Privacy Notice

1.Who we are

Villarreal Ingeniería y Proyectos, S.A. de C.V. (hereinafter "VIPSA", "VIPSA Engineering", "we" or "us") is the entity responsible for the processing and protection of your personal information under this Privacy Notice.

2.Information we collect

For the purposes described in this Notice, VIPSA may collect the following identification and contact information, primarily through our contact form, by email or by phone:

• Full name
• Email address
• Phone number
• Company or organization and job title (when you provide them)
• Any information you voluntarily include in your message or request

3.How we use your information

Primary purposes

We use your personal information for the following purposes that are necessary for our relationship with you and that do not require your express consent:

• Respond to your contact, information or quote requests.
• Communicate with you regarding business opportunities and engineering projects.
• Prepare and send technical proposals, quotes and related documentation.
• Manage our business relationship and contracted projects.
• Comply with applicable legal, tax and contractual obligations.

Secondary purposes

Additionally, and unless you object, we may use your information for the following purposes that are not necessary for our relationship with you:

• Sending informational communications, newsletters or materials about our services.
• Invitations to events, industry trade shows or presentations.

If you do not want your information used for these secondary purposes, you may opt out by emailing administracion@vipsa.mx. Declining the use of your information for secondary purposes will not affect the services you request.

4.Limiting the use or disclosure of your information

You may limit the use or disclosure of your personal information by sending a request to administracion@vipsa.mx, clearly stating the limitation you wish to apply. We will respond within the timeframes required by applicable law.

5.Your privacy rights

You, or your duly accredited legal representative, have the right to access the personal information we hold about you, to rectify it when it is inaccurate or incomplete, to request its cancellation (deletion) when you believe it is no longer needed for the stated purposes, and to object to its processing for specific purposes (known collectively as "ARCO rights" under Mexican law). Depending on your jurisdiction, you may also have rights to know, delete or correct your information.

To exercise any of these rights, or to withdraw your consent, send your request to administracion@vipsa.mx, addressed to VIPSA's Data Protection Department. Your request should include at least:

• Your name and a means to send you our response.
• A document proving your identity (or your representative's authority).
• A clear description of the personal information your request concerns.
• Any other detail that helps us locate your information.

Exercising these rights is free of charge. We will respond to your request within the timeframes established by applicable law.

6.Withdrawing consent

You may withdraw any consent you have given us for the processing of your personal information at any time by sending a request to administracion@vipsa.mx, through the same means described above. For legal reasons or due to the nature of our relationship, we may need to continue processing certain information even after you withdraw your consent.

7.Sharing and transfers

VIPSA may share or transfer your personal information, solely to fulfill the purposes described, to the following categories of third parties:

• Affiliates or members of the VIPSA corporate group, including our business development representation in the United States.
• Technology service providers (hosting, email, customer-management tools) acting on VIPSA's behalf.
• Competent authorities, when required by a legal mandate or request.

These transfers are carried out in accordance with applicable law and, where relevant, through instruments that require the recipient to protect your personal information to the same standard set out in this Notice. Where a transfer requires your consent, we will request it beforehand; if you do not object to this Notice, you are deemed to consent to such transfers. We do not sell your personal information.

8.Cookies, tracking and Do Not Track

Our website uses cookies and similar technologies that are strictly necessary for its operation. If we incorporate analytics or traffic-measurement tools (such as Google Analytics), we will inform you and provide the means to configure or disable them through your browser settings or mechanisms made available on the site. Because we do not currently track users across third-party websites for advertising, we do not respond differently to browser "Do Not Track" (DNT) signals; if this changes, we will update this Notice.

9.Changes to this Notice

We may modify or update this Privacy Notice due to new legal requirements, our own needs, or changes in our privacy practices. Any changes will be posted on this same page (vipsa.mx/en/privacy), so we recommend reviewing it periodically. The date of the latest update appears at the top of this document.

10.Regulatory authority

If you believe your right to the protection of personal information has been infringed, you may file a complaint with the competent personal-data protection authority under the laws in force in Mexico.