Privacy Notice for Customers

At PENSKE, we are committed to safeguarding the privacy of your personal data. This notice applies to Penske Logística, S.A. de C.V., Penske Servicios de Administración, S.A. de C.V., and Penske Truck Arrendadora de Mexico, S.A. de C.V. (hereinafter, “Penske”). In accordance with Article 16, Section II of the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), we inform you that Penske will process the personal data collected from you under the terms of this Privacy Notice:

Address

For the purposes of this Privacy Notice, Penske designates the following address: Antonio Dovali Jaime No. 70, 3rd Floor, Santa Fe, Álvaro Obregón, C.P. 01210, Mexico City.

Personal Data That May Be Collected and Processed

The personal data that you provide to Penske will be processed exclusively for the purposes described in this Privacy Notice and will be handled confidentially and solely for the purpose for which it was collected.

The personal data that may be collected under this Privacy Notice includes: Full name, full address, tax address, telephone number, email address, nationality, country of residence, marital status, telephone (mobile and landline), address and official identification of the purchasing manager and commercial director, name, corporate name, business name, address, and phone number of main commercial contacts, RFC (Tax ID), CURP, tax registration form, attorney who reviewed the contract, data of the person advised, and the following financial or asset-related data: main banking institutions where you hold accounts, branches, account numbers, bank loans, CLABE account numbers, and amounts.

Regarding the sensitive personal data mentioned above, Penske commits to processing such data only when necessary for the stated purposes and to handling it under adequate security measures to ensure confidentiality.

Purpose of Processing Your Personal Data

We inform you that Penske may transfer your personal data to other companies within the group. Penske may use your personal data for the following purposes:

Primary Purpose: To evaluate the possibility of Penske providing its services.

ARCO Rights

As of January 6, 2012, you have the right to: (i) Access your personal data held by us and know the details of their processing; (ii) Rectify them if they are inaccurate or incomplete; (iii) Cancel them when you believe they are not required for any of the purposes stated in this Privacy Notice, are being used for non-consented purposes, or when the contractual or service relationship has ended; (iv) Object to their processing for specific purposes as permitted by law. (Collectively, the “ARCO Rights”.)

Penske has designated a Personal Data Officer (the “Privacy Officer”). You may limit the use or disclosure of your personal data by sending a communication to the Privacy Officer at the following email address: oficialdeprivacidad@penske.com (the “Contact Address”). The Privacy Officer will respond to your ARCO Rights Request and provide the reasons for the decision via certified mail (additional cost) or in person at the corporate offices within a maximum term of 20 business days from the date your request is received. Your request must include all requirements set out in Article 29 of the Federal Law on the Protection of Personal Data Held by Private Parties.

Penske may deny access (“Denial”) to your ARCO Rights in the following cases:

• When you are not the owner of the personal data or cannot prove representation;
• When your personal data is not found in Penske’s database;
• When the rights of a third party may be harmed;
• When there is a legal impediment or resolution restricting your ARCO Rights;
• When rectification, cancellation, or objection has been previously performed.

Requirements To Exercise ARCO Rights

• Your name and full address (street, interior/exterior number, neighborhood, postal code, city, and state) using the “ARCO Rights Request” form;
• Documents proving your identity (copy of valid voter ID, passport, professional license, or immigration document) or, if applicable, documents proving legal representation;
• A clear and precise description of the personal data regarding which you seek to exercise any ARCO Rights;
• Any document or information that facilitates the location of your personal data;
• If requesting rectification, the modifications to be made and supporting documentation (birth certificate, proof of address, IMSS pre-affiliation document for NSS corrections, etc.).

Revocation of Consent

Notification of Changes to the Privacy Notice