Privacy Notice

TRADE NAME

CTR SCIENTIFIC

DATA CONTROLLER

“Control Técnico y Representaciones, S.A de C.V.” (hereinafter “the Company”), with address at Av. Lincoln No. 3410 Poniente, Col. Mitras Norte, Monterrey, N.L., C.P. 64320, is responsible for collecting your personal data, for the use and processing given to it, and for its protection.

The personal information of each customer or prospective customer (hereinafter the “Data Owner”) will be used for the following purposes, which give rise to and are necessary for the existence, maintenance and performance of the legal relationship between the Company and the Data Owner:

• To fulfill the obligations undertaken with the Data Owner;
• Invoicing and collections;
• Creation and administration of the Data Owner's account;
• Use of the website;
• To grant access to our facilities to any Data Owner who requests it and is previously authorized by our management;
• To prepare and negotiate the corresponding contracts with the Data Owner;
• Identification of the Data Owner and inclusion in the database;
• Verification and authentication of the data provided by the Data Owner;
• To request commercial or credit references about the Data Owner from third parties;
• To prepare quotations based on the information the Data Owner provides through the transaction forms;
• To follow up on requests for information about the products the Company offers through our website or other electronic and conventional means;
• Shipment of merchandise purchased by the Data Owner;
• Contacting the Data Owner regarding products requested from the Company;
• Delivery of the products ordered;
• Provision of the services requested by the Data Owner;
• Sending urgent or important notices about any matter related to our website or to products requested from the Company;

The Data Owner's personal information will be used for the following secondary or ancillary purposes:

• To report on new products related to those previously purchased by the Data Owner;
• To report on changes to our products or services;
• Sending commercial or technical information;
• Sending selective advertising, as well as invitations and information about courses, seminars and competitions;
• To feed the Company's statistics;
• To conduct market research and statistical analyses;
• To carry out periodic evaluations of our products in order to improve their quality;
• To evaluate the quality of the service provided by the Company;
• To conduct internal studies on consumption habits.

For the purposes mentioned above, the following personal data will be requested from the Data Owner:

· Full name

· Sex

· Email address

· Address

· Landline, extension and mobile phone

· Date and place of birth

· Tax ID card, Federal Taxpayer Registry (RFC) or billing details

· Commercial references from the Data Owner's suppliers of products or services

· Debit or credit card details (only for internet sales)

Means for exercising ARCO rights:

The Company will process any request from the Data Owner to exercise their ARCO rights (Access, Rectification, Cancellation and Objection).

For any request to exercise ARCO rights, the Data Owner must send electronically to the email address ctrscientific@ctr.com.mx a scanned and signed copy of their valid voter ID card (INE or IFE) or, where applicable, their valid passport or immigration card.

We inform you through this document that you may access, rectify or cancel your personal data, as well as object to or limit its transfer, processing or disclosure, including the revocation of any prior consent, by means of written, electronic or telephone notice sent to the Company, which will respond within a maximum of 5 (five) business days.

However, it is important to bear in mind that we will not be able to address your request or cease the use of your personal data immediately in all cases, since it is possible that, due to a legal obligation or to the Company's own policies, we may need to continue processing your personal data. Likewise, you should consider that, for certain purposes, the revocation of your consent will mean that we cannot continue providing services or supplying products to you, or that your relationship with the Company is terminated.

Should the cancellation or rectification of all or part of the Data Owner's personal data proceed, the Company will send the Data Owner the corresponding records by email in PDF or Word format; however, if the Data Owner is unable to access their personal data, the Company will provide technical support by telephone or email, free of charge. In any case, the Company may ask the Data Owner to complete electronic forms, which the Company will provide by email.

The personal data you provide to the Company will be used internally only, and therefore your personal data will at no time be shared with third parties. Accordingly, pursuant to articles 36, 37-IV and 37-VII of the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP), the Data Owner's personal data will not be transferred to third parties as set out herein.

Notwithstanding the foregoing paragraph, the Company transmits data to an external cloud service provider solely for the preventive backup of our information and of the personal data of data owners in the event of damage to or malfunction of our servers.

Likewise, although the Company will not collect sensitive personal data from the Data Owner, it will in some cases request the following financial or asset-related personal data:

• Credit history;
• Bank account statements;
• Proof of tax status (constancia de situación fiscal);
• Information on current loans;
• Commercial references;
• Positive compliance opinion (opinión de cumplimiento);
• Completion of a credit application;

The Data Owner is informed that the Company at no time has access to the credit or debit card information provided through our website www.ctrscientific.com to make purchases, as that information is processed solely and exclusively by the issuing bank.

The Data Owner is informed that the Company will collect their data in person when purchases are made at our counter; likewise, by telephone, email and our websites www.ctrscientific.com and www.ctruniforms.com to collect billing details, and finally, through those websites when online purchases are made.

Cookies and web beacons are not currently used to monitor the Data Owner's behavior over the internet.

The data provided to CTR, belonging to CONTROL TECNICO Y REPRESENTACIONES, S.A. DE C.V., is protected with an SSL security lock. SSL (Secure Socket Layer) is a security protocol that makes the transmission of data between a server and a user (or vice versa) over the Internet completely secure. The SSL certificate allows us to protect your data in a secure environment, as the information is encrypted and sent to the server.

Regarding the rights established in the Federal Law on the Protection of Personal Data Held by Private Parties, if you consider that the protection of your personal data has been infringed, you may turn to the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI), where you can file a complaint and assert your rights. For more information visit www.inai.org.mx.

You are informed that our plant has video recording cameras installed in the customer parking area, reception and store, as a security and crime prevention measure, as well as a means of evidence for possible claims before insurance companies. Only personnel of the Internal Monitoring Department have access to those images and recordings, which will only be reproduced and shown to the competent authorities or to the adjusters of the corresponding insurance companies in the event of a loss, contingency or crime.

CTR Scientific reserves the right to update, change or modify this Privacy Notice at any time. Should any change occur, CTR Scientific will communicate it through our website.

DATE OF LAST UPDATE OF THIS PRIVACY NOTICE

February 17, 2026