At PENSKE we are committed to safeguarding the privacy of your personal data, this notice applies to Penske Logística, S.A. de C.V., Penske Servicios de Administración, S.A. de C.V., and Penske Truck Arrendadora de Mexico, S.A. de C.V. (hereinafter “Penske”), accordingly and in agreement with the provisions of Article 16, section II of the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), we inform you that "Penske" will treat personal data obtained from You under the terms of this Privacy Notice:

Address

For the effects of this Privacy Notice, “Penske” designates as its address the one located at Antonio Dovali Jaime No. 70 3er. piso, Santa Fe, Delegación Álvaro Obregón, México City., CP. 01210.

Personal Data That May Be Collected and Treated

The personal data You provide to "Penske" will be used exclusively for the purpose described in this privacy notice and will be treated confidentially and exclusively for the purpose they had been collected.

In order to achieve the purposes set out in this privacy notice, the following personal data must be treated: full name, complete address, business address, telephone number, email address, nationality, country of residence, marital status, user name in social networks (Facebook, Twitter or LinkedIn) name, telephone number (mobile and fixed line), domicile and official identification of the sales manager and commercial director, name, business name, company name, domicile and telephone number of major clients and contacts, letter of introduction, Federal Taxpayer's Registry Number (RFC), Unique Population Registry Code (CURP), Tax Administration Service registration format (R1 or R2), service or activity of the company where you work, the level at which you supply (local, regional or national), if case of being local, the cities covered, details of the product or service you provide and main commercial terms, the attorney who reviewed the contract, data of the advised person, and; the following financial or economic data: major credit institutions where you have bank accounts, branch offices, account numbers, bank loans, account numbers, Standardized Banking Code (CLABE) account numbers and amounts.

Regarding sensitive personal data mentioned in the preceding paragraph, "Penske" will be obliged to a treatment that will be the one absolutely necessary for said purposes and to treat them under appropriate security measures to protect confidentiality.

Purpose of the Treatment of Your Personal Data

"Penske" will treat the personal data gathered from You with the following purposes:

  1. Main Purposes: Those necessary for the legal relationship with "Penske":
    1. Assess you and, if appropriate, hire you in the future as a supplier, and:
    2. Keep control of the suppliers hired and of their services for their subsequent registration and management in the system.
  2. Secondary purposes
    1. Transfer your personal data to the companies of the group or Penske affiliates.

"ARCO" Rights

In like manner, since January 6, 2012, you have the right to: (I) access your personal data in our possession and know the details of the treatment thereof, (ii) rectify them if inaccurate or incomplete, (iii) cancel them when you consider that they are not required for any of the purposes mentioned in this privacy notice, that they are being used for purposes not agreed upon or that the contractual or service relationship has ended, or (iv) oppose their treatment for specific purposes, as set forth by the law, (collectively, the "ARCO Rights")."Penske" has appointed a personal information manager (the "Privacy Officer"), therefore You can limit the use or disclosure of your personal data by means of a notice addressed to the Privacy Officer at the following email: oficialdeprivacidad@penske.com (the “Contact Address”). The Privacy Officer will respond to your Request of Exercising ARCO Rights and the reasons for his/her decision by certified mail (extra cost) or in person at the corporate offices within a maximum period of 20 business days from the day of receipt of your request to Exercising ARCO Rights. For your request to be processed, it must fulfill each and every requirement set forth in Article 29 of the Federal Law on Protection of Personal Data Held by Private Parties.

"Penske" may deny access (the "Refusal") for you to exercise your ARCO Rights in the following cases:

  1. When You are not the owner of the personal data, or if you cannot prove having the representation of the holder;
  2. When your personal data are not contained in the "Penske" database.
  3. When the rights of a third party may be damaged.
  4. When there is a legal impediment or a judgment from a competent authority, restricting your ARCO Rights.
  5. When the rectification, cancellation or opposition had been previously made.

The exercise of ARCO Rights will be free of charge, but if you reiterate your request within twelve months, the costs will be three days of General Minimum Wage in the Federal District, plus V.A.T., unless there are substantial changes to the Privacy Notice that encourage new Requests to exercise ARCO Rights. You must cover the justified costs of shipping or the cost of reproduction in copies or other formats.

Requirements To Exercise "ARCO" Rights

To exercise the ARCO rights according to what is mentioned in the previous paragraph, the application must contain:

  1. Your name, complete address (Street, inside and/or outside number, neighborhood, postal code, city and state) in accordance to the format "Request to Exercise ARCO Rights" in order to communicate the response to the ARCO Request;
  2. Documents proving your identity (copy of Voting Card [IFE], passport, professional license or immigration document) or, where applicable, documents proving your legal representation (copy of Voting Card [IFE], passport, professional license or immigration document);
  3. A clear and precise description of personal data for which you are seeking to exercise any of the ARCO Rights, and;
  4. Any document or information that facilitates the location of your personal data;
  5. If you request correction of data, you must also indicate the modifications to be made and provide documentation supporting your request (birth certificate, proof of address, pre-affiliation document issued by the Mexican Social Security Institute [IMSS] in case of requesting changes to Social Security Number [NSS], etc.).

Revocation of Consent

The holder may arrange at any time the revocation of his/her consent to the treatment of personal data (free of charge), the application is to be found on "Penske" website or requesting this document at any "Penske" branch office. The request may be submitted by digital means or hard copy when there is a legitimate cause and your specific situation requires so, or else when you do not want your personal data to be treated for specific purposes. The exercise of the right of opposition will not be admissible when the treatment is necessary for compliance with a legal obligation imposed upon "Penske".

The exercise of any of the "ARCO" rights and the Revocation of personal data may be restricted for reasons of national security, public order provisions, public security or public health or to protect the rights of third parties, in the cases and with the scope foreseen by the applicable laws in the matter, or else by resolution of the competent authority duly founded and motivated.

Notification of Changes to the Privacy Notice

Penske reserves the right to amend this Privacy Policy in the future in order to meet legislative updates, case-law, internal policies, new requirements issued by the authority. Any amendment to this notice will be notified by e-mail, publication or notice at the Penske subsidiaries and in the section of our privacy policy available on the following website: https://www.pensketruckleasing.com/northamerica/mexico/

This Privacy Notice complies with the requirements of the Federal Law on Protection of Personal Data Held by Private Parties in force.

Date of last revision: February, 2026