personal data for the purposes established in this Privacy Notice.

Third-party personal data

If you provide the Data Controller with personal data belonging to third parties, such as family members, to fulfill the purposes identified in this Privacy Notice, you must inform them that their personal data will be processed and make them aware of the contents of this Privacy Notice.

By providing third-party personal data, you represent that you have obtained the data subjects' prior consent to provide their information to the Data Controller and that the information is accurate and complete.

Personal data of minors

For the purposes established in this Privacy Notice, the Data Controller does not directly collect personal data from minors through forms, questionnaires, its website and/or mobile application.

If a data subject is a minor when providing information to the Data Controller, the Data Controller will consider that the data subject has permission from their parents or guardians to do so and has informed them of the purpose for providing their data, unless there is evidence or a statement to the contrary.

Parents and/or guardians may at any time exercise ARCO rights on behalf of their children or wards, or revoke consent to the processing of personal data provided to the Data Controller for the stated purposes, where permitted by applicable law.

Purposes of personal data processing

The Data Controller may process your personal data for two types of purposes: primary and secondary. Primary purposes:

• Informing data subjects about services marketed by the Data Controller when they request this information. The information provided may include service options and prices for contracting online or in person.

• Facilitating the contracting of services offered by the Data Controller through electronic means.

• Installing equipment at locations specified by the Customer.

• Electronically processing payments for the purchase, delivery and/or installation of equipment.

• Invoicing services provided by the Data Controller.

• Managing, controlling and administering customer accounting, administrative and tax matters.

• Providing assistance through electronic means.

• Compiling statistics and historical records of website browsing.

Secondary purposes

The Data Controller will not use your personal data for secondary purposes.

Transfers of personal data

Your personal data may be transferred within the United Mexican States ("Mexico") or abroad to the following categories of recipients for the purposes identified:

• Public bodies; federal, state and/or municipal public administrations; commissions; institutes and/or regulatory entities, to comply with public security regulations and judicial or administrative requests issued by competent authorities.

• Service providers, to obtain centralized information storage services; manage registrations and cancellations; change the scope of contracted services; and conduct customer analysis and statistics to evaluate, improve and design new services.

Consent for transfers

The LFPD provides that the transfers described above do not require your consent, but the Data Controller is required to inform you of them.

You will be informed in advance of any transfer of your personal data that does require your consent, through the communication and updating of this Privacy Notice and before the data is disclosed.

Mechanisms and procedure for exercising ARCO rights

ARCO rights refer to the following rights:

• Access: the right to know what personal data we process about you, as well as information about the conditions and general features of that processing.

• Rectification: the right to request, at any time, that inaccurate or incomplete personal data be corrected.

• Cancellation: the right to have the processing of your personal data cease, following its blocking and subsequent deletion.

• Opposition: the right to object, on legitimate grounds, to the processing of your personal data.

Exercising ARCO rights

You have ARCO rights to control your personal data, including updating it and, where appropriate, having it deleted.

To exercise any ARCO right, you must submit a request to our Personal Data Department through either of the following channels:

• Sending a request by email to protecciondedatos@vialterna.com.

• Sending a duly signed request to C. Montes Urales 720-PB Col, Lomas - Virreyes, Lomas de Chapultepec, Miguel Hidalgo, 11000 Ciudad de México, CDMX.

Contents of an ARCO request

The request must contain or be accompanied by:

• Your full name and address, or another means of communicating the response to your request.

• A copy of a document proving your identity and, where applicable, the legal authority of anyone acting on your behalf. This requirement may be omitted if you provide information establishing that you are an employee of the Data Controller and identifying you beyond doubt.

• A clear and precise description of the ARCO right you wish to exercise and the personal data related to your request.

• Where applicable, any other information or document that helps us locate your personal data.

ARCO response periods

The Data Controller will respond to your request within 20 business days after it has been sent and received. If the request is granted, the Data Controller will implement it within 15 business days after communicating its response.

If the information and/or documentation provided in your request is incomplete, incorrect and/or insufficient, or if documents proving your identity or the relevant legal authority are missing, the Data Controller will ask you to correct and remedy these deficiencies so that the request can be processed. You will have 10 business days to respond and correct the request; otherwise, it will be considered not submitted.

Using electronic means to exercise ARCO rights authorizes the Data Controller to respond through the same means, unless you clearly and expressly indicate a different contact method in your request.

The right of cancellation is not absolute. The Data Controller must retain information to comply with various legal obligations. In such cases, it may be necessary to request cancellation from the entity that received your personal data.

Revocation of consent

In some cases, you may revoke your consent to the processing of your personal data. However, revocation cannot have retroactive effect: it cannot affect situations, procedures or transfers that took place before consent was revoked.

Consent also cannot be revoked where doing so would make it impossible to fulfill obligations arising from an existing legal relationship between you and the Data Controller, or would breach generally applicable public-order provisions requiring continued processing of personal data for a specified period.

You may send a request to revoke consent to protecciondedatos@vialterna.com, following the instructions applicable to exercising ARCO rights.

Restrictions on the use and disclosure of your personal data

You may limit the use or disclosure of your personal data by submitting a request to our Personal Data Department, following the procedure and instructions applicable to exercising ARCO rights.

The Data Controller has means and procedures to include certain personal data in its own exclusion lists to prevent disclosure. In such cases, the Data Controller will provide data subjects who request registration with the corresponding registration certificate.

Automated means of collecting personal data

Our website uses files known as "cookies" to facilitate browsing and communication. If you visit our website and/or submit information through it, the cookies we use allow us to collect, analyze and retain technical information relating to your browsing habits, your use of these communication channels and, where applicable, your geographic location.

You may disable cookies in your web browser. For more detailed information about cookies and how to prevent their installation, we recommend visiting www.allaboutcookies.org.

Please also be aware that disabling cookies or refusing the collection of your geographic location may prevent you from using certain sections or services of the website.

Changes to the Privacy Notice

The Data Controller reserves the right to modify, update, extend and/or otherwise change the content and scope of this Privacy Notice at any time and at its sole discretion. In such cases, the Data Controller will publish the changes on https://vialterna.com/ in the "Privacy Notices" section.

The Privacy Notice governing the processing of your personal data will be the one published on https://vialterna.com/ in the "Privacy Notices" section.

Contact for questions or requests

If you have any questions or requests, please email atencionautoridades@vialterna.com or protecciondedatos@vialterna.com.

Vial Client Comprehensive Privacy Notice (Mobile application)

In accordance with the Federal Law on Protection of Personal Data Held by Private Parties, its Regulations and other applicable provisions, we would like to inform you about how we process your personal data.

This Comprehensive Privacy Notice explains who is responsible for your data, why we collect it, with whom we may share it and how you can exercise your rights. This will allow you to make informed decisions about the use of your personal data.

Data Controller for Vial Client

Vialterna Comunicaciones, S.A. de C.V. (the "Data Controller" or "Vialterna") is responsible for your personal data. For all purposes, Vialterna's address for receiving notices is C. Montes Urales 720-PB Col, Lomas - Virreyes, Lomas de Chapultepec, Miguel Hidalgo, 11000 Ciudad de México, CDMX.

Data collected by Vial Client

To fulfill the purposes mentioned in this Privacy Notice, Vialterna will process the following categories of personal data:

• Geolocation data.

Sensitive data in Vial Client

To fulfill the purposes listed in this Privacy Notice, Vialterna will not request or process sensitive personal data. As a Vialterna user, please do not provide this type of information.

Primary purposes of Vial Client

Vialterna will process your personal data for the following purposes:

• Monitoring, observing and tracking devices linked through Vial Client in real time.

• Collecting and analyzing the battery charge level of devices while they use Vial Client.

• Handling and routing requests for help or emergency alerts made through Vial Client.

Secondary purposes of Vial Client

None.

Data transfers in Vial Client

Your personal data may be transferred within Mexico or abroad to the following categories of recipients for the purposes identified:

• Users authorized to receive notifications, so they can assist Vialterna in following up on requests for help or emergency alerts made through Vial Client.

• Public bodies; federal, state and/or municipal public administrations; commissions; institutes and/or regulatory entities, to fulfill information, transparency and unlawful-activity prevention obligations, and to comply with duly justified judicial or administrative requests issued by competent authorities.

ARCO rights in Vial Client

The Law regulates your ARCO rights as a data subject: Access, Rectification, Cancellation and Opposition.

To exercise any ARCO right, you must submit a request to our Personal Data Department by email at protecciondedatos@vialterna.com.

• Your full name and address, or another means of communicating the response to your request.

• A copy of a document proving your identity and, where applicable, the legal authority of anyone acting on your behalf.

• A clear and precise description of the ARCO right you wish to exercise and the personal data related to your request.

• Where applicable, any other information or document that helps us locate your personal data.

Revocation, restrictions and changes in Vial Client

In some cases, you may revoke consent to the processing of your personal data. However, revocation cannot have retroactive effect.

You may limit the use or disclosure of your personal data by submitting a request to our Personal Data Department, following the procedure and instructions applicable to exercising ARCO rights.

This Privacy Notice may be modified, changed or updated due to new legal requirements; our own product or service needs; our privacy practices; changes to our business model; or other reasons.

If you have any questions or need clarification about this Privacy Notice, you may contact our Personal Data Department by email at protecciondedatos@vialterna.com.

Last updated: August 30, 2023.