PRIVACY NOTE.

BMW SLP, S. A. de C. V. (BMW SLP), Boulevard BMW No.655 Parque Industrial Desarrollo Logistik Villa de Reyes, San Luis Potosí, C.P. 79526, MExico, is responsible for processing your personal data under the terms of article 3 fraction XIV of the Federal Law for the Protection of Personal Data in Possession of Third Parties (LFPDPPP).

The personal data we collect from the website (https://www.bmwgroup-werke.com/san-luis-potosi/es.html) or through different means of communication used by BMW SLP are:

• Identification data: name, age, date and place of birth, marital status, autograph signature and physical features (height, weight, physical build, scars, blood type).
• Labor data: Last position or title.
• Personal contact data: address, (personal) email, landline, alternate telephone number and/or mobile number.

The following sensitive data may also be collected if required:

• Nationality, immigration status;
• Health data such as: blood type and health restrictions.

In order to verify the accuracy of your personal data, BMW SLP may request the following documents: official identification card, driver’s license, passport and visas; foreign nationals, a document proving their legal stay within Mexican territory shall also be required.

Personal data provided by you, including sensitive data, shall be processed under the provisions of this notice and the provisions of the Law to make invitations to the press or to the media, travel arrangements (booking flights and hotels), to request the procurement division by email to apply a supplier selection process and follow the visits procedure with the tour within the BMW SLP plant, as well as administrative tasks such as database registry to create press address books, attendance profiles for events organized by BMW Group, to send event surveys, provide vehicles to the press for their review and to share information of health restrictions with BMW Group, if applicable for the organization of any event or meal.

To prevent unauthorized access to your personal data and in order to guarantee the use of information for the purposes set forth in this privacy notice, we have established physical, electronic and administrative procedures using state-of-the-art technology limiting the use or disclosure of your data but allowing us to duly process them. Personal data provided by you shall not be used for marketing, advertisement, and/or commercial prospecting purposes.

In compliance with the provisions of articles 8 and 9 of the LFPDPPP, BMW SLP informs you that we need your express consent to collect and process your sensitive, financial, and property data under the terms of this Notice; such consent is obtained through the signature and acceptance of this notice.

Your personal and/or sensitive data may be shared with BMW AG in Germany or any other company within BMW Group for the same processing and purposes set forth in section II of this Notice. Shall it be necessary to transfer data to third parties outsourced by BMW SLP, such data shall be processed under the same security mechanisms as stated on section II of this document. In compliance with the provisions of articles 36 of the LFPDPPP, your express consent is required for these data transfers; such consent is obtained through the signature and acceptance of this notice.

Pursuant to the provisions of the Federal Law for the Protection of Personal Data in Possession of Third Parties, you may request BMW SLP, S. A. de C. V. to access, rectify, erase (if legally admissible) or object to the use of personal data that you had provided as well as to withdraw your consent following the procedure detailed below:

1) Send an email to datos.personales@bmw.com.mx stating the following: your full name, your current or previous relation to BMW SLP (including as applicable whether you are or were job applicant, supplier, visitor, journalist or took part in a process to become Importer), the data to which you are requesting any access, rectification, erasure, or objection, or those related to your withdrawal of consent, attaching a copy of your official identification card to prove your identity or the legal capacity you have to make the request. Also, you shall attach those documents that are relevant to the request. For rectification requests, the holder is required to accurately state which modification is to be made and attach the documents justifying the request.

2) Upon receiving your request, you shall get an acknowledgement of receipt dated accordingly. In case your request fails to meet the legal requirements, within five working days after receipt, you shall be requested to correct your request within ten days or otherwise it shall be deemed as not submitted.

3) In case your request was sent on a non-working day it shall be received from the following working day of the date when it was sent.

4) Your request shall be answered by email within twenty working days from the date of the acknowledgement of receipt. This term may be extended by twenty additional days whenever there is a reasonable cause. This extension shall be notified to the holder of the data pursuant to the provisions of article 97 of the Regulation to the LFPDPPP.

5) In case your request is admissible under the LFPDPPP and other regulations in effect, you shall be given access to your data or your data shall be rectified or erased, you shall exerecise your right of objection or your consent shall be withdrawn within fifteen days from the date your request is answered. This term may be extended by fifteen additional days whenever there is a reasonable cause. This extension shall be notified to the holder of the data pursuant to the provisions of article 97 of the RLFPDPPP.

Whenever the request is admissible pursuant to the terms of articles 32, 33, 34, and 35 of the LFPDPPP, the delivery of personal data shall be without charge to the email address that the data holder states for such purposes. In case the information is required to be delivered otherwise only the reasonable shipping fees and/or the cost of making copies or reproducing the data in other formats shall be charged.

Information related to the use of our website (https://www.bmwgroup-werke.com/san-luis-potosi/es.html) is described below. You shall regularly review this Privacy Policy since it may change from time to time at the sole discretion of the administrators.

When you visit the website (https://www.bmwgroup-werke.com/san-luis-potosi/es.html) we collect your Internet address (this address is regularly temporary and assigned by your Internet service provider when you connect to the Internet), the type of operating system and Internet browser you use. Additionally, we may track the parts of the site that you are visiting. The information we collect is used to help us create a better user experience on our website. All this process takes place without us knowing your name or any other information allowing us to identify you. When you visit our website, you remain anonymous unless you choose to expressly identify yourself before us.

BMW SLP, S. A. de C. V. may require you to disclose some information related to your personal data, our contact forms may mandatorily require you to enter your email address to register and reply to your request, questions, or suggestions, and contact you to answer your information requests. Website forms may require you to provide your financial, property, and/or sensitive data, therefore, BMW SLP guarantees to manage such data under the strictest confidentiality.

Cookies: A cookie contains brief information that the website sends to your computer which is stored on your hard drive. Next time you visit our website, we may use the information stored on the cookie to make the use of our Internet site easier. A cookie does not allow us to know your personal identity unless you expressly decide to provide us with such information. Most cookies expire after a specific period of time or else you may delete them whenever you decide to do so. Also, you may set up your browser to let you know ehenever a cookie is received so you may accept or reject them. To know more details on cookies on our website, you may check our Cookie Policy

If you have any questions about the contents, interpretation and construction, or scope of our privacy notice, policies, personal data management, and the way to set up your privacy preferences, you may contact us by email at datos.personales@bmw.com.mx

If you think your right to protection of personal data has been infringed by any conduct or omission of our employees, our actions or answers, or you suspect that the processing of your personal data has infringed the provisions set forth by the Federal Law for the Protection of Personal Data in Possession of Third Parties, you may submit the relevant claim or accusation to the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) (National Institute for Transparency, Access to Information and Protection of Personal Data). For more information, please visit: www.inai.org.mx.

This Privacy Notice shall be effective from its last update and may be modified by the person resposible for it under the terms of the applicable regulations. Any change shall be notified through the publication of the new Privacy Notice on our website (https://www.bmwgroup-werke.com/san-luis-potosi/es.html), directly at the offices of BMW SLP, S. A. DE C. V. or through a request made to the entity in charge of processing data by email at datos.personales@bmw.com.mx