Based on the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter “The Law”), as well as the Guidelines of the Privacy Notice published in the Official Gazette of the Federation dated January 17, 2013 (in hereinafter “The Guidelines”), on behalf of and on behalf
of the consortium made up of 5M2 S.A. DE C.V. (“5M2”) and BKT BICIPUBLICA S.A. DE C.V. (BKT), (hereinafter “GRUPO EXPANSIÓN”) declare to be companies legally constituted in accordance with Mexican law, with address at Avenida Constituyentes #956, Colonia Lomas Altas, Mayor Miguel Hidalgo, C.P. 11950, Mexico City; As the operator of the Public Bicycle System of Mexico City “ECOBICI” (hereinafter “ECOBICI”), it is responsible for collecting your personal data, the use that is given to them and their protection.

The personal data that we collect from you will be used for the following purposes that are necessary for the ECOBICI service that you request: 1. Establish contact with you when you have requested it. 2. Evaluate the quality of the service we provide 3. Respond to a request or information for the provision of services. 4. Process and monitor the services that have been contracted from the Ecobici System. 5. Carry out tasks of clarification and monitoring of collection for use of ECOBICI. 6. Sending notifications regarding changes in this Privacy Notice.

Grupo Expansión is not responsible for the veracity or precision of the personal data and/or sensitive data that you provide us, since they have not been previously validated and/or verified. To carry out the purposes described in this privacy notice, the personal data that we may process and/or transmit consist of: 1. Name (s) and surnames. 2. Image recorded from surveillance cameras of the Ecobici System. 3. Address. 4. Federal Taxpayer Registry. 5. Email addresses. 6. Telephone numbers. 7. Official photo identification (valid passport, driver’s license,
driver, voter ID, professional ID, FM2 Visa, FM3 Visa). 8. Copy of proof of address. 9. Nationality. 10. Copy of immigration document (if applicable). 11. Unique Population Registry Code (CURP).

In addition to the personal data mentioned above, for the purposes reported in this Privacy Notice we will use the following personal data considered sensitive that is equated to sensitive data in terms of the Law, which require special protection: 1. Account number and data banking. You have the right to know what personal data we have about you, what we use them for and the conditions of use we give them (Access). Likewise, it is your right to request the correction of your personal information in case it is outdated, inaccurate or incomplete (Rectification); that we remove it from our records or databases when it considers that it is not being used in accordance with the principles, duties and obligations provided for in the regulations (Cancellation); as well as oppose the use of your personal data for specific purposes (Opposition). These rights are known as ARCO rights.

Means to exercise ARCO rights. The User, in relation to his personal data, may exercise his rights to access his personal data that GRUPO EXPANSIÓN possesses, rectify his personal data when they are inaccurate or incomplete, cancel his personal data when he considers that they are excessive or
unnecessary for the purposes of the treatment or the contractual or service relationship has ended or oppose providing your personal data for the purposes mentioned herein, as well as revoke your consent for the treatment of your personal data, so that GRUPO EXPANSIÓN stops doing use of them. The foregoing may be made by the User through a written request addressed to GRUPO EXPANSIÓN, which may be submitted through the following options: a) By email: datospersonales@grupoexpansion.com, in which the User will have to certify your identity by sending: a.1) Photocopy of any official identification (voter ID, passport, military card or professional ID); o In case of acting on behalf of a third party, you must present a copy of the public deed of power or simple power of attorney granted to the legal representative of the User, as appropriate, as well as the corresponding identification of him; b) Be delivered directly to the address of GRUPO EXPANSIÓN, Av. Constituyentes No. 956, Colonia Lomas Altas, Alcaldía Miguel Hidalgo, C.P. 11950, Mexico City, from Monday to Friday from 9:00 a.m. to 6:00 p.m., with the corresponding accreditation mentioned in paragraph a) above.

Likewise, GRUPO EXPANSIÓN has a maximum period of 20 (twenty) calendar days, counted from the date on which it received the request for access, rectification, cancellation or opposition, to notify the User through the same means in which the request was received. , whether or not it is accepted, and if so, GRUPO EXPANSIÓN has a period of 15 (fifteen) calendar days following the date on which the response was communicated to the User, to make the corresponding modifications or deliver a copy simple of the requested information. The aforementioned terms may be extended only once for an equal period, as long as GRUPO EXPANSIÓN so justifies it and in accordance with the provisions of article 32 of the Law.

Similarly, GRUPO EXPANSIÓN may deny access, rectification, cancellation or opposition to the User’s personal data, when: 1) The User is not the owner of the personal data, or the legal representative is not duly accredited for it; 2) When the applicant’s personal data is not found in its database; 3) When the rights of a third party are injured; 4) When there is a legal impediment, or the resolution of a competent authority, that restricts access to the User’s personal data, or does not allow their rectification, cancellation or opposition, and 5) When the rectification, cancellation or opposition has been previously done. In all of the above cases, GRUPO EXPANSIÓN will inform the User or the legal representative, as the case may be, of the reason for their
decision by the same means by which the request was made, accompanying, where appropriate, the relevant evidence.

Mechanisms and Procedures for the Revocation of Consent.- In the event that the User wishes to revoke their consent for the processing of their personal data, they must follow the steps established above, referring to the means to exercise their ARCO rights and the response time by GRUPO EXPANSIÓN, will be in accordance with the provisions of the previous paragraph.

Security measures.- GRUPO EXPANSIÓN hereby guarantees that the User’s personal data will be stored in the GRUPO EXPANSIÓN databases, which will remain for the period necessary to fulfill the specific purpose for which they were collected and in accordance with what is established in the Law, I feel the User is solely responsible for the veracity of the data provided. GRUPO EXPANSIÓN uses technology precautions, rules and other security procedures to protect your personal data against unauthorized access, misuse, disclosure, loss or destruction. To ensure the confidentiality of your data, GRUPO EXPANSIÓN also uses industry standard protection with firewalls and passwords. However, it is the User’s responsibility to ensure that the computer they are using is adequately secured and protected against malicious software, such as trojan viruses, computer viruses and worm programs. The User is aware that without adequate security measures (for example, secure web browser settings, updated antivirus software, personal firewall software, not using software from dubious sources) there is a risk that the data and passwords that the User uses to protect access to your data, they could be discovered by unauthorized third parties.

User Options.- The User has several options regarding the use of our Internet sites, including the Site. The User must provide personally identifiable information to enter the forms or data fields of our sites, including the Site and thus be able to use the personalized services available. If the User provides their personal data, they have the right to view and correct their data at any time by accessing the corresponding application. Certain sites may request the User’s permission for certain uses of their information and the User can accept or reject those uses.

Data of minors or incapable.- In the event that data of minors or incapable could be collected based on the information that had been provided regarding their age or year of birth by the user, GRUPO EXPANSIÓN will make its best efforts not to use this data for purposes inappropriate for the age of the minor or in relation to the incapable. In any case, GRUPO EXPANSIÓN guarantees that it will manage the requests derived from the exercise of the rights of access, cancellation, rectification and opposition of the data of minors or incapable persons by parents or guardians. Authority in charge of the Protection of your Data.- If you consider that your right to the protection of your personal data has been violated or damaged by any conduct or omission on the part of GRUPO EXPANSIÓN, or presumes any violation of the provisions set forth in the Law, You can file your disagreement or complaint with the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI). For more information, visit their website: www.inai.org.mx.

Modifications to the Privacy Notice.- Likewise, GRUPO EXPANSIÓN reserves the right to make modifications or updates to this Privacy Notice at any time, derived from any reform or modification of the Law, by internal policy or by any requirement for the provision of our services, in which case you can verify it in this Privacy Notice on this site www.grupoexpansion.com.

If the User continues to use our sites and/or services, including the Site, such behavior indicates that the User accepts the use of the newly provided information in accordance with this Privacy Notice.

If you have any questions about our privacy and personal data protection practices, we suggest you contact us through the email address: datospersonales@grupoexpansion.com