Privacy Notice

1. Identity and address of the data controller

The Sindicato de Trabajadores de la Industria Metal-Mecánica, Automotriz, Similares y Conexos de la República Mexicana (SITIMM), with its address at Calle V. de las Fuentes, Colonia Moderna, C.P. 36690, Irapuato, Guanajuato, Mexico, is responsible for the processing of the personal data you provide through the 'Yo soy SITIMM' mobile app (iOS and Android) and the sitimm.org website.

For any matter related to this notice or your personal data: soporte@sitimm.org.

2. Personal data we collect

We collect only the data needed for each service. Depending on how you use the app, this may include:

• Identification — First and last name, date of birth, sex, profile photo — When you create an account or complete your profile. • Contact — Email, phone (landline and mobile), home address, city — Sign-up, profile, event registration, consultations. • Official ID and tax data — RFC, CURP, Social Security Number (NSS) — Membership verification and profile. • Employment — Company, position, workplace, seniority — Membership verification; provided by the union's membership roll. • Family — Name and documents of children you register — Only if you enter them (programs and benefits). • Documents — Personal documents you attach — Only if you upload them. • Account — Password (encrypted), linked social accounts (Google, Apple), WhatsApp verification code — Sign-up and sign-in. • Device — Device identifier, model, operating system, app version, language, push notification token — When you open the app and accept notifications. • Usage — Screens visited, actions taken, technical errors — During use; analytics can be turned off in Settings. • Content you provide — Photos for event galleries, comments, messages and attachments in consultations with advisors, messages to the AI assistant — Only when you send them. • Guests without an account — Name, email and phone to register for an event or open a consultation — When you use those forms without an account.

Union membership. Your status as a union member is sensitive personal data. Membership is formalized in person at the union's offices, where you give your express consent; the app does not create or modify it: it only verifies that you appear in the membership roll to give you access to member services. The app processes that data exclusively for the purposes in section 3.

We do not collect geographic location, phone contacts or biometric data. The camera is only used when you open it (profile photo, contributing photos, scanning tickets if you are event staff) and the calendar only if you choose to save an event.

3. Purposes of processing

Primary purposes (necessary for the service; without them we cannot provide it):

1. Create and manage your account, verify that you are a member and show you your profile and employment information. 2. Provide the union's services: consultations and advice with union advisors, event registration and attendance (including the QR-code ticket and transportation support), bulletins, magazines, programs, discounts and galleries. 3. Send you notifications about your account, your consultations, your events and union announcements, if you authorize it on your device. 4. Handle your support requests and those you make as a guest (event registration, consultation). 5. Keep the app secure: authentication, prevention of fraud and unauthorized access, error diagnostics. 6. Comply with the union's legal obligations.

Secondary purposes (not necessary; you may object without affecting the service):

1. Aggregated usage statistics to improve the app (analytics). Turn off in Settings → Usage statistics. 2. Informational notices about new union publications (blog, magazines, discounts) via push notification. Turn off in your phone's notification settings.

If you do not want your data processed for the secondary purposes, in addition to the switches above you can write to soporte@sitimm.org. Refusal will not be grounds for denying you the services.

4. Processors and transfers

We do not sell or hand over your data. SITIMM hosts the app, the database and the files (photos, documents) on its own servers in Mexico. For some features we use providers that process data on SITIMM's behalf and under its instructions (processors), some outside Mexico:

• Google LLC (Firebase) — Push notifications (Cloud Messaging) and usage statistics (Analytics) — Push token, device identifier, usage events, user identifier (Analytics only) — USA. • Google LLC — Sign in with Google — Email and name of your Google account, if you choose that method — USA. • Apple Inc. — Sign in with Apple; notification delivery on iOS — Apple identifier, email (or Apple relay); push token — USA. • Functional Software, Inc. (Sentry) — Error monitoring — Technical crash data; personal data is redacted before sending — USA. • Twilio Inc. — Sending the WhatsApp verification code at sign-up — Phone number — USA. • OpenAI, L.L.C. — 'SitimmVito' AI assistant, through SITIMM's servers — The text of the messages you write to the assistant — USA. • ConfigCat — Remote feature configuration — None (no user identifier) — EU.

Disclosures to processors do not require your consent under the Law. We may also disclose data, without consent, when a competent authority requires it in accordance with the Law or for the exercise and defense of the union's rights.

We do not make transfers to third parties that would require your consent: we do not share your data with affiliated companies, with CEFORMA or with any other organization. If this becomes necessary in the future, we will inform you and request your consent.

5. ARCO rights and withdrawal of consent

You may Access your data, Rectify it if inaccurate, Cancel it when you consider it is not required for the purposes of this notice, and Object to its processing for specific purposes. You may also withdraw the consent you have given us; withdrawal has no retroactive effect and may mean we can no longer provide the service.

How to exercise them:

1. Send an email to soporte@sitimm.org with the subject 'Derechos ARCO'. 2. Include: your full name, a means to reply to you, a copy of an official ID (or of the power of attorney if a representative acts on your behalf), and a clear description of the data and the right you wish to exercise. To rectify, attach the document supporting the correction. 3. We will respond within the period set by the Law from receipt of your request and, where applicable, make it effective within the following legal period. The response will be sent by the means you indicate.

From the app you can directly exercise: access and rectification of your profile data (Profile → Edit) and full cancellation by deleting your account (section 6).

If you believe your data protection rights have been violated, you may turn to the competent data protection authority under the applicable Law.

6. Options to limit the use or disclosure of your data

• Usage statistics (analytics) — Settings → Usage statistics (switch). Signing out deletes the device's analytics identifier. • Push notifications — Your phone's system settings → Notifications → Yo soy SITIMM. Signing out unlinks the device from your account on our servers. • Profile photo, children, documents — Profile → Edit: you can delete them at any time. • Photos contributed to galleries and comments — Galleries are only visible inside the app to signed-in members; they are not published on the website or social networks. To remove a photo or comment, write to soporte@sitimm.org indicating the gallery or post. • Your entire account — Settings → Delete account (requires identity confirmation), or on the web: https://sitimm.org/es/cuenta. You have 30 days to change your mind; afterwards your data is deleted or anonymized (section 8). • Guest without an account — Write to soporte@sitimm.org; your event registration data is deleted automatically 30 days after the event.

7. Device identifiers and similar technologies

The app does not use cookies. It does use:

• Device identifier (Android ID or vendor identifier on iOS) and push notification token, to deliver notifications and recognize your device at sign-in. • Firebase Analytics, which records screens and actions with a user identifier. Turn off in Settings. • Sentry, which receives technical information when the app crashes; personal data is redacted before sending. • Local storage on your phone so the app works offline: it keeps your credentials in the system's secure store and a temporary copy of public content. It does not store your name, RFC, CURP, NSS or phone numbers outside the secure store.

The sitimm.org website uses Google Analytics cookies only if you accept them in the site's banner.

8. Retention and deletion

We keep your data while your account is active and for as long as the union's legal obligations require.

• You delete your account — It is marked for deletion and all your sessions are closed. For 30 days you can restore it by signing in. We send you a confirmation email with the date. • After the 30 days — Data is irreversibly deleted or anonymized: profile (name, RFC, CURP, NSS, phone numbers, address, date of birth, sex), profile photo and photos contributed to galleries (including the files), social accounts, documents, children's data, notification tokens. Your contact data in event registrations and consultations is erased; the text of consultations and comments is kept without an identifiable author. We email you when it completes. • Employment record (company, position) — It belongs to the union's membership roll, not the app: it is unlinked from your account and kept while you remain on the roll, under the processing disclosed when you joined in person. • Guest without an account (event registration) — Name, email and phone are deleted 30 days after the event ends. • Technical errors (Sentry) and statistics (Firebase) — Kept for each provider's applicable period, without identifiable personal data.

9. Minors, security, changes and consent

Minors. The app, event registration and consultations are exclusively for people 18 or older. We do not knowingly collect data from minors; the children's data a member registers is provided by the father, mother or guardian under their responsibility and only for the programs and benefits that require it. If we detect an account or registration belonging to a minor, we will delete it.

Security. We apply administrative, technical and physical measures: encryption in transit (HTTPS), credentials in the device's secure store, expiring sessions, identity verification for sensitive actions (account deletion), role-based access control on the servers, and redaction of personal data in error logs.

Changes to this notice. We may update it due to legal changes or changes in the services or providers. The current version will always be at https://sitimm.org/es/aviso-de-privacidad with its date; relevant changes will be announced in the app. This notice is published in Spanish and other languages for your convenience; in case of discrepancy, the Spanish version prevails.

Consent. By creating your account, registering for an event or opening a consultation, you declare that you have read this notice and consent to the processing described. Express consent for the processing of your union membership is given when you join in person at the union's offices; for the secondary purposes, through the switches described in section 6.