I. IDENTITY AND ADDRESS OF THE DATA CONTROLLER

In accordance with the provisions of Articles 8, 13, 15, 16, 17, 36, and other applicable provisions of the Federal Law on Protection of Personal Data Held by Private Parties, as well as Articles 89, 90, and 91 and other applicable provisions of its Regulations (hereinafter, the “Law”), the companies Gas Sultana, S.A., Distribuidora de Gas San Marcos, S.A. de C.V., Gasificadora la Perla, S.A. de C.V., Maquinado de Equipos y Tanques, S.A. de C.V., Ecoquim, S.A. de C.V., Condugas del Noreste, S.A. de C.V., Regiomontana de Gas, S.A., Combustibles Licuados y Equipos, S.A., Servicios Especiales Royal, S.A., Gas de Ameca, S.A. de C.V., their affiliates and/or subsidiaries (hereinafter collectively or individually referred to as the “Data Controller”), with registered address at Carretera a Reynosa km 3.5, Col. San Sebastián, Guadalupe, Nuevo León, Mexico, C.P. 67190, will be responsible for processing the personal data that we collect from you for the purposes described in this Privacy Notice, observing the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility.

II. PERSONAL DATA THAT WILL BE SUBJECT TO PROCESSING

For the purposes indicated in this Privacy Notice, we may collect the following personal data from you:

Full name
Photograph
Proof of address
Marital status
Birth certificate
Email address
Official identification or document proving your legal stay in the United Mexican States
Professional license (cédula profesional)
Nationality
Occupation or profession
Landline phone number
Mobile phone number
Unique Population Registry Code (CURP)
Federal Taxpayers Registry (R.F.C.)
Social Security registration number with the Mexican Social Security Institute (IMSS) and/or record of weeks contributed
AFORE (retirement fund) statement or proof
Level of education
General data of parents, children or spouse: names, age, address, occupation, place of residence and, where applicable, birth certificate
Academic background/history
Employment background/history
Documents supporting your employment history
Employment or personal references
Letters of recommendation
We may also request the following financial or asset-related personal data in order to make you an employment offer:

Proof of income and benefits received in your previous job
Last three payroll receipts
Certificate of income and withholdings from your previous employment
INFONAVIT and/or FONACOT credit number
Bank account details
AFORE account statements
An estimated breakdown of your monthly expenses

III. PROCESSING OF SENSITIVE PERSONAL DATA

In addition to the personal data mentioned above, for the purposes described in this Privacy Notice, we will process the following personal data that the Law considers as sensitive and that require special protection:

Whether you have belonged or currently belong to any union, and, where applicable, proof of membership in a union or association
Clinical file/medical record reflecting your current or future state of health, genetic information, and, where applicable, results of medical check-ups, medical certificates, laboratory tests, psychometric and/or psychological tests required by the company
By signing this Privacy Notice, you give your express consent for us to process your sensitive, financial, and asset-related personal data in accordance with this Privacy Notice.

IV. PURPOSE OF THE PROCESSING OF YOUR PERSONAL DATA

Your personal data will be used for the following purposes:

To analyze a possible hiring by the Data Controller or any of its subsidiaries or affiliates
To contact you in case there is a vacancy that matches your profile as a candidate
To learn about your personal profile, academic background, and professional and/or work experience
To follow up on your application to become part of the company
To schedule a job interview
To apply aptitude or knowledge tests related to the vacant position
To inform you about additional requirements you must meet if the Data Controller is interested in your profile
To carry out a socioeconomic study, validate your professional title, proof of studies, or experience
To provide information requested by government entities or authorities, or to comply with laws or regulations applicable to the Data Controller’s business in the United Mexican States or abroad
To address any complaint, question, or comment made by you
To send you updates or changes to this Privacy Notice
Where applicable, to send you a job offer
To send you other job offers in which you may participate
To keep and update your file within the Human Resources department
Additionally, we inform you that your personal data will not be used for marketing, advertising, or commercial prospecting purposes.

The Data Controller will implement the necessary technical, administrative, and physical security measures to protect your personal data, as well as to avoid unauthorized use, access, or processing. The Data Controller will only use your personal data for the purposes established in this Privacy Notice.

V. OPTIONS AND MEANS PROVIDED BY THE DATA CONTROLLER TO LIMIT THE USE OR DISCLOSURE OF PERSONAL DATA

You may limit the use or disclosure of your personal data by sending the corresponding request to our Privacy Department. The requirements to prove your identity and the procedure for handling your request will be the same as those indicated in Section VI of this Privacy Notice.

VI. MEANS TO EXERCISE THE RIGHTS OF ACCESS, RECTIFICATION, CANCELLATION, OR OPPOSITION (“ARCO RIGHTS”)

To exercise your rights of access, rectification, cancellation, and opposition (ARCO Rights) regarding your personal data held by the Data Controller, you must follow this procedure:

Send an email to the following address: datos.personales@gasmty.com, indicating that you wish to exercise your ARCO rights. Our Privacy Department will send you, in response, the form for the exercise of ARCO rights. Once you receive the form, you (as the Data Subject) must send it back duly completed to the email address indicated above, attaching the following documents scanned or in PDF format:

Valid official identification
Full name of the Data Subject
Clear description of the personal data with respect to which you seek to exercise the corresponding right
Documents proving the legal representation of the Data Subject, in case the rights are exercised by a representative
The Data Controller will respond to your request within a period not exceeding 20 business days, using the same means of communication.

The Data Controller may deny access to personal data, or refuse to carry out rectification, cancellation, or grant opposition to their processing in the cases established in Article 34 of the Law.

The Data Controller will not be obliged to cancel the Data Subject’s personal data in the cases provided for in Article 26 of the Law.

VII. REVOCATION OF CONSENT

The Data Subject may revoke, at any time, the consent previously granted for the processing of their personal data, in accordance with Article 8 of the Law. To do so, it will be necessary to send an email to the Privacy Department at: datos.personales@gasmty.com.mx, where you will be informed of the procedure to follow.

VIII. TRANSFER OF DATA

Your personal data may be transferred to and processed by persons other than the Data Controller in the following cases:

Parent companies, subsidiaries, or affiliates of the Data Controller, or a controlling/parent company: For the purposes of centralized information storage, control of hirings and terminations, changes related to your contract, as well as for statistical and historical record-keeping functions.
Authorities, agencies, or governmental entities: To comply with obligations set forth in applicable legislation and/or in response to requests made by such authorities.
The data transfers mentioned above do not require your consent, in accordance with Article 37 of the Law.

IX. CHANGES TO THE PRIVACY NOTICE

This Privacy Notice may be modified and/or updated at any time by the Data Controller in order to comply with legislative or jurisprudential changes, internal policies, or new requirements. The updated version will be posted on our website www.gruporg.com, and that version will be applicable at all times.

If the Data Controller changes its identity, needs to collect additional personal, financial, or asset-related data, changes the purposes for processing your personal data, or modifies the conditions of data transfers that may be carried out under this Privacy Notice, a new Privacy Notice will be made available to the Data Subjects via the email address you have provided to the Data Controller or through the Data Controller’s website.