Industrias Plásticas Médicas, S.A. de C.V. (IPM), located at Calle Vicente Guerrero No. 11, Parque Industrial Cuautla, Ayala, Morelos, ZIP Code 62715, is responsible for the processing of your personal data and hereby informs you of the following.

I. Purposes of the Processing of Your Personal Data

Necessary Purposes: to respond to sales inquiries and provide quotes; to process and manage orders and contracts; to organize and carry out deliveries; to issue tax receipts; to manage payments and collections; to address inquiries, complaints, and after-sales service; and to comply with legal obligations related to the requested transaction. The logistics planning required to fulfill your order is part of these purposes.

Secondary and voluntary purposes: to send IPM advertisements and promotions or to conduct marketing outreach; and to create consumer profiles to personalize those communications. These purposes will only be carried out if you separately consent to them through the options provided in this notice or an equivalent electronic consent. If you do not provide affirmative consent, your data will not be used for these purposes. Your refusal will not affect the products or services you request or purchase.

You may notify us of your refusal as soon as you receive this notice and subsequently withdraw your consent by emailing gcarmona@ipm.mx or by writing to the department indicated in Section IV. General planning that uses previously de-identified information, which does not allow for the identification of an individual, does not constitute personal profiling.

II Personal Data to Be Processed

For applicable purposes, we may process the following: name; address, phone number, and email address; tax information necessary for billing, including the Taxpayer Identification Number (RFC), tax status, and tax ZIP code, when applicable; shipping address; identification and contact information for those who manage purchases and payments; and information regarding orders, payment methods, and receipts linked to an identified or identifiable individual.

A company’s purely business-related data will be distinguished from the personal information of individuals. If it becomes necessary to collect financial or asset-related data that is not covered by a legal exception, we will first obtain the appropriate express consent. We will not collect any information beyond what is necessary for the transaction.

To process a quote or a standard sale, we do not require medical diagnoses or medical histories. If, in order to address a specific inquiry, a complaint, or a legal obligation related to the product, it becomes necessary to process information that reveals your health status, we will identify the data and the specific purpose. This data is sensitive; unless there is an applicable legal exception, we will obtain your express, written consent in advance. Health data will not be used for advertising or for creating health profiles for commercial purposes.

III. Transfers of Personal Data

Recipient

Purpose and Basis for Not Requiring Consent

Tax Administration Service

Comply with tax obligations and issue the corresponding receipts. Article 36, Section I of the Federal Law on the Protection of Personal Data Held by Private Parties.

All other transfers will be made only when necessary and covered by a legal exception; for example, to respond to a valid request from an authority or to fulfill our legal relationship with you. For a voluntary transfer outside of these exceptions, we will provide advance notice of the recipient, the data involved, and the purpose, and we will request the appropriate consent.

Data processors that process data exclusively on behalf of IPM—such as for billing, delivery, or systems support—must act in accordance with IPM’s instructions and comply with the applicable confidentiality and security obligations. If a third party processes the data for its own purposes, the disclosure will be considered a transfer and will be subject to the applicable exception or consent.

IV. Rights of Access, Correction, Deletion, and Objection

You may access your personal data and learn about the conditions under which it is processed; request that it be corrected if it is inaccurate, incomplete, or out of date; request that it be deleted; or object to its processing in the cases provided for by law. These rights are known as ARCO rights. Exercising one right does not prevent you from exercising another.

Submit your request in writing to the Telemarketing Department at the IPM address indicated in this notice, or by email to gcarmona@ipm.mx.Puede. For guidance on the procedure, please call +52 735 3556024, extension 0. There is no specific format required.

The request must include: your name and an address, email address, or other means of receiving notifications; documents proving your identity and, if applicable, the identity and authority of anyone acting on your behalf; the right you wish to exercise or the request you are making; and a clear description of the data involved, unless the request is for access. You may provide information to facilitate its location. For rectification, indicate the changes and include supporting documents; for objection, state the grounds or circumstances justifying it in accordance with the law.

IPM will issue a notice stating the date of receipt. If the request contains insufficient or incorrect information or requires documents to verify identity or representation, IPM may request additional information on one occasion only within five business days of receipt. You will have ten business days, starting the day after you receive the request for additional information, to comply with it. If you do not comply, the request will be deemed not to have been filed; if you do comply, the response period will begin the day after you complete the request.

IPM will notify the applicant of its decision within a maximum of twenty business days from the date of receipt of the request. If the request is granted, it will be implemented within fifteen business days following notification of the decision. Each deadline may be extended once for an equal period when circumstances warrant it; the reasons for the extension will be communicated before the respective deadline expires, in accordance with Article 31 of the Federal Law on the Protection of Personal Data Held by Private Parties.

The response will be provided via the method specified in the request. Access to and delivery of the data will be granted upon verification of identity and, where applicable, representation, through electronic documents, simple copies, or consultation via an agreed-upon and secure mechanism. This process is free of charge; only justified shipping or reproduction costs that are legally applicable may be charged. Any denial will be communicated along with the grounds and an explanation. The deletion is subject to blocking, retention, and applicable legal exceptions.

V. Withdrawal of Consent

You may revoke the consent you have given at any time, without retroactive effect, by sending a written request to the Telemarketing Department or to gcarmona@ipm.mx, specifying the processing for which you wish to revoke consent and providing proof of your identity and, if applicable, proof of representation. You may also use at least the same method by which you gave your consent, through a simple and free mechanism provided by IPM.

The determination and, when applicable, the cessation of processing will be addressed within twenty and fifteen business days, respectively, in accordance with the extension rules set forth in Section IV. If you request confirmation of the cessation, you will receive an explicit response. When processing must continue due to a legal obligation or another applicable exception, IPM will inform you of the purpose and legal basis. The revocation of voluntary consents will not affect your employment rights or the products or services you have contracted for, as applicable.

VI. Restrictions on the Use or Disclosure of Your Personal Data

You may request that your information no longer be used for advertising, promotions, marketing, or consumer profiling for these purposes by sending an email to gcarmona@ipm.mxo addressed to the Telemarketing Department. To opt out of commercial communications, simply specify the contact method you wish to restrict; additional information will only be requested when it is essential to verify your request. IPM will record your restriction and will not send you any further communications. This process is free of charge and does not affect any contracted services.

To limit unsolicited calls and messages to your phone number, you can also register with PROFECO’s Public Registry to Prevent Unsolicited Advertising, in accordance with its rules, at https://repep.profeco.gob.mx. You can get assistance by calling 55 5568 8722 or 800 468 8722. This registry complements the direct opt-out process with IPM and does not replace your ARCO rights.

VII Security and Confidentiality Measures

IPM establishes and maintains administrative, physical, and technical security measures to protect your personal data against damage, loss, alteration, destruction, and unauthorized use, access, or processing. These measures are determined by considering the risk associated with the processing, the sensitivity of the data, technological developments, and the potential consequences for data subjects, and are no less stringent than those applied to our own information.

Access to the data is limited to authorized individuals who need it for the stated purposes. Those involved in processing the data must maintain confidentiality even after their relationship with IPM ends. Data processors who process data on behalf of IPM must do so in accordance with IPM’s instructions and the applicable security and confidentiality obligations.

If a security breach occurs that significantly affects your property rights or moral rights, IPM will immediately inform you of the nature of the incident, the compromised data, the measures taken, the security recommendations, and how to obtain additional information, in accordance with applicable regulations.

VIII Retention of Your Personal Data

We will retain your data for as long as necessary to fulfill the purposes disclosed and to comply with applicable legal obligations or responsibilities. When the data is no longer necessary, we will block it, where applicable, and delete it upon the expiration of the applicable retention or statute of limitations periods. While the data is blocked, it will be retained only to the extent necessary to fulfill the responsibilities that justify its retention.

IX. Changes to This Privacy Notice

IPM will notify you of any changes or updates by publishing the new version on its website. The current version may be requested from the contact department listed in Section IV. Before processing personal data for a new purpose that requires consent, you will be informed, and the appropriate consent will be obtained.

X Competent Authority and Remedies

If you believe that the processing of your personal data violates your rights, you may contact the Secretariat for Anti-Corruption and Good Governance through its Personal Data Protection Unit and the General Directorate for Personal Data in the Private Sector.

If you disagree with the response to an ARCO rights request, you may file a data protection request with the Secretariat within fifteen business days of receiving the response. If you do not receive a response, you may file the request once the legal response period has expired. You may also report alleged violations of personal data protection regulations.

A data protection request may be submitted in free-form writing or using the forms and, where applicable, the electronic system provided by the Secretariat, in compliance with the applicable requirements. To learn about the channels for submitting requests and complaints and to obtain guidance, visit https://www.gob.mx/buengobierno or write to proteccion.datos@buengobierno.gob.mx. The guidance email does not replace the formal submission of the request through an authorized channel.

This notice is issued pursuant to the Federal Law on the Protection of Personal Data Held by Private Parties and the applicable regulatory and administrative provisions. Last update to this proposal: October 7, 2026.

Decision on Secondary Purposes

Select an option for each purpose. The options are independent and voluntary; they do not affect the requested transaction.

Voluntary Purpose

Their decision

Advertising, Promotions, and Business Development by IPM

Yes ☐ No ☐

Consumer profiles for personalizing marketing communications

Yes ☐ No ☐

Name of the account holder ______________________________________________

Signature or equivalent authentication __________________ Date _________________

Acknowledgment of receipt of this notice does not, by itself, authorize the disclosure of sensitive information or voluntary transfers that require specific consent. If this notice is provided electronically, IPM will retain evidence of the decisions expressed through an equivalent mechanism.

‍

‍