This Privacy Notice applies to:

• Suppliers Prospects and Suppliers who are natural persons, only for purposes that are not in their capacity as merchants and professionals, and that therefore are not excepted by Article 5 of the Regulation of the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter the "NP Suppliers").
• Persons who are shareholders, real owners, and/or legal representatives of the suppliers, who provide personal data that are subject to the scope of application of the regulations (hereinafter the "Supplier Representatives").
• Natural persons with the quality of references, affinity, or kinship with the Supplier, with the shareholders, the real owner, or the legal representatives of the supplier, whose information is required in the contracting process (hereinafter the "Related Holders").

The Company responsible for the treatment of personal data will be PetroBal S.A.P.I. de C.V. and PetroBal Upstream Delta 1, S.A. de C.V. (hereinafter "PetroBal", located at Moliere 222, Piso 7, Col. Los Morales, Sección Palmas, Alcaldía Miguel Hidalgo, C.P. 11540, Mexico City, Mexico.

Any questions related to the protection of your personal data, please contact our Privacy Officer at the following email address: privacidad@petrobal.com.mx

To comply with the purposes of the treatment indicated in this privacy notice, it is necessary to collect and process the following personal data:

• Identification data,
• Location data,
• Contact details,
• Data related to political exposure, as well as kinship or affinity with politically exposed people.

We inform you that we will use personal and sensitive data related to legal proceedings involving prospective suppliers, to determine if they comply with the requirements established in our internal policies, as well as with any applicable regulations.

PetroBal will process your aforementioned personal data to carry out internal investigations and procedures that allow us to verify suitability and whether you meet the requirements established in our internal policies, as well as any other applicable regulations, to become a PetroBal Supplier.

Specifically, PetroBal will process your personal data to achieve the following purposes:

• Carry out research and procedures that allow us to verify whether the prospective supplier complies with the requirements established in our internal policies, as well as in any applicable regulations to become a Supplier for PetroBal.
• Enact Grupo Bal’s and PetroBal’s internal policies regarding the prevention of operations with illicit or untraceable resources.
• If the prospective Supplier turn out to be eligible, PetroBal will process your personal data as follows:
  • To execute any activity necessary to manage the relationship with the Supplier.
  • To manage the Supplier’s access to our facilities.
  • To carry out internal and external audits.
  • To address legal conflicts promoted before the competent authorities.

Additionally, PetroBal may use your personal data in the following cases:

• Offer you additional opportunities to be a supplier to other Group companies.
• For your participation in events organized by the company.
• To use your image in corporate videos or company communications.
• For statistical purposes of evaluation of the company.
• To provide references from you.
• To send you additional communications to those necessary for the service provided.

In case you do not want your personal data to be processed for any or all the aforementioned purposes, please let us know by sending an e-mail to the following address: privacidad@petrobal.com.mx

PetroBal may transfer your personal data, from both, your national and foreign entities, without requiring your consent to:

• PetroBal’s Affiliated companies, subsidiaries, and/or controlling entities, national or foreign, that operates under this exact internal policy regarding the protection of personal data.
• Government Authorities and Regulators provided they are required laws, bylaws, processes, or procedures.

Your organization or its legal representative may exercise any of the rights of Access, Rectification, Cancellation, or Opposition of your Personal Data (hereinafter "ARCO Rights"), as well as revoke your consent for the use of your personal data by sending an email to our Privacy Officer at the address: privacidad@petrobal.com.mx where you will be attended promptly.

Our Privacy Officer will provide you with a "Request to Exercise the Rights of the Holders" so that you can exercise your privacy privileges.

For our Privacy Officer to follow up on your request, you or your legal representative must correctly prove your identity for which it is necessary to complete all the fields indicated in the Form and accompany it with a copy of any of the current official identifications indicated therein.

That the information provided is inaccurate or insufficient, or the corresponding accreditation documents are not attached, our Privacy Officer, within five (5) business days following receipt of the request, may require you to provide additional information or documentation necessary to comply with your request; accordingly, you must fulfill such information or documentation request within the next ten (10) working days, starting the next day you receive the aforementioned requirement from our Privacy Officer.

If no response is given within that period, the corresponding application will be considered not submitted.

Our Privacy Officer will inform you of whether or not your request was accepted, as well as any related comments, within a maximum period of twenty (20) business days, counted from the date on which the request was received, so that, if successfully fulfilled, will become effective within fifteen (15) business days following the communication of the response.

You may limit the use or disclosure of your personal data by sending your request to our Privacy Officer at the following e-mail address: privacidad@petrobal.com.mx
The requirements to prove your identity, as well as the procedure to comply with your request, will follow the criteria described in the aforementioned provision.

If your request is correctly submitted, our Privacy Officer will register it in PetroBal's exclusion list.

PetroBal reserves the right, in its sole discretion, to change, modify, add, or remove portions of this Privacy Notice at any time.

The current Privacy Notice will always be accessible on our webpage: www.petrobal.com.mx/en/

This Privacy Notice was last updated on October 2023.