This privacy notice is shared in accordance with the amended Federal Law on Protection of Personal Data Held by Individuals and its regulation published in the Mexican Official Gazette of the Federation on July 5ᵗʰ of 2010, as well as the guidelines issued by the Mexican Ministry of Economy for content and scope of privacy notices in cooperation with the The National Institute for Transparency, Access to Information and Personal Data Protection (INAI by its initials in Spanish), as applicable according to the "Law". This privacy notice is available for consultation on our website: https://www.alliera.com/aviso-de-privacidad

1. Identity

Alliera S.A. de C.V. (hereinafter "CEMEX" and/or "Alliera") is responsible for the use and protection of any personal data, and in this regard informs as follows.

2. Address

For any purposes regarding this privacy notice, CEMEX 's address is Constitución 444, Centro, Monterrey, Nuevo León, México.

3. Personal Data Department

The contact information for CEMEX's Personal Data Department is as follows; Address: Constitución 444, Centro, Monterrey, Nuevo León, 64000; Office hours from 9:00 am to 5:00 pm (Monday to Friday); Email: dataprivacy@cemex.com

CEMEX designates the Personal Data Department to attend and process the holders requests to exercise the ARCO rights referred in the Law (Access, Rectification, Cancellation and Opposition, as well as the limitation to the use or disclosure of data and withdrawal of consent) as set forth in Section 8 of this privacy notice.

4. Purposes of personal data processing

The data that CEMEX holds, collects or will collect will be (i) the personal data voluntarily provided when creating an account on the Alliera website as well as personal data that may be collected through cookies, web beacons and other technologies in accordance with Section 11 of this privacy notice, and (ii) the personal data voluntarily provided when filling out the personal data questionnaire when requesting a quote. The collected personal data will be used for the following purposes and needs:

- Providing services and products offered through the website.

- Responding requests, comments, complaints or concerns that have been included in the comment boxes or other means on the Alliera website.

- Managing business relationships, including ways to contact any customer to fulfill contractual or legal obligations.

- Registration for events or conferences announced through the website or any other communication channel.

In addition, the personal information will be used for the following purposes that are not necessary for the requested service, but are complementary and/or allow providing a better service:

- Sending advertising about Alliera, or any of its products or services, from time to time based on requests or comments on the website or registration for events or conferences.

- Conducting data analysis to improve Alliera's website, products, services, marketing strategy and customer experience.

- Providing content and advertising that may be relevant to the users and measure the effectiveness of the provided advertisement.

If a customer does not want their personal data to be processed for these additional purposes, they can submit a written request to CEMEX or send an email request to the Personal Data Department. For further information, please contact the Personal Data Department.

The refusal to use any personal data for these additional purposes shall not be a reason for us to deny services and products that have been requested or contracted with us.

The processing of personal data will be necessary, appropriate and relevant in relation to the purposes set in this privacy notice, as well as the different purposes that are compatible or similar to them.

5. Processed personal data

To carry out the purposes described in this privacy notice, in addition to the personal data mentioned in Section 11, CEMEX will use the following personal data:

- First and Last Name

- Address

- City

- State

- Email address

- Telephone number

- IP Address

- Company where the customer works

In addition to the above, some personal data may be requested from third parties, we kindly request to obtain the appropriate consent from such third parties before providing any personal information relating to them.

CEMEX does not collect any personal data considered sensitive by law.

6. Personal data of minors

In general, CEMEX does not intentionally collect information from minors because the services and/or products offered are not directed to minors. However, in the event that we do collect, use or store personal information from minors, we will do so with the consent of their parents or guardians. In the event that a minor identifies himself/herself as such, we will seek the consent of his/her parents or guardians before the minor provides any personal data.

The parent or guardian of a minor who has provided personal data without their consent may request the exercise of any of the ARCO rights mentioned in Section 8 of this privacy notice by sending an email to the Personal Data Department.

7. Data transfer to third parties

All personal data is shared within the country and with the persons, companies and organizations mentioned below (as well as in Section 11 of this privacy notice in the case of personal data collected through cookies):

Third-party	Purpose
Element Studios S.C.	Service provider that develops, modifies and improves Alliera's website.
Mediamonks Mexico City, S. de R.L. de C.V.	Provider of digital media management and web advertising.

The aforementioned third parties will have access to the information to carry out the purposes described above and are obligated to not disclose it or use it for any other purposes. CEMEX will disclose this privacy notice and the purposes for which it is used to such third parties, and such third parties will assume the same obligations as CEMEX in relation to the processing of any personal information provided. We are committed to comply with all applicable legal principles regarding the transfer of personal information and that this privacy notice is respected at all times.

In addition to the foregoing, CEMEX may make domestic and/or international transfers of data to holding companies, subsidiaries or affiliates of CEMEX in accordance with the law.

8. Means to exercise the rights of Access, Rectification, Cancellation and Opposition (ARCO Rights) and withdrawal of consent for personal data processing

All customers have the right to know what personal information CEMEX has, what we use it for and the conditions of the use we make of it (Access). Likewise, it is their right to request the correction of their personal information in case it is outdated, inaccurate or incomplete (Rectification); that we remove it from our records or databases when they consider that it is not being used in accordance with the principles, duties and obligations provided in the regulations (Cancellation); as well as to oppose to the use of their personal data for specific purposes (Opposition). These rights are known as ARCO rights.

Likewise, all customers may withdraw their consent, if they have given it for the processing of their personal data before. However, it is important to note that not in all cases we will be able to fulfill such a request or terminate the use immediately, since it is possible that due to a legal obligation we may need to continue processing their personal data. Also, they should consider that for certain purposes, the consent withdrawal will mean that we can no longer provide the service they requested, or the conclusion of their relationship with us.

To exercise any of the ARCO rights, and/or to withdraw consent for personal data processing, a request must be submitted to the Personal Data Department, either at the address specified in Section 3 or through the email address specified therein, containing:

I. Full name, address, telephone number and email address where the response will be sent or informed;

II. if applicable, the full name of a legal representative accompanied by a copy of the public instrument or power by an attorney signed before two witnesses evidencing such legal representation;

III. A copy of an official identification and, if applicable, an identification of a legal representative, such as a voting card issued by the National Electoral Institute (INE by its initials in Spanish), passport or immigration document that proves the foreigner's legal stay in the country;

IV. indicate the right(s) to be exercised and a clear and precise description of the personal data in respect of which the exercise of any of the aforementioned rights is sought, including in the case of requests for rectification the modifications to be made, and

V. any other element or document that supports the request and/or facilitates the location of the personal data.

The exercise of any ARCO right is not a prerequisite nor does it block the exercise of any other right.

In the event that the information provided in the written request is wrong or insufficient, or if the corresponding supporting documents are not provided, CEMEX within five (5) business days following the receipt of the request, may require that the customer provides the necessary elements or documents to process the request. The customer will have ten (10) business days to respond to the request, counting from the day after he/she receives it. If the customer does not respond within this period, the corresponding request will be deemed as if it hasn’t been filed.

CEMEX will notify of its decision within twenty (20) business days counting from the date the request was received, so that, if it is appropriate, the customer may make the request effective within fifteen (15) business days after the response is communicated. The response will be provided electronically to the email address specified in the request.

For more information on the procedure and requirements for the exercise of ARCO rights and/or the withdrawal of consent of personal data processing, all customers may contact our Personal Data Department, which will process the corresponding requests, and will answer any questions regarding information processing.

9. Options and means to exercise the rights to limit data and mechanisms use or disclosure

The use or disclosure of any personal data can be limited at any time, with the understanding that the processing of personal data will be subject to the consent of the owner, apart from the exceptions provided by law.

For more information, please contact our Personal Data Department.

10. Personal information retention period

Any personal information is retained for as long as necessary to provide our services and fulfill the purposes set out in this privacy notice. To determine the appropriate retention period for any personal information we take into account the amount, nature and sensitivity of the personal information, the potential risk from unauthorized use or disclosure of such personal information, the purpose for which we process the personal information and whether we have other alternatives for fulfilling those purposes. After such retention period the personal data will be deleted, unless it is reasonably necessary to retain it to comply with our legal obligations (including requests or orders from any authority), to comply with regulatory requirements, to resolve disputes, for security reasons, to prevent and avoid fraud or other unlawful acts, to comply with additional requests from the customer or to enforce any terms of use of our platforms, policies or other legal documents as applicable.

11. Cookies and online security protocol

"Cookie" is a data file that is stored on a computer hard drive when a user accesses a website. These files may contain information such as the identification provided by the user or information to track the pages that have been visited. A cookie cannot read data or information from the hard drive or read cookies created by other sites or pages.

Please be advised that CEMEX uses cookies and other tracking technologies on our website to collect certain personal information, which we may share with third parties, as shown below:

In addition to the above, other analytical, functional or advertising cookies may be used in order to understand the customer behavior, personalize the experience within the website or measure the effectiveness of our advertising without threatening any personal information.

Please note that third parties (including, for example, advertising networks and external service providers such as web traffic analysis services) may use cookies in which we have no control of. These cookies are likely to be analytical/operational or for advertising purposes.

Cookies can be blocked by activating the browser settings that allows or refuses the storage of certain or all cookies. Additionally, specific cookies can be blocked in all websites by using the links provided in the 'ineligibility' column in the table above and following the instructions shown. For those cookies that do not collect personal data, we will issue such cookies unless the customer has adjusted his/her browser settings to reject cookies. For more information about the use of these technologies please contact the Personal Data Department.

12. Procedure and means to communicate privacy notice changes

This privacy notice may have changes or updates derived from new legal, regulatory or jurisprudential requirements; from our own needs, for the products or services we offer; from our privacy practices; from changes in our business model, internal policies, market practices or for other causes.

We are committed to keep every customer informed about the changes that this privacy notice may have, any changes that are made to it will be incorporated to it by the responsible parties and will be made known through our website https://www.alliera.com/aviso-de-privacidad.

13. External links

The Alliera website may contain links to external websites that can be subject to a different privacy notice. We recommend reviewing the privacy notice of each website. CEMEX is not responsible for the content or privacy practices of websites owned by other companies.

14. Information about The National Institute for Transparency, Access to Information and Personal Data Protection (INAI)

If a customer believes that his/her right to the protection of his/her personal data has been violated by any conduct or omission on our part, or it presumes any violation of the provisions of the Law, he/she may file a complaint to The National Institute for Transparency, Access to Information and Personal Data Protection (INAI). For further information, visit its official website www.inai.org.mx.

Last update: March 31ˢᵗ, 2022.