Privacy Notice

Dear Customer and/or User:

Pursuant to the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, and the Privacy Notice Guidelines (hereinafter the “Law”), Ferrocarril Mexicano, S.A. de C.V. (hereinafter “Ferromex”), with address at Bosques de Ciruelos number 99, Colonia Bosques de las Lomas, Miguel Hidalgo, Mexico City, C.P. 11700, in compliance with the obligation undertaken by “Ferromex” (and/or Tequila Express) to protect the Personal Data of its customers and/or users of its products and services, hereby informs you of the following:

Purposes for the Processing of Customers’ and/or Users’ Personal Data

The Personal Data (as defined below) requested from you will be processed for the following purposes:

A) Primary Purposes:

• To provide the services requested by the customer and/or user.

• To inform you about changes or new products or services related to those contracted or acquired by the customer and/or user.

• To fulfill obligations undertaken with our customers and/or users.

• Billing for services rendered.

• Collection management and payment processing.

• To verify that the customer complies with the requirements established by financial institutions within the country.

• To carry out sales and other transactions on this Site efficiently.

• To deliver the goods and services requested.

• Regarding financial data, such information will only be used for the purpose of processing refunds requested by the customer and/or user.

B) Secondary Purposes:

• To communicate updates regarding our services.

• To send advertising and promotional materials regarding our products and services.

• To conduct analyses in order to determine the effectiveness of our advertising and promotional campaigns.

• “Ferromex” may use your information to enroll you in refund programs and other programs in which the customer or user chooses to participate, as well as to conduct quality assurance activities. You may, at any time, object to the processing of Personal Data for secondary purposes, pursuant to the notification mechanisms set forth in this Privacy Notice.

Personal Data of minors, individuals under legal guardianship, and persons with disabilities will be processed for the primary purpose of providing services related to their purchase. Content of Personal Data, Privacy, and Protection Pursuant to the “Law,” “Personal Data” means any information concerning an identified or identifiable natural person. Accordingly, in order to carry out the purposes described in this Privacy Notice, we will use the following Personal Data:

• Identification data: name, address, landline and/or mobile phone number, age, date of birth, gender, nationality, email address, and Federal Taxpayer Registry number.

• Financial, credit, and asset-related data: bank name, account number, credit card number, interbank CLABE number, beneficiary name, branch information, and account statements.

• Images collected through video recording in waiting areas and onboard passenger trains (“Ferromex” will delete such images within 72 hours after the conclusion of the rail journey, provided no incidents have occurred; such images may only be transferred upon request by competent authorities). We inform you that it is of special importance to us to safeguard the Personal Data of minors, individuals under legal guardianship, and persons with disabilities, pursuant to the Law and through the implementation of the following specific measures:

• Obtaining consent from parents or legal guardians, which shall be deemed tacitly granted through acceptance of this Privacy Notice if no objection is expressed via the following email address: tequila.express@ferromex.mx.

• The implementation and maintenance of stricter security measures to ensure the confidentiality of minors, individuals under legal guardianship, and persons with disabilities. In all cases, “Ferromex” may only process the following Personal Data of minors, individuals under legal guardianship, and persons with disabilities:

• Name

• Contact address

• Landline and/or mobile contact number

• Email address

• Gender

• Age

• Date of birth

• Nationality

Likewise, “Ferromex” may request information regarding the minor’s legal representative, as required under applicable law. “Ferromex” shall at all times ensure the proper use of Personal Data belonging to minors, individuals under legal guardianship, and persons with disabilities, and shall only process such data in compliance with applicable regulations and ensuring respect for their fundamental rights. “Ferromex” does not collect Personal Data from Users and/or Customers under 13 (thirteen) years of age residing in the United Mexican States. “Ferromex” shall process Personal Data for as long as necessary to fulfill the purposes described in this Privacy Notice and/or as required by applicable legal provisions.

The Personal Data provided to “Ferromex” shall be processed, safeguarded, and managed in accordance with the applicable legislation of the United Mexican States. In this regard, we undertake to protect such information under the principles of loyalty and responsibility, always complying with strict security measures and guaranteeing its confidentiality.

The Personal Data collected shall be retained for the periods necessary to fulfill the purposes of processing. Once the purposes of processing have been fulfilled, your Personal Data shall be canceled, unless an applicable legal provision requires such data to be retained for a longer period.

By registering, the data subject grants full, free, and voluntary consent to provide the Personal Data requested, understanding that if the user chooses not to provide mandatory information, they may not access services that specifically require such information; however, they may still access all other services that do not require such information. Under no circumstances does “Ferromex” store sensitive Personal Data such as racial or ethnic origin, current health status, genetic information, religious, philosophical, or moral beliefs, union affiliation, political opinions, sexual preference, among others.

Data Transfers “Ferromex” may disclose information when required by law and/or competent authority or when it believes in good faith that such disclosure is necessary to:

I) comply with legal proceedings;

II) respond to claims involving content that infringes upon the rights of third parties; or

III) protect the rights, property, or safety of “Ferromex,” its Customers and/or Users, and the general public, as permitted under applicable regulations. In some cases, we may use, and consequently provide service providers with, your financial information in order to assist us in performing certain tasks. In such cases, “Ferromex” shall require service providers to enter into agreements regarding the confidential handling of your information under standards at least equivalent to those applied by “Ferromex.”

Additionally, we may disclose specific financial and/or credit information when we determine that such disclosure may be useful to comply with the law, cooperate with or seek assistance from public security authorities, protect the interests or safety of “Ferromex” or other visitors to the website www.tequilaexpres.mx, or users of services or products provided by “Ferromex,” or to participate jointly with other entities in anti-fraud activities. Likewise, your financial information may be supplied to third parties in the event of a transfer of ownership or assets, or insolvency proceedings involving “Ferromex.” “Ferromex” shall not be responsible for any other disclosure of your financial and/or credit information by a third party to whom “Ferromex” is permitted to disclose such information under this Privacy Notice, provided such transfer has been made pursuant to this Privacy Notice. Notwithstanding the foregoing, in order to fulfill the purposes of this Privacy Notice, “Ferromex” may carry out national and international transfers and/or remissions of data without your consent, pursuant to the terms of the Law, in the following cases:

a) When the transfer is made to holding companies, subsidiaries, or affiliates belonging to the same corporate group as the Data Controller and operating under the same internal processes and policies.

b) When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the controller and the data subject.

c) When the transfer is provided for in a Personal Data Law or treaties to which Mexico is a party.

d) When the transfer is necessary for medical prevention or diagnosis, the provision of healthcare, medical treatment, or healthcare service management.

e) When the transfer is necessary pursuant to an agreement entered into, or to be entered into, in the interest of the data subject by the controller and a third party.

f) When the transfer is necessary or legally required to safeguard a public interest, or for the administration of justice.

g) When the transfer is necessary for the recognition, exercise, or defense of a right in judicial proceedings.

Means to Exercise “ARCO” Rights and Revocation of Consent:

You may exercise your rights of access, rectification, cancellation, and opposition (“ARCO Rights”) contained in the “Law,” as well as limit the use and disclosure of your data, by sending an email to the following address: tequila.express@ferromex.mx, indicating your request and the necessary information such as your full name (first name(s) and surname(s)), attaching a scanned copy of your official identification, telephone number, and physical or electronic address for purposes of notifications related to the case. This information shall be safeguarded under the same “Law.” If the information provided in the request is erroneous or insufficient, or if the corresponding accreditation documents are not attached, “Ferromex,” within 5 (five) business days following receipt of the request, may require you to provide the necessary elements or documents to process the request. You shall then have 10 (ten) business days following receipt of such requirement to respond. Otherwise, your request shall be deemed not submitted.

Likewise, within a maximum period of 20 (twenty) business days from the date the request is received, or, where applicable, from the date the request for additional information has been fulfilled, “Ferromex” shall issue a resolution, which shall be notified through the contact methods established in your request. Once the resolution has been issued and if deemed applicable (partially or fully), “Ferromex” shall have 15 (fifteen) business days to implement such resolution. Please note that such response may be affirmative or negative and shall be duly substantiated. Furthermore, with regard to ARCO Rights, their exercise may be restricted for reasons of national security, public order, public security and health, protection of third-party rights, or by means of a duly founded and motivated resolution issued by the competent authority. In the event your ARCO Rights are restricted for the aforementioned reasons, such reasons shall be communicated to you.

The terms and deadlines indicated in the preceding paragraphs may be extended once if necessary, and you shall be notified through the contact methods you have established. The revocation and exercise of “ARCO” Rights shall be free of charge, and you shall only be required to cover justified shipping expenses or reproduction costs in copies or other formats established in your request.

For the purposes that gave rise to and are necessary for the development of the relationship you maintain with “Ferromex,” it shall be understood that, should you request the cancellation of or object to the processing of such data, the data subject accepts that they may no longer continue said relationship with “Ferromex.” Likewise, we inform you that you have the right to file a complaint before the National Institute for Transparency, Access to Information and Protection of Personal Data, formerly the Federal Institute for Access to Information and Data Protection, should you consider that your right to the protection of Personal Data has been violated. For more information, please visit: http://inicio.ifai.org.mx.

Use of Cookies, Web Beacons, or Similar Technologies

“Ferromex” may engage one or more third parties as selected service providers to operate and manage this website, as well as the Personal Data collected through it or through any other means; therefore, such data may even be transferred to said third parties for non-commercial purposes.

The Personal Data you provide to “Ferromex” may be compiled and stored in a database exclusively owned by “Ferromex.” “Ferromex” may use “cookies” or similar technologies to confirm your identity, personalize your access to this website, and review its use, solely for the purpose of improving your browsing experience and website functionality. Therefore, “Ferromex” does not collect Personal Data through the use of “cookies” or similar technologies unless such data has been provided by the user or with their consent. Likewise, this website includes third-party cookies and links to external websites, whose content and privacy policies are not the responsibility of “Ferromex”; therefore, the user shall, where applicable, be subject to the privacy policies of such external websites, without any liability whatsoever on the part of “Ferromex.”

“Ferromex” has implemented administrative, technical, and physical security measures to protect your Personal Data, and likewise requires such measures to be complied with by the third parties contracted by “Ferromex” as selected service providers.

Changes to the Privacy Notice and Security Breaches:

“Ferromex” reserves the right to make any changes or modifications to this Privacy Notice. Such modifications may be consulted on the following websites: www.tequilaexpress.mx and/or www.ferromex.mx.

In the event of a security breach occurring at any stage of the processing of your Personal Data, “Ferromex” shall inform the general public through either of the following websites: www.tequilaexpress.mx and/or www.ferromex.mx, so that you may take the appropriate measures to safeguard your rights.