PRIVACY POLICY

Identidad y Domicilio del Responsable

In accordance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), its Regulations, the Privacy Notice Guidelines, and all other applicable laws, JR FORGING S.A. DE C.V. (hereinafter referred to as "JR FORGING"), acting as the Data Controller, with its registered address for receiving notices at Carretera Querétaro–San Luis Potosí No. 24000, Warehouse 26, Col. Ampliación Nueva Santa Catarina, C.P. 76223, Querétaro, Querétaro, Mexico, is committed to processing the Personal Data collected from you in accordance with the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality, and accountability established under applicable law. Accordingly, JR FORGING makes this Privacy Notice available to you so that, as the Data Subject, you are informed of the scope and conditions governing the processing of your Personal Data, thereby ensuring your right to informational self-determination.

Definitions

Privacy Notice: This document, made available to you in physical, electronic, or any other form.
Personal Data: Any information relating to an identified or identifiable natural person.
Sensitive Personal Data: Personal Data that affects the most private sphere of the Data Subject, or whose improper use may give rise to discrimination or pose a serious risk to the Data Subject.
ARCO Rights: The rights of Data Subjects to Access, Rectification, Cancellation, and Objection regarding their Personal Data.
Days: Business days.
Data Processor: The natural or legal person who processes Personal Data on behalf of JR FORGING, either individually or jointly with others.
Corporate Group: A group of legal entities organized under direct or indirect ownership structures in which the same company maintains control over such entities.
Law: The Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares).
Regulations: The Regulations of the Federal Law on the Protection of Personal Data Held by Private Parties.
Data Controler: The private individual or legal entity that determines the purposes and means of processing Personal Data. For purposes of this Privacy Notice, the Data Controller is JR FORGING.
Data Subject: The natural person to whom the Personal Data relates.
Processing: The collection, use, disclosure, transfer, or storage of Personal Data by any means. Processing includes any action involving access, handling, use, transfer, or disposal of Personal Data.
Transfer: Any disclosure of Personal Data to a party other than the Data Controller or the Data Processor.

Personal Data We Collect

Data Subject: Name, telephone number, email address, and information regarding your browsing activity and online behavior while using our website and mobile applications.

How we collect your personal data?

Personal data may be collected directly by our personnel, employees, commercial representatives, technological systems, and information technology applications, either in person or through the Internet. JR FORGING collects your Personal Data when you request our products or services in person or through digital channels; when you communicate with our commercial representatives or authorized personnel via email, telephone, or video conference; when you exercise your ARCO Rights; when we conduct supplier audits; when you report an incident related to our products or services; when you visit our facilities, website, or social media platforms; when third parties, with your prior consent, provide your Personal Data as a personal reference; and when we collect information through technologies such as cookies and web beacons to personalize content and advertisements, analyze website usage, and manage advertising campaigns. Additionally, when you access our website or mobile applications, we may collect information such as your device's unique identifier, IP address, operating system details, network provider, and location data, where applicable.
Por motivos de seguridad, nuestras instalaciones cuentan con sistema de circuito cerrado de televisión (cámaras de seguridad) que podrán grabar su imagen, así como la toma de fotografías.

Purposes of Personal Data Processing

Primary Purposes:
JR FORGING uses the Personal Data it collects for the following purposes:

• Comply with all legal, contractual, and non-contractual obligations arising from the legal relationship between you and JR FORGING.

• Enable JR FORGING to properly provide its own products and services, as well as third-party products and services when acting as a reseller or distributor.

• Enable JR FORGING to contact you and notify you of any changes to the terms and conditions applicable to the provision of its own or third-party products and services, including, but not limited to, pricing, payment terms, invoicing, service levels, product or service features, functionalities, and warranties.

• Enable JR FORGING to comply with all legal and regulatory obligations applicable to its commercial activities, as amended from time to time.

• Carry out collection and accounts receivable activities.

• Provide you with access to designated areas or specific events within our facilities.

• Verify the identity of Data Subjects and their personal references through official identification documents in order to provide legal certainty to the relationship between you and JR FORGING.

• Enable JR FORGING to improve its products and services through the analysis of incidents related to its own products and services, as well as those of third parties when acting as a reseller or distributor.

• Enable JR FORGING to enhance its physical and technological security systems.

• Provide competent governmental authorities with your Personal Data, including audio, video, and/or biometric data, when required pursuant to a duly justified and legally supported request.

• Service Video calls

If you do not wish for the Personal Data you provide to be used for the purposes described above, you may object by exercising your ARCO Rights in accordance with the procedures set forth in this Privacy Notice. Please note that exercising your ARCO Rights with respect to these purposes will not affect JR FORGING's ability to provide the products and/or services you have requested.

For the purposes described in this section, the Data Subject has five (5) business days from the commencement of the commercial relationship to object to the processing of their Personal Data. Notwithstanding this period, the Data Subject may exercise their ARCO Rights at any time during the processing of their Personal Data to object to such processing, in accordance with the procedures set forth in this Privacy Notice.

Your Personal Data, including Sensitive Personal Data, Asset-Related Data, Financial Data, and Biometric Data, may be stored in Mexico or in another country, strictly for the purposes set forth in this Privacy Notice and in compliance with applicable legal requirements.

JR FORGING hereby informs you that, in accordance with Articles 189 and 190 of the Federal Telecommunications and Broadcasting Law (Ley Federal de Telecomunicaciones y Radiodifusión), it is required to record and retain certain information related to the use of telecommunications services, as mandated by applicable law.

Transfer of Personal Data to third parties

The Personal Data you provide may be transferred to and/or processed by parties other than the Data Controller for the purposes described in this Privacy Notice. Likewise, your Personal Data may be transferred to and/or processed by companies that are part of the JR FORGING Group. You also acknowledge and agree that JR FORGING may disclose your Personal Data to competent governmental authorities when required by a duly justified and legally supported written request. Furthermore, in connection with the contractual or commercial relationship you maintain with JR FORGING, your Personal Data may be shared with public or private entities when necessary for the provision of the products or services you have requested or contracted.

You may, at any time, object to JR FORGING transferring your Personal Data to third parties by exercising your ARCO Rights through the procedures established in this Privacy Notice. Please note that refusing the transfer of your Personal Data may result in the termination of the contracted services if such transfer is strictly necessary for the provision of those services.

Protection of Personal Data

JR FORGING implements appropriate administrative, technical, technological, and physical safeguards to protect your Personal Data against damage, loss, alteration, theft, misuse, as well as unauthorized access, disclosure, modification, or destruction.

Disclosure of Personal Data as permitted by Law

You acknowledge that JR FORGING may be required to disclose your Personal Data in compliance with applicable laws, judicial or administrative proceedings, legal actions, or upon receipt of a lawful and duly justified request from a competent governmental authority.

Options and means to limit the use or disclosure of Personal Data

As the Data Subject, you may, at any time, limit the use or disclosure of the Personal Data provided to JR FORGING by exercising your ARCO Rights as described in this Privacy Notice.

Additionally, please note that other mechanisms are available to limit the use or disclosure of the Personal Data provided to JR FORGING, including the National Institute for Transparency, Access to Information and Personal Data Protection (INAI), the Public Registry to Avoid Advertising (REPEP), and the Federal Consumer Protection Agency (PROFECO). Further information about these mechanisms can be found on the official websites of these government authorities.

Use of Cookies

At http://www.jrforging.mx, https://www.facebook.com/jrforging, https://www.instagram.com/jr.forging/?hl=es-la, we use cookies and other tracking technologies, such as web beacons, to collect information, including users' IP addresses. These technologies help JR FORGING better understand user and visitor behavior, enabling us to provide personalized content based on the products, services, and solutions we offer. It is important to note that the use of cookies does not allow JR FORGING to access or extract information from your computer that could compromise the security or privacy of our customers or website visitors.

ARCO rights

In accordance with the Federal Law on the Protection of Personal Data Held by Private Parties and its Regulations, you have the right to exercise your ARCO Rights: Access, Rectification, Cancellation, and Objection with respect to the Personal Data you have provided to JR FORGING. You may also object to or withdraw your consent for the processing or transfer of your Personal Data at any time, provided there is no legal restriction preventing such action. You may exercise any of your ARCO Rights by submitting a signed written request to the following email address: ventas@jrforging.mx, or by delivering it in person to the address indicated in this Privacy Notice during business hours, Monday through Friday, from 8:00 a.m. to 6:00 p.m.

In accordance with Article 32 of the Federal Law on the Protection of Personal Data Held by Private Parties, JR FORGING will notify the Data Subject of its decision regarding the request for Access, Rectification, Cancellation, or Objection within a maximum period of twenty (20) days from the date the request is received. If the request is granted, the corresponding action will be carried out within fifteen (15) days following the date on which the decision is communicated.

Information and documentation required to exercise ARCO rights

• A written request specifying the ARCO Right you wish to exercise (Access, Rectification, Cancellation, or Objection), including the name of the Data Subject.

• A copy of the identification documents of the Data Subject or their legal representative.

• The Data Subject must verify their identity by providing a scanned copy of a valid government issued identification (such as a voter ID card, national ID, or passport).

• The legal representative or attorney in fact must provide proof of authority through a public instrument, a power of attorney signed before two witnesses, or a personal declaration made by the Data Subject.

• Contact information (full name and email address) of the Data Subject, as well as the preferred method by which JR FORGING may send notifications and responses regarding the request.

• A clear and accurate description of the Personal Data to which the requested ARCO Right applies.

• Any additional information or documentation that may facilitate the identification of the relevant Personal Data (for example, the service or product acquired).

The email address provided is intended exclusively for the submission and processing of ARCO Rights requests. Any other type of inquiry submitted through this email address may not receive a response and should be directed to the appropriate department.

Specific procedures for exercising ARCO rights

Pursuant to Article 35 of the Federal Law on the Protection of Personal Data Held by Private Parties and Article 93 of its Regulations, JR FORGING informs you that the exercise of your ARCO Rights (Access, Rectification, Cancellation, and Objection) is simple and free of charge. The Data Subject shall only be responsible for any applicable shipping, reproduction, or document certification costs, except where otherwise provided by law.

Reproduction costs shall not exceed the actual cost of recovering the requested materials, in addition to any applicable shipping expenses.

Withdrawal of consent

You may withdraw your consent for the processing of your Personal Data by submitting a written request to JR FORGING via the following email address: ventas@jrforging.mx. Additional information regarding the process will be provided upon request. In accordance with Article 32 of the Federal Law on the Protection of Personal Data Held by Private Parties, JR FORGING will communicate its decision regarding your request for withdrawal of consent within a maximum period of twenty (20) days from the date the request is received. If the request is deemed appropriate, the withdrawal of consent will become effective within fifteen (15) days following the date on which the corresponding decision is communicated. Pursuant to Article 35 of the Law and Article 21 of its Regulations, JR FORGING informs you that the process for withdrawing your consent is simple and free of charge.

Changes to this privacy notice

This Privacy Notice may be modified, amended, revised, or updated as a result of new legal requirements; changes in JR FORGING's organizational structure, operations, or services; updates and implementation of best privacy practices; changes to JR FORGING's business model; or for any other reason. JR FORGING reserves the right to modify, amend, revise, or update this Privacy Notice at any time. In such cases, the updated version will be made available through our website. https://www.jrforging.mx

You provide your consent for the processing of your Personal Data at the time JR FORGING collects such information, for the purposes set forth in this Privacy Notice and/or when you express your consent through the applicable physical, electronic, or biometric means. By doing so, you acknowledge that you have been informed of this Privacy Notice and expressly consent to the processing of your Personal Data, including Sensitive Personal Data, Financial Data, Asset-Related Data, and Biometric Data, where applicable.

Last Updated: June 2025