COMPREHENSIVE PRIVACY NOTICE

Ainda, Energía & Infraestructura, S.A.P.I. de C.V., located in Montes Urales 770, Piso 1, Lomas de Chapultepec, IV Sección, Alcaldía Miguel Hidalgo, C.P. 11000, Mexico City, Mexico (hereinafter "Ainda"), as the party responsible for the processing of your personal data, we recognize the importance of the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility for the processing of your personal data. Therefore, in compliance with the Federal Law for the Protection of Personal Data in Possession of Private Parties published in the Official Gazette of the Federation on July 5, 2010, its Regulations published in the Official Gazette of the Federation on December 21, 2011, and the Privacy Notice Guidelines published in the Official Gazette of the Federation on January 17, 2013 (the "Law"), hereby submits for your consideration this Integral Privacy Notice.

1. Personal data to be processed

Some or all of the following personal data will be processed by Ainda, because it is necessary to commence, maintain, and fulfill the relationship between you and Ainda.

• Identification data: name and e-mail address.

2. Purposes personal data use

The personal data you voluntarily provide will be processed for the establishment, maintenance, and fulfillment of the legal relationship between you and Ainda. Ainda will use your personal data in order to:

• Contact you;
• To fulfill the objectives of the relationship with the purpose of use of personal data;
• To answer any questions and comments that you send us by any means;

Importantly that Ainda will not use your data for marketing, advertising or commercial prospecting purposes.

3. Transfer of personal data

Ainda will transfer your personal data within the national territory or abroad to begin, maintain, and fulfill the legal relationship between you and Ainda (the "Recipients"). Ainda will transfer all or part of the information you provide to the Recipients through e-mails and/or other forms.

The Recipients may be of two types: (i) companies with which Ainda has a contractual and/or commercial or professional relationship and (ii) third parties outside Ainda, when this transfer is made precisely for the maintenance or fulfillment of the legal relationship between Ainda and you, such as, but not limited to, the transfer of data to legal, tax, financial, labor or IT service advisors. In both cases, Ainda will inform the recipient of the personal data protection measures implemented by Ainda. However, Ainda will not be liable for the processing of your personal data by third parties as such acts are beyond the scope of Ainda. Similarly, you are informed that Ainda, at its discretion, may request information from third parties regarding your legal and personal background, for which Ainda will verify that such transferors have a privacy policy that protects your personal data.

In any of the above mentionedcases , you are hereby informed that Ainda does not require your consent to transfer your personal data, in terms of Article 37 of the Law. However, if you object to the transfer of your personal data, please send us an e-mail to [email protected] in order to prevent the transfer of your personal data. Any other type of data transfer can only be made when: (i) it is in accordance with the Law, (ii) it is the result of an order from a competent authority, or (iii) withthe express consent of the owner.

4. Security Measures

Ainda has adopted the necessary administrative, technical, and physical security measures to protect your personal data against damage, loss, alteration, destruction or unauthorized use, access, or treatment. However, given that communications via the Internet are beyond the scope of our surveillance, we cannot always guarantee that your personal data transmitted to us via the Internet will be free from unauthorized use, access, or processing.

The security measures adopted by Ainda will be reviewed and revised in the light of technical and legal developments and will not be less than those adopted by Ainda to protect its own information.

If we become aware of a security breach at any stage of the processing of personal data that affects your right to privacy, the head of Ainda's personal data area will immediately inform you by e-mail of the security breach, so that you can take the necessary measures to defend your rights.

In any case, access to your personal data, held by Ainda, will be limited to persons who need to have access to such information, for the purpose of carrying out the purposes identified in this Privacy Notice.

5. Rights that correspond to the holder of personal data (ARCO)

As holder of personal data, you may contact Ainda’s Legal and Compliance Department of to exercise your rights of access, rectification, cancellation and/or opposition ("ARCO Rights") established in the Law. You may also revoke, at any time, the processing of your personal data, as well as limit the use or disclose information. If, after the revocation, you request confirmation of the revocation, AINDA will respond quickly.

The exercise of the ARCO Rights will be made through a written request addressed to the owner of the personal data area of AINDA, and sent to the email address [email protected], or to our offices located at Montes Urales 770, Piso 1, Lomas de Chapultepec, IV Sección, Alcaldía Miguel Hidalgo, C.P. 11000, Mexico City, Mexico from Monday to Friday from 9:00 to 18:00 hours, with attention to the owner of the personal data area, stating in detail your request (the "ARCO Request"). The ARCO Request must be accompanied by a copy of valid official identification and indicate how you wish to receive a response from AINDA. The head of the corresponding area of AINDA will respond to your ARCO Request in the medium you have chosen, stating the reasons for its decision within a maximum period of 20 (twenty) business days from the day on which your ARCO Request was received (or from the deadline, if any, established by law for that purpose, whichever is greater). The procedure will be conducted in accordance with the provisions of the Law.

For purposes of the foregoing, Ainda will make a series of suggested forms available to carry out requests for access, rectification, cancellation, and opposition to the processing of your personal data, which are available directly in the area of personal data of Ainda located in the offices.

In terms of the Law and its Regulations, we inform you that, in case of refusal of response to requests for ARCO rights or disagreement with it, you can submit to the National Institute of Transparency, Access to Information and Protection of Personal Data, the corresponding ARCO Request within the terms and conditions set by the Law and its Regulations.

6. Changes to the Privacy Notice

Any modification to this Privacy Notice will be made known to you at least 30 (thirty) days prior to the effective date of the modifications. You will be able to see this on the website: www.aindaei.com.