Privacy Policy

Personal Data Collection

For purposes of this Privacy Notice, the companies that are part of ATISA Group, its affiliates, subsidiaries and other entities (hereinafter, collectively as " ATISA Group"), are responsible for the disclosure, storage, and use of personal data (including access, action, handling, use, transfer or disposition), (hereinafter referred to as "Treatment"), with address at Acapulco Blvd. #14700, Pacifico Industrial Park, CP 22643, Tijuana, Baja California, Mexico.

I. Information to be Collected

ATISA Group may collect your information through different sources, including:

• a. Personal - When you request or receive any of the services provided by the ATISA Group companies.
• b. Direct - When you provide us with your personal data to request our real estate
• c. Other - From any other source of commercially available information or that is permitted by law.

The data we can request includes (but is not limited to) name, address, sex, date of birth, nationality, country of birth, age, marital status, occupation, contact telephone numbers (home, office, mobile), email, personal references, CURP, Federal Taxpayers Registry, advanced electronic signature number, and any other information that might be needed.

II. Purposes for Collection of Personal Data

The treatment of personal data of the owner (including the sensitive personal data that we may collect if necessary), has the purpose of developing new services, and providing advisory services, marketing, rent, sale, promotion, contracting, etc. of real estate and commercial premises, among others, for services that you can contract or the company you represent, as well as for hiring personnel to fill our vacancies or for compliance or monitoring of legal obligations derived from any legal relationship that you or your company have with ATISA Group. This information may be used, as needed unless the owner provides otherwise through the medium written in this Privacy Notice (see appropriate sections below).

Your personal data may also have the following purposes:

• a. Address legal requirements of competent authorities.
• b. Make your knowledge of new services or products, benefits, promotions, raffles or notifications about change in conditions and in general all advertising derived from ATISA Group.
• c. To comply with our terms and conditions in the provision of our services.

TThe sensitive data that could be collected can be used for the identification of risk in the hiring of any of the services that as a Group we provide, these data may include medical questionnaires identifying illnesses or diseases, use of drugs, if pregnant, and medical studies, among others.

III. Options to Limit the Use or Disclosure of Information

The personal data will be kept in strict confidentiality, in accordance with the security, administrative, technical and physical measures that ATISA Group implements in its security policies and procedures. Illegal disclosure is forbidden and use by third parties is limited, in accordance with the provisions of this Privacy Notice.

IV. Means for Exercising the Rights by the Owner of the Information

Holders of personal data may exercise their rights of rectification, access, cancellation, opposition, disclosure or revocation, as of January 6, 2012, at Acapulco Blvd. #14700, Pacifico Industrial Park, CP 22643, Tijuana, Baja California, Mexico. Noting as reference this Privacy Notice, which will be admitted with acknowledgment of receipt.

To proceed with a request, the following information must be provided:

• a. The full name of the owner of the personal data, address and email account (to send a response to your request).
• b. The documents that prove the identity or, where appropriate, the legal representation of the owner of the personal data.
• c. The clear and precise description of the personal data indicating which data the request is for and for what types of access or use.
• d. Any other document or element that facilitates the location of the personal data.
• e. In the case of rectification of personal data, the owner must specify the modifications that he wishes to make and attach the documentation supporting his request.

V. Transfer of Personal Data

ATISA Group (its affiliates, subsidiaries, and other entities) may at any time make the transfer of data to:

• a. Your affiliated companies, affiliates, subsidiaries, and other entities.
• b. Third-party providers of research services and/or data analysis, granting credits of any kind, that is, sending information focused on the needs of the owner of the personal data, as well as performing any service necessary or required by the owner of the personal information.
• c. Third party service providers for compliance with legal obligations acquired by ATISA Group.
• d. Third party service providers for the fulfillment of legal obligations acquired by the owner of the information with ATISA Group.
• e. Third party service providers in order to comply with legal obligations in accordance with current tax provisions.
• f. Commercial partners or Banking or Credit Institutions with which ATISA Group (its affiliates, subsidiaries, and other entities) carries out contracts or agreements focused on the development or obtaining of resources for new products and services to continue with the development of its corporate purpose.
• g. Public Federations in order to formalize or document the operations carried out with the holders of personal data, or for the purpose of communicating or notifying any matter arising from the legal relationship you have with us.
• h. Third parties derived from a corporate restructuring, including the merger, consolidation, sale, liquidation or transfer of assets.
• i. To other departments, companies, developers or areas of Human Resources in order that the holders of the information have a greater possibility of contracting or placing the service or product they wish.
• j. To the entities, dependencies or authorities that so require the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin, its Regulation, the General Rules and other provisions that emanate from them.
• k. Other transmissions provided for in the aforementioned Law and its Regulations.

Third parties and entities that receive personal data, in terms of the Federal Law for the Protection of Personal Data Held by Private Parties and its Regulations, have the same obligation to protect the data they receive. The owner of personal data that 1) submits any request; 2) provides your personal information because you are interested in entering into a legal or commercial relationship with ATISA Group; or 3) has a contractual relationship with ATISA Group, accepts the transfer of personal data in the terms described in this Privacy Notice.

VI. Changes to the Privacy Notice

Information regarding any change or modification to this Privacy Notice will be made through any of the following means, having its effects in any of them:

• a. An email provided by the owner of the personal data,
• b. Noticed on the ATISA Group portal (http://www.atisa.com),
• c. Any other means of public or private communication foreseen in the contracts or agreements that document the operations carried out with ATISA Group.
• d. Third party service providers for the fulfillment of legal obligations acquired by the owner of the information with ATISA Group.

If you require additional information about this request, you may contact our Privacy Committee, sending an email to avisodeprivacidad@atisa.com.