SUPPLIER PRIVACY NOTICE

Based on articles 15 and 16 of the Federal Law for the Protection of Personal Data in Possession of Individuals, we inform you that Ganaderos Productores de Leche Pura, S.A.P.I. de C.V., subsidiaries and affiliates, hereinafter referred to as “GRUPO ALPURA”, located at Autopista México-Querétaro Kilómetro 37.4, Parque Industrial Cuamatla, Cuautitlán Izcalli, Estado de México, Zip Code 54730, are responsible for collecting your personal data (including sensitive personal data), both physically and electronically, for its use and protection.

The company is committed to the protection of all personal data provided by the holder; therefore, we want to make sure you know how we safeguard the integrity, privacy, and protection of your personal data, which will be used for the purposes outlined below.

For what purposes will we use your personal data?

The data recorded or collected are through our website, media, personally, directly by phone or mail, WhatsApp, Microsoft forms, or information through other sources that are permitted by law.

• To process your registration as a supplier in our Oracle system.
• To issue purchase orders in Oracle system.
• Documentary review as part of internal and external audits.
• For invoice payment management.
• As evidence and documentary support within the food safety process for the BRCGS audit.
• For contract and NDA procedures.
• For letter of no conflict of interest and possible analysis.

What personal data will we collect and use?

To conduct the purposes described above, we will use the following personal data:

In the award process:

• National Suppliers

• Foreign suppliers

And documentary requirements for food safety purposes regarding raw materials, containers, packaging, ingredients, and services (only to suppliers to which applicable) as well as for the elaboration of contracts and confidentiality agreements.

With whom may we share your personal data and for what purposes?

They are for internal use or, if applicable, for External Audit purposes (upon request).

How can you access, rectify or cancel your personal data or object to its processing?

According to the Federal Law for the Protection of Personal Data in Possession of Private Parties (LFPDPPP), (hereinafter “Law”), consent will not be required for the processing of personal data when it has the purpose of fulfilling obligations arising from a legal relationship between the data holder and the data controller and in accordance with the terms set forth in the comprehensive privacy notice found on the following page: www.alpura.com.mx.

Revocation of Consent.

In order for us to stop using your personal data, consent may be revoked at any time, without retroactive effect. To revoke consent send your request precisely indicating the consent you wish to revoke, to the email address proteccion.datos@alpura.com.

Within a maximum period of twenty working days from the date on which the company receives your request, we will respond to your request and will inform you of the origin of this, through a response to the same means by which you sent us your request.

Limitation of Use and Disclosure of Data.

You may limit the use and disclosure of your personal data by sending your request precisely indicating the limitation you require to the following e-mail address: proteccion.datos@alpura.com.

Within a maximum period of twenty working days from the date your request is received, we will respond to your request and will inform you of the origin of your request, through a response to the same email in which you sent us your request.

Rights of Personal Data Holders.

You, any data holder or, if applicable, your legal representative, may exercise the rights of access, rectification, and cancellation of your personal data; oppose the processing of such data or revoke the consent you have given us for such purpose. The exercise of any of them is not a prerequisite nor does it prevent the exercise of others.

The data holder will have the right to rectify them when they are inaccurate or incomplete.

The holder shall at all times have the right to cancel his or her personal data. The cancellation of personal data shall give rise to a blocking period after which the data shall be deleted. The company may keep them exclusively for the purposes of the liabilities arising from the processing. The blocking period shall be equivalent to the statute of limitations period for actions arising from the legal relationship underlying the processing under the terms of the applicable law on the matter.

The company will not be obliged to cancel personal data, among other cases provided for in the Law, when it refers to the parties to a private contract and is necessary for its development and fulfillment; when it must be processed by legal provision; when it hinders judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions; when it is necessary to protect the legally protected interests of the holder and when it is necessary to comply with an obligation legally acquired by the holder.

Exercise of the Rights of Access, Rectification, Cancellation and Opposition (“ARCO”).

The holder or his legal representative may request at any time the access, rectification, cancellation or opposition, with respect to the personal data concerning him.

The request for access, rectification, cancellation or opposition must be sent by e-mail to the address proteccion.datos@alpura.com and contain and be accompanied by the following:

• The name of the holder and address or other means of communicating the response to the request;
• The documents proving the identity or, as the case may be, the legal representation of the holder;
• The clear and precise description of the personal data in respect of which the exercise of any of the aforementioned rights is sought, and
• Any other element or document that facilitates the location of the personal data.
• The company will process the requests of the holders, for the exercise of the rights referred to in the Law.

In the case of requests for rectification of personal data, the holder must indicate, in addition to the above, the modifications to be made and provide the documentation supporting the request.

The company will communicate to the holder within a maximum period of twenty working days, counted from the date on which the request for access, rectification, cancellation or opposition was received, the determination adopted, so that, if appropriate, the same becomes effective within fifteen working days following the date on which the response is communicated. In the case of requests for access to personal data, prior delivery, accreditation of the identity of the applicant or legal representative, as the case may be, shall be required. The aforementioned deadlines may be extended once for an equal period, provided that the circumstances of the case so justify.

The obligation of access to information shall be deemed fulfilled when the personal data is made available to the holder; or, by means of the issuance of simple copies, electronic documents or any other means determined by the company in this privacy notice.

In the event that the holder requests access to the data from a person who is presumed to be the data controller, and the company turns out not to be the data controller, it will be sufficient for the holder to be so informed by any of the means referred to in the preceding paragraph, in order for the request to be deemed to have been complied with.

The company may deny access to personal data, or to carry out the rectification or cancellation or grant the opposition to the processing thereof, in the following cases:

• When the applicant is not the holder of the personal data, or the legal representative is not duly accredited to do so;
• When in its database, the personal data of the applicant are not found;
• When the rights of a third party are harmed;
• When there is a legal impediment, or the resolution of a competent authority, which restricts access to personal data, or does not allow the rectification, cancellation or opposition of the same, and
• When the rectification, cancellation or opposition has been previously made.
• The refusal referred to in this article may be partial, in which case the company will carry out the access, rectification, cancellation or opposition required by the holder.
• In all the foregoing cases, the company shall inform the reason for its decision and communicate it to the holder, or, as the case may be, to the legal representative, within the time limits established for such purpose, by the same means by which the request was made, accompanied, as the case may be, by the relevant evidence.

The delivery of personal data will be free of charge, and the holder will only have to cover the justified shipping costs or the cost of reproduction in copies or other formats.

Data Transfer.

The company undertakes to ensure compliance with all legal protection principles regarding the transfer of your personal data. Likewise, it expresses its commitment to ensure that this privacy notice is respected at all times by the individuals or legal entities to whom the information provided may be transferred.

Changes to the Privacy Notice

Grupo Alpura reserves the right to make changes to this privacy notice, which will be disclosed through the website www.alpura.com.mx and social networks (Facebook and Instagram: alpuraoficial, Youtube: Alpura Oficial).

Likewise, the Holder is informed that he/she has the right to object to the processing of his/her personal data in case he/she does not agree with the modifications that this privacy notice may present, to do so, he/she must send a request to the email address to proteccion.datos@alpura.com.

If you consider that your right to protection of personal data has been harmed by any conduct of our employees or our actions or responses, positions provided in the Federal Law on Protection of Personal Data Held by Private Parties, you may file a complaint or complaint with the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI), for more information visit www.inai.org.mx, and at www.alpura.com.mx and RRSS social networks (Facebook and Instagram: alpuraoficial, Youtube: Alpura Oficial), in which you will be asked for the personal data described in this notice.

Date of last update: June 2024.