PRIVACY NOTICE

THERMION ENERGY SERVICES, S.A.P.I. de C.V. (“Thermion”), with its principal place of business at Montes Urales # 770, 5th floor, Col. Lomas de Chapultepec Section V; Mexico City; C.P. 11000, Mexico, hereby informs that in connection with certain activities relating to electric consumption profile evaluations, proposals of alternatives for electric supply, and institutional client identification procedures, performs certain assessment activities of potential electric consumers of Thermion or any of its subsidiaries or affiliates, and in connection with the above, it collects the following data from individuals that work for, or represent potential Thermion consumers, but not limited to: i) full name of the person interested in the services offered by Thermion; ii) name of the company that the person identified in i) above works for or advises, along with its electric consumption profile; iii) position that such individual holds in the company; iv) location of the company; v) email address and, occasionally; vi) telephone contact information (collectively, the “Data”), which Thermion integrates to its corporate data base, exclusively for the above described evaluation and contact purposes only.

The Data will, at all times, be treated in strict compliance to the terms and requirements set forth in the Mexican Federal Law for the Protection of Personal Data Held by Individuals (Ley Federal de Protección de Datos Personales en Posesión de los Particulares or, the “Law”) and its secondary regulation (the “Regulation”).

Thermion is responsible for the collection, preservation and management of the Data. You may, at any time, exercise your “ARCO Rights”, consisting of the right to: a) be informed of the Data held by Thermion (access); b) request the correction of the Data in the event it is outdated, inexact or incomplete (rectify); c) request the elimination of the Data from the Thermion data base (cancellation); or d) oppose to the use of the Data for specific purposes (opposition), the foregoing through written request made to the Thermion domicile set forth in the first paragraph of this notice, addressed to “Arco Contact”, or through email sent to [email protected]. All requests for the exercise of ARCO Rights must comply with the requirements identified in the Law and the Regulation and will be replied to in the timeframes and under the terms set forth in the Law. We hereby inform that your request must contain and be accompanied by the following: 1) your name and address or other means to communicate the response to your request, 2) the documents that verify your identity or, if applicable, the legal authority of your representative, 3) the clear and precise description of the Data over which the exercise of any ARCO Rights is being sought, and 4) any other element or document that facilitates the location of the Data. For any Data rectification requests, you must also include the requested amendments and provide the documentation that supports such request. It is important that you consider that the exercise of any ARCO Rights may be limited pursuant to the Law and Regulation. Moreover, you may request the restriction of the use or disclosure of your Data by delivering your written request to any of the above-mentioned addresses [or, if available, by selecting the “Remove from this list” option located at the bottom of any email you may receive].

To guarantee the safety, integrity and privacy of the Data, Thermion will maintain adequate protection mechanisms, including administrative, technical and physical security measures, that adhere to industry standards, which shall at least be equal to those that Thermion employs for the management of its own information.

Thermion may transfer the Data to its affiliates and subsidiaries who will comply with the terms set forth in this privacy notice. It is possible that Thermion requires the transfer of the Data to third parties exclusively so such third parties can perform, in Thermion’s name, certain tasks related to data processing for the evaluation of the electric consumption profile and/or for the presentation of electric supply alternatives for potential Thermion consumers. These third parties will only receive the Data in connection with and as part of the performance of such services for the benefit of Thermion and will adhere to the content of this privacy notice and the Law. Thermion will only select third parties that are formally committed to install the necessary security measures to guarantee the adequate level of privacy of the Data. Thermion is responsible of notifying such third parties of the content of this notice, as well as any amendment or cancellation of Data following the exercise of any ARCO Rights.

For European Union members, Thermion recognizes the application of the General Data Protection Regulation (GDPR), and with it the right that visitors of this website have in order to access your data; modify, rectify or delete your information, subject to applicable law.

In accordance with the provisions of the GDPR, the information provided by the visitor will be used always in accordance with applicable laws. In case the visitor wishes to exercise any of the aforementioned rights, or requires more information, please send an email to [email protected].

The Thermion webpage employs cookies, web beacons and other technologies by virtue of which it is possible to monitor your behavior as an Internet user with the purpose of providing you with a better service and/or experience while navigating our page, as well as to offer services based on your preferences and/or requirements. Cookies are text files that are automatically downloaded and stored in the hard drive of the computer or electronic communication equipment of the user while navigating a specific webpage, which allow recording of some user-specific data in the Internet server, including your preferences for visualizing the webpages stored in such server, name and passwords. The web beacons are visible or hidden images included in a webpage or email that are used to monitor the behavior of the user in such means and through which you can obtain certain information like origin of IP address, browser, operative system, webpage access timing and, for email, the association of the above data with the data receiver. If you register in our webpage, the Date obtained through such technologies are the following: name, user name, address, IP address, preferences, purchases, timing and length of webpage navigation, operative system, consulted sections in the webpage, and webpages accessed before and after Thermion’s webpage. The Data we collect through these technologies can eventually be shared with third parties, pursuant to the sixth paragraph of this privacy notice. These technologies can be disabled by the following process: 1. Access our webpage, 2. Click on the “cookies” subsection in your surfer, and 3. Click on the mechanism to disable cookies.

Any change to the scope of this privacy notice will be informed by Thermion through this means.

By providing your Data to Thermion, directly and through this electronic media, you express your consent to the management of your Data by Thermion on the terms herein established. You may at any moment request the cancellation of this authorization in writing addressed to the persons and containing the requirements set forth in the third paragraph of this privacy notice. Thermion will handle such request within 20 days from the receipt thereof and will communicate its written reply at the personal address identified in the request. We hereby inform that in the event that Data handling is required under applicable law, Thermion may not be allowed to authorize or conclude your request in an immediate manner.

If you do not authorize or cancel the management and transfer of Data or seek to limit the same, it is possible that Thermion may not be able to adequately perform your assessment and consequently, it is possible that Thermion may not provide you with certain information in the evaluation process.