In compliance with the Mexican Federal Data Protection Law (Ley Federal de Protección de Datos Personales en Posesión de Particulares), regulations and the Privacy Statement Guidelines (the "Data Protection Law"), we provide this Privacy Statement for Grupo México, S.A.B. de C.V. (the “Company”) with address at [Campos Eliseos 400, Col. Lomas de Chapultepec, Alcaldía Miguel Hidalgo, C.P. 11000].

Certain personal identifying information may be gathered and treated as part of our record of customers, suppliers and users. This information includes:

1) Identifiers: Full name.

2) Contact information: Email addresses.

3) Professional data: Company and position.

Grupo México will treat this information according to strict security measures, respecting strict confidentiality.

For the purposes of this Privacy Statement, we may gather your personal data in different ways: when you provide it to us directly; when you visit our websites or use our services online, and when we receive information through other sources as permitted under the Data Protection Law

Your personal data will be treated for the purposes detailed following:

• To send you Grupo México public financial reports, filed with the Mexican Stock Exchange (Bolsa Mexicana de Valores), and to contact you on matters related to this privacy statement.

The Company may transfer your information without your consent, nationally or internationally, to fulfill the purposes of this Privacy Statement, as permitted by the Data Protection Law in the following cases:

a) Affiliates and subsidiaries, to provide the service requested or contracted, as well as for the secondary purposes stated above in this privacy statement.

b) Third party service providers, to fulfill the legal obligations of the Company or any of our affiliate and subsidiary companies.

c) Third party service providers, public or private, for research, data analysis, sending information customized to the needs of the owner of the personal information, as well as for financial services or requirements for the owner of the personal information.

d) When the transfer is provided for in a Data Protection Law or international conventions to which Mexico is party.

e) When the transfer is necessary for medical diagnoses or prevention, to provide healthcare or medical treatment, or to manage healthcare services.

f) When the transfer is necessary under contract between the Company and a third party in the interest of the owner.

g) When the transfer is necessary or legally required to safeguard a public interest, or by court order.

h) When the transfer is for the purpose of acknowledging, exercising or defending a right in a legal proceeding.

The Company may also transfer personal information to the third parties the Company deems necessary.

These third parties and receiving entities will be advised of the terms to which you have consented for the treatment of your personal information, as laid out in this privacy statement.

You, or your legal representative, may exercise any of your rights of access, rectification, cancellation or objection (known as the "Arco Rights") by sending an email to the Company at [contacto@gmexico.mx].

Requests must be submitted with a completed ARCO Rights and Retraction of Consent Form (the "Request"), containing all the elements necessary to address the exercising of your right or retraction of consent. Write to [contacto@gmexico.mx] to ask for a copy of the Request form. There is no fee to exercise these rights, although you will cover any costs for mailing, copying or, where necessary, certifying documents.

In order for the Company to review and follow up on your Request, you, or your legal representative, are required to prove your identity, completing all the fields indicated in the Request and providing a copy of your government-issued identification, which may be a voter identification card, passport or professional license. On receiving your Request, the personal data department will confirm receipt the same day. If the information provided in the Request contains errors or is insufficient, or the corresponding documentation has not been provided, you will receive a communication from the Company within five (5) business days asking you to provide the information or documentation required. You will have ten (10) business days to respond, otherwise your Request will be dismissed.

The Company will inform you of the decision reached within twenty (20) business days of receiving the Request and any action corresponding will be taken within fifteen (15) business days following. The request may or may not be granted, providing due justification. The response will be delivered to the email address you provide in the Request. The exercising of your ARCO Rights may be restricted for reasons of national security, government order, public health and safety, or to protect the rights of third parties, or by order of the corresponding authority, duly reasoned. You will be notified in the event your ARCO Rights have been restricted due to any of the reasons mentioned.

Additionally, under Chapter VII of the Data Protection Law, if you believe your data protection rights have been violated, you are invited to pursue the matter with the Mexican Institute for Access to Information and Data Protection (Instituto Federal de Acceso a la Información y Protección de Datos).

We also inform you of your right to refuse or retract consent for the treatment of your data. To exercise this right, please send an email to [contacto@gmexico.mx], noting the reason for your request and providing information or documentation to identify yourself. You may provide the same information or documentation as required to exercise your ARCO Rights. On receiving your request, the personal data department will confirm receipt, the same day as received, and will review the request according to applicable law and company policy, responding within 20 (twenty) business days. The response will be sent to the email address provided in the request.

On submitting a Request for the cancellation or objection to the treatment of your personal information, you acknowledge you will not be able to continue your relationship with the Company.

Our website [www.gmexico.com] (the "Website") uses cookies to enhance your user experience and to adapt promotions to your browsing habits. The information collected through these cookies may include the identifying and contact information mentioned in section 1 of this privacy statement.

You can also disable these cookies [*].

By using our website you give your consent to the use of cookies as described in this privacy statement.

Please direct any questions or concerns regarding the protection of your Personal Information to our Privacy Officer, who will attend to any request or matter involving personal data or information and the exercising of ARCO Rights. The Privacy Officer is available at the address of the Company or send an email to [contacto@gmexico.mx], which will be confirmed by telephone. You may also call [58368200] Monday to Friday [9] am to [6] pm (Mexico Central time).

You may limit the use or disclosure of your personal information by sending a request to [contacto@gmexico.mx]. On accepting your request, we will add you to our opt-out list. For more information, please contact our Privacy Officer.

The Company reserves the right to update or change the terms of this privacy statement at any time to comply with changes to legislation, company policy or new requirements to deliver or offer our products or services, and market practices. Changes and updates will be published on our website. You may request a copy of our current Privacy Statement by writing to [contacto@gmexico.com].

This Privacy Statement is governed by Mexican law.