Comprehensive privacy notice

This is an English translation provided for reference. The legally binding version is the Spanish-language privacy notice (aviso de privacidad). In the event of any discrepancy, the Spanish version prevails.

1. Identity and address of the data controller

Himexko Ingeniería y Ejecución, S.A. de C.V. ("HIE"), Mexican Taxpayer ID (RFC) HIE240325GU1, with its address at Calle José Martí No. 3507, Colonia Francisco I. Madero, Postal Code 64560, Monterrey, Nuevo León, Mexico, is the data controller responsible for processing the personal data it collects through its website, forms, WhatsApp, email, telephone and other customer service channels.

Processing is governed by Article 16, second paragraph, of the Political Constitution of the United Mexican States and by the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP"), enacted on March 20, 2025, as currently in force. In particular, HIE will observe the principles of lawfulness, purpose, loyalty, consent, quality, proportionality, information and accountability set forth in Articles 5 to 15 of that law.

This notice is addressed to individuals who contact HIE as prospects, customers, representatives, company contacts or service requesters. If HIE processes data in connection with employment relationships, recruitment processes or other activities, such processing may be subject to specific notices.

2. Personal data we collect

Depending on the nature of the request or the business relationship, HIE may collect the following categories of information:

• Identification and contact. Name, company, job title, city, preferred language, telephone numbers, WhatsApp number and email address.
• Project and service information. Location of the property or facility, dimensions, technical specifications, storage requirements, drawings, photographs, documents provided and dates related to installation, inspection or maintenance.
• Communications and follow-up. Messages, attachments, WhatsApp profile name, requests, quotes, contracts, service history and sales or service follow-up.
• Tax and billing data. Where applicable, name, RFC (taxpayer ID), address and tax regime, certificates and the information needed to formalize transactions or issue tax invoices (CFDI).
• Browsing data. When measurement or advertising technologies are enabled on the website, online identifiers, IP address, pages viewed, device, browser, approximate location and source of the visit may be processed.

HIE does not request sensitive personal data for the purposes described. Please do not send information of that nature or third-party data that is not strictly necessary. If sensitive data is received without having been requested, HIE will review whether there is a legal basis for processing it and will delete it when there is no basis to retain it. If any transaction were to require financial, asset-related or sensitive data, you will be informed specifically and the consent required under Articles 7 and 8 of the LFPDPPP will be requested, subject to the applicable legal exceptions.

3. Purposes of processing

3.1. Primary or necessary purposes

1. To handle and respond to inquiries, requests for information and requirements received through HIE's contact channels.
2. To analyze technical needs and prepare assessments, proposals, budgets and quotes.
3. To manage the contracting and provision of design, manufacturing, installation, inspection, maintenance and after-sales services.
4. To record contact information and conversations in the customer relationship management (CRM) system in order to manage prospects, requests, projects and the related business relationship.
5. To follow up on requests and projects, including reminders of appointments, progress, installation, inspection, maintenance or subsequent support directly related to the requested service, through staff or automation tools.
6. To comply with contractual, administrative, accounting and tax obligations, including invoicing and responding to lawful requests.

3.2. Secondary or optional purposes

7. To send HIE news, commercial information, campaigns or promotions by email or WhatsApp.
8. To request feedback or conduct satisfaction and quality surveys to evaluate and improve our services.

Secondary purposes are not required in order to receive support or contract services. Data subjects may object to them at the time their data is collected or at any later time by sending an email to ventas@hie.com.mx with the subject line "Negativa a finalidades secundarias" (Objection to secondary purposes). HIE will process the request and stop using the information for these purposes, without affecting the necessary purposes and applicable legal obligations. Where processing requires express consent, such consent must be obtained by a means that allows it to be evidenced.

Legal basis: LFPDPPP, Articles 5, 7, 9, 11, 12 and 15 (principles, consent, purposes and information).

4. WhatsApp support and use of artificial intelligence

When a person contacts HIE through WhatsApp, HIE may provide initial support through an automated assistant that uses artificial intelligence. This tool helps answer general questions, identifies the preferred language and requests the information needed to understand the project. Conversations and files provided may be recorded in HIE's CRM.

The information collected may be reviewed by authorized HIE staff. Proposals, prices, commercial terms and contractual commitments are reviewed or confirmed by a person: the assistant does not set them on its own. Data subjects may request to speak with a person at any time through the same channel or at ventas@hie.com.mx. The automated processing described is not intended to make decisions that produce legal effects on the data subject without human intervention.

Legal basis: LFPDPPP, Articles 5, 12, 14 and 26, section II (proportionality, information and objection to certain automated processing).

5. Processors, technology providers and data transfers

To operate its channels and systems, HIE uses technology providers, including Meta Platforms (WhatsApp Business), HubSpot (CRM), n8n (automation), Anthropic (artificial intelligence services), GoDaddy (domain and email), Cloudflare (web infrastructure services) and Google (analytics and advertising tools, when active). Data submitted through the website forms is processed through n8n and recorded in HubSpot's CRM.

Depending on the service contracted, some providers may act as processors (personas encargadas) that handle data on behalf of and according to HIE's instructions; others may carry out independent processing subject to their own terms. Disclosure to a processor does not, in itself, constitute a transfer to a third party within the meaning of Article 2, sections XII and XX, of the LFPDPPP. Some services may involve storage or processing outside Mexico. The relationship with providers acting as processors must include the contractual, administrative and technical obligations needed to protect the information.

HIE does not sell personal data. With respect to the purposes described, no transfers to third parties for their own commercial purposes are contemplated. Disclosures required by a competent authority or permitted by law may be made, including a transfer necessary under a contract entered into or to be entered into in the interest of the data subject, where applicable under Article 36 of the LFPDPPP. If HIE intends to carry out a different transfer that requires consent, it will first identify the recipient and the purpose, provide the corresponding notice and enable a mechanism to accept or reject that transfer, in accordance with Article 35 of the LFPDPPP.

The use of WhatsApp may also involve independent processing of account information by Meta, in accordance with the terms and privacy notices applicable to that service.

Legal basis: LFPDPPP, Article 2, sections XII and XX; Articles 35 and 36 (processors and transfers).

6. Cookies and tracking technologies

The HIE website may use cookies and other technologies to provide technical functions, measure browsing and, when active, evaluate or personalize advertising campaigns. Tools that may be used include Google Analytics, Google Ads and the Meta Pixel, depending on whether they are actually enabled. Depending on the configuration, these technologies may collect IP addresses, browser identifiers, pages visited, device data, approximate location and source of the visit.

Users can configure, restrict or delete cookies through their browser settings and, when available, use the website's privacy preferences mechanism. Blocking technical cookies may limit some features. Before enabling measurement or advertising tools that collect personal data, HIE must disclose the corresponding information and provide the applicable means to control their use. Third-party platforms may apply their own privacy notices and controls.

Legal basis: LFPDPPP, Articles 5, 12, and 14 to 16 (information, proportionality and making the notice available).

7. Retention periods and deletion

HIE will retain personal data for the period necessary to fulfill the purpose for which it was obtained and, where applicable, for the limitation or retention periods established by applicable law. Data related to prospects, quotes and follow-up will not be retained indefinitely merely because it has been entered into the CRM.

Specific obligations that may apply include the retention of accounting information and tax documentation under Article 30 of the Federal Tax Code (Código Fiscal de la Federación) and, for original documents recording contracts, agreements or commitments that give rise to rights and obligations, the minimum period set forth in Article 49 of the Commercial Code (Código de Comercio).

Once the purpose for which the data was collected has been fulfilled and the required periods have expired, the data will be blocked and subsequently deleted when legally appropriate; where applicable, an irreversible de-identification procedure may be used. The legal retention of certain documents does not authorize keeping all communications or prospects recorded in the CRM indefinitely.

Legal basis: LFPDPPP, Articles 10, 12, 24 and 25; Federal Tax Code, Article 30; Commercial Code, Article 49.

8. Security and confidentiality

HIE applies reasonable administrative, technical and physical measures to protect personal data against damage, loss, alteration, destruction, and unauthorized use or access. These include credential-protected access to systems, restricting access to staff who need the information to perform their duties, and security controls related to contracted providers.

If a security breach occurs that significantly affects the economic or moral rights of data subjects, HIE will notify them immediately under the terms of Article 19 of the LFPDPPP, so that they can take appropriate measures.

Legal basis: LFPDPPP, Articles 18 to 20 (security, notification of significant breaches and confidentiality).

9. ARCO rights, withdrawal of consent and limitation of use

Data subjects or their legal representatives may exercise the rights of access, rectification, cancellation and objection (known in Mexico as ARCO rights). They may also request the withdrawal of their consent or the limitation of the use or disclosure of their data, where legally applicable.

To submit a request, send an email to ventas@hie.com.mx, addressed to In Young Choi, the person designated to handle personal data matters, including the following information:

1. Name and a means of contact for receiving notifications.
2. Documents proving the identity of the data subject or, where applicable, of their legal representative.
3. A description of the right to be exercised and the personal data involved, unless general access is requested.
4. Any additional information that helps locate the data; for rectification requests, the requested corrections and supporting documentation.

HIE will communicate its decision within a maximum of 20 business days from receipt of the request. If the request is granted, HIE will carry it out within 15 business days following the communication of its response. These periods may be extended once for an equal period when justified by the circumstances. Exercising ARCO rights is free of charge, without prejudice to reproduction or shipping costs permitted by law.

Withdrawal of consent does not have retroactive effect and does not prevent processing based on a legal obligation or a legal relationship. To withdraw consent or limit the use or disclosure of data, data subjects may write to ventas@hie.com.mx, clearly identifying the processing or disclosure they wish to stop. A response will be sent through the contact method indicated in the request, within the legal time limits applicable to the right exercised.

Legal basis: LFPDPPP, Article 7 and Articles 21 to 34 (withdrawal of consent, ARCO rights and procedure).

10. Competent authority

If data subjects believe that their right to personal data protection has been violated, they may file a complaint with the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), within its powers as the competent authority for the protection of personal data held by private parties.

11. Changes to this privacy notice

The current version will be available at https://hie.com.mx/aviso-de-privacidad/ (Spanish) and its English translation at https://hie.com.mx/en/aviso-de-privacidad/. When HIE adds new purposes or transfers that require consent, it will inform data subjects and request the corresponding consent in advance, in accordance with Articles 7, 11 and 15 of the LFPDPPP. Significant changes may also be communicated through the available contact channels.