Privacy Notice

Transporte Intermodal Mexicano, S.A. de C.V. provides this Privacy Notice in compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), published in the Official Gazette of the Federation on March 20, 2025 and in force as of March 21, 2025, as well as with all other applicable provisions on the matter.

1. Scope of this Notice

This Notice governs the processing of personal data that TIMSA collects through the timsa.mx website, including its contact, quotation request and reporting (whistleblower) forms, as well as data you provide to us by email at the addresses published on this site.

The processing of personal data of job applicants, TIMSA personnel and their beneficiaries is governed by a separate privacy notice, delivered directly at the beginning of the selection process, which covers, among others, biometric data and sensitive personal data. This Notice does not replace that one.

2. Personal data we process

Depending on the type of interaction, TIMSA may process the following categories of data:

3. Purposes of processing

Purposes that do not require your consent

These are necessary in order to assist you or to comply with TIMSA's obligations:

• Responding to requests for information, quotations and commercial enquiries.
• Receiving, investigating and following up on reports submitted through the reporting channel.
• Entering into, managing and performing the contractual relationship with customers and suppliers.
• Complying with legal, tax and regulatory obligations, and responding to requests from competent authorities.

Purposes that require your consent

These are not necessary in order to assist you. If you do not authorize them, TIMSA will still address your request with no adverse consequence:

• Sending communications about TIMSA's services, news and events.
• Preparing internal statistics and improving our processes.

To object to these purposes, send an email to [email protected] stating your name and the contact detail you wish to have excluded.

4. Retention period

TIMSA retains your personal data only for as long as necessary to fulfil the purposes for which it was collected and, thereafter, for the retention periods required by applicable law. For reference:

• Contact and quotation requests that do not proceed: up to 24 months from the last contact.
• Data linked to a contractual relationship: for the term of the contract and for the statutory retention period following its termination.
• Reports submitted through the reporting channel: until the investigation is concluded and for as long as necessary to evidence its proper handling.

Once these periods expire, the data is blocked and subsequently deleted or anonymized.

5. Transfers

TIMSA does not sell or otherwise trade your personal data. The transfers that may occur in the ordinary course of our operations are:

• Competent authorities, whether Mexican or foreign, where a duly founded and reasoned request exists, or where necessary to comply with obligations arising from the supply chain security and international trade programs in which TIMSA participates.
• Legal, accounting and audit advisors, where necessary for compliance with legal obligations or for TIMSA's legal defense.

Third parties that process personal data on TIMSA's behalf are contractually bound to observe this Notice and to apply equivalent security measures.

6. ARCO rights

You have the right to access your personal data, to request its rectification where it is inaccurate or incomplete, its cancellation where you consider it is not required for the stated purposes, and to object to its processing for specific purposes. These are known in Mexico as ARCO rights.

To exercise them, send your request to [email protected] including the following:

• Your name and a means by which we can communicate our response.
• A document evidencing your identity or, where applicable, your legal representation.
• A clear description of the data concerned and of the right you are exercising.
• Any element that helps us locate your data.

TIMSA will inform you of its determination within a maximum of twenty business days and, where the request is granted, will give effect to it within the following fifteen business days.

7. Withdrawal of consent

Independently of your ARCO rights, you may withdraw at any time the consent you have given for the processing of your personal data, by sending a request to [email protected] meeting the same requirements set out in the preceding section.

The withdrawal takes effect once TIMSA confirms it and does not operate retroactively. In some cases processing must continue because a legal obligation requires it or because a legal relationship remains in place; if so, we will inform you together with the corresponding legal grounds.

8. Cookies and technical browsing data

The timsa.mx website is a static site. TIMSA does not use analytics, advertising or behavioral tracking cookies, and does not build profiles based on your browsing.

The site is delivered through a content delivery network and a hosting provider which, for security and service availability reasons, may process visitors' IP addresses, generate technical connection logs, and set strictly necessary cookies to prevent automated traffic and attacks. TIMSA does not use that information to identify visitors, nor does it link it to the data you provide to us.

Information you enter into the forms on this site is transmitted to TIMSA over an encrypted connection.

9. Reporting channel

The reporting channel is designed so that you can submit a report without identifying yourself:

• The form does not request your name, email address, telephone number or any other identifying data. All of its fields are free text.
• TIMSA does not take, nor ask third parties to take, any action aimed at identifying the person submitting a report.
• The information is sent directly to the Compliance area ([email protected]), with restricted access.
• TIMSA prohibits retaliation of any kind against anyone who submits a report in good faith or cooperates in its investigation.

If you choose to voluntarily provide contact details so that your report can be followed up, they will be treated in accordance with this Notice and in strict confidence.

10. Security measures

TIMSA has implemented reasonable administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access or processing, including role-based access controls, encryption of form submissions, and training for personnel who process personal data.

11. Personal data officer

TIMSA has designated an area responsible for handling data subject requests and for promoting the protection of personal data within the organization. You may contact it at [email protected] or at the address stated at the beginning of this Notice.

12. Amendments to this Notice

TIMSA may amend this Privacy Notice. Any amendments will be published on this same page, indicating the date of the latest update. We recommend that you review it periodically.

13. Data protection authority

If you consider that your right to the protection of personal data has been infringed, or that TIMSA has engaged in conduct contrary to applicable law, you may file a complaint with the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), through its Directorate-General for Personal Data in the Private Sector, the authority that assumed the powers previously held by the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI).

14. Governing version

This English text is provided for convenience only. In the event of any discrepancy or difference in interpretation, the Spanish version of this Privacy Notice shall prevail.