PRIVACY NOTICES

Comprehensive Privacy Notice - AMERICAN EXPRESS BANK (MEXICO), S.A. INSTITUCIÓN DE BANCA MÚLTIPLE

Your privacy and trust are very important to American Express Bank (Mexico), S.A., Institución de Banca Múltiple (hereinafter, the "Society"). Therefore, we want to ensure that you are aware of how we safeguard the integrity, privacy, and protection of your personal data, in compliance with the Federal Law for the Protection of Personal Data in Possession of Private Parties (hereinafter, the "Law"), and its Regulations.

It is necessary for the Society to collect certain personal data in order to carry out the activities intrinsic to its business and commercial activities. The Society has the legal and social obligation to comply with sufficient legal and security measures to protect the personal data it has collected for the purposes described in this Privacy Notice.

All of the above is done with the objective that you have full control and decision over your personal data. We therefore recommend that you read the following information carefully.

1. Details of the Person in Charge

The Society is a Credit Institution duly incorporated under the laws of the United Mexican States with registered office at Avenida Patriotismo 635, Colonia Ciudad de los Deportes, Alcaldía Benito Juárez, C.P. 03710, Mexico City, Mexico.

2. Personal Data

For the proper provision of our services and to comply with the purposes set out in this Privacy Notice, the Society will collect and process your personal identification data, including your personal image (photograph), contact, authentication, biometric, employment, geographical coordinates of latitude and longitude in which optical and/or electronic devices used for the application and contracting of the Society's products and services are located ("geolocation"), estate and/or financial data, as well as health data, information regarding behaviours that you have performed and have a direct relationship with the detection and care of COVID 19 and/or any other disease that is classified as an emergency and/or health contingency by the competent authorities, including the taking of your temperature (hereinafter, the "Personal Data"), in accordance with the provisions herein.

Likewise, the Society will collect identification, and contact details of the persons You have designated as references. By providing this data You acknowledge having the consent of such persons to the processing of their data for contact and/or collection purposes, as well as to perform validations with respect to the information provided.

Finally, the Society may collect the personal identification and contact details of the persons that You have designated as additional third parties to the services. By providing this data, You acknowledge having the consent of such persons for their personal data to be processed for the purposes set out in this Privacy Notice.

3. Primary and Secondary Purposes of Data Processing

The Society will process your Personal Data solely and exclusively in accordance with the terms of this Privacy Notice.

The Personal Data You have provided to us will be used for the following primary purposes, which are necessary and which give rise to the contractual relationship between the Society, in its capacity as the responsible entity, and You as the owner of the Personal Data:

(i) performance of all activities related to the operation of Credit Cards (the "Cards"), including: the processing of requests and the administration, issuance, delivery and activation of the Cards; collection activities, including the sending of communications via email, telephone calls, instant messaging services, short messages and other physical and/or electronic means of communication; clarification, investigation and billing of charges related to the Cards; conducting periodic research and monitoring of your credit behaviour; making home visits

for data validation, Card delivery and/or requests management; creating consumption profiles, spending averages and enrolments, accumulation of points, redemptions and administration of our own and third party loyalty programmes. As part of the processing of requests and, where appropriate, for the fulfilment of the legal relationship arising from such requests, the Society, including the suppliers that provide services for such purposes, will process your Personal Data in order to: carry out risk analysis and credit viability and monitoring, as well as statistical analysis and generation of information models and/or current and predictive behavioural profiles;

(ii) performance of all activities related to the operation of traditional deposit products, such as cheque books, deposit accounts, as well as the issuance of debit and/or prepaid Cards, including; the processing of requests and the administration, collection, clarification and research activities related to such products as well as, in relation to such products, the sending of commercial communications through e-mails, telephone calls, SMS messages and other electronic or physical means of communication that may be appropriate and relevant to fulfil the present purpose;

(iii) generate authentication data in order, on the one hand, to create an access profile to electronic systems in order to provide you with personalised attention and, on the other hand, to accredit your identity when using electronic and/or automated equipment or systems for the provision of our services; if you are in our facilities, to maintain access control and maintenance of programmes to guarantee the security and protection of customers, employees, visitors and suppliers by means of electronic, optical or any other technology devices and means;

(iv) prove your identity in accordance with the Society's internal procedures, including requesting credit information from you in order to collate and/or validate such information, or even demographic information, such as your address, with the credit bureau of our choice;

(v) attend to and follow up on investigations and reviews of complaints and/or claims related to the detection, prevention and mitigation of conducts that may contravene the provisions of the applicable regulations and/or our service contract;

(vi) monitoring activities for the purposes of maintaining the security of our technological infrastructure and detection of possible fraudulent activities, failures and/or errors;

(vii) produce statistical and financial reports for your company or your partner company to enable it to develop and maintain procedures and policies;

(viii) creation and implementation of analytical and statistical processes necessary for the provision of services;

(ix) performance of any complementary or ancillary activities necessary for the provision of the services;

(x) provision of services related to the offering, promotion, sale, marketing and/or advice of insurance products operated by insurance companies;

(xi) make enquiries, surveys, investigations, and reviews related to your complaints or grievances;

(xii) contact you with any questions regarding the services or this Privacy Notice;

(xiii) perform obligations arising out of any legal relationship between the Society and you for the provision of the services;

(xiv) evaluate the quality of services through surveys;

(xv) carry out dissociation procedures. The purpose of such procedures is to use the dissociated information for statistical and behavioural modelling purposes;

(xvi) the origination, operation, management, processing, and administration of the products and/or services contracted with the Society, the latter being empowered to: (i) perform verification/validation of

the personal data provided, including the veracity of such data, directly with governmental authorities and/or against databases and (ii) in case of discrepancy, carry out any rectifications or corrections that may be necessary to keep your information up to date and correct;

(xvii) make recordings of calls held by the Society for the purpose of assessing the quality of service and/or answering queries;

(xviii) for the purposes of internal or external audits, as well as to comply with collaboration obligations and/or information requirements formulated by the competent governmental authorities, when it is necessary to safeguard the public interest, the procurement or administration of justice and/or in terms of current and applicable legislation;

(xix) to compile files and databases, and to process them, either directly by the Society or through third parties or suppliers necessary for the Society to provide the financial services inherent to its purpose and to report such information to the administrative and jurisdictional authorities when so required by the legal provisions in force;

(xx) use them in cases of merger, spin-off or acquisition of the Society including its subsidiaries and/or affiliates, as well as for assignment or discounting of the loan portfolio, endorsement, or any other form of negotiation of the loan portfolio even before its maturity;

(xxi) sending by the Society of all kinds of notices, notifications, communications, service surveys and additional information related to the products and services contracted and monitoring by means of telephone calls, e-mails, text messages and/or any other means of contact, regarding any activity that is directly or indirectly related to the products and/or services offered by the Society;

(xxii) determine, manage, and use as a test mechanism the information related to the "geolocation" of the optical and/or electronic devices used in the request and contracting of the Society's products and services;

(xxiii) for compliance with applicable laws, regulations, and legal provisions;

(xxiv) inform and/or provide to the competent authorities any Personal Data, including sensitive Personal Data, that it may require in the event of a health and/or any other emergency; and

(xxv) for compliance with applicable laws, regulations, and legal provisions.

(xxvi) in the case of photographs revealing their identity, to be included in their file as a measure to prevent and/or mitigate identity fraud;

(xxvii) comply with obligations to cooperate with competent authorities in terms of applicable laws;

(xxviii) carry out processes of verification, comparison, and consultation of third party, public and/or private databases for the purpose of keeping in contact with you for any matter related to the Cards.

In addition, if You do not state otherwise, the Society will process Your Personal Data for the following secondary purposes: to make promotions, offers and advertising regarding the Society's products and services, including the offer of Cards or any other products issued under the American Express brand; products, promotions and benefits associated with passive operations, investment products, as well as the offers we make with commercial establishments that accept American Express Cards as a means of payment through electronic, telephonic and printed means; and the offering, promotion, sale, marketing and/or advice of insurance products operated by insurance companies made by any of the following: (a) directly by insurance companies; (b) through the intervention of the Society or any of its subsidiaries or affiliates which are similarly empowered by law to intervene in the sale of such products; or (c) through any other intermediary with whom the Society has duly entered into commercial agreements.

Your personal data may also be processed to recognise interests, actions, and connections during the use of our applications and/or browsing on our webpages in order to select and personalise advertisements, offers and other advertising content.

If You do not want Your Personal Data to be processed for the aforementioned secondary purposes, please call the Personal Data Department.

4. Transfer of Personal Data

In order to comply with the obligations arising from the legal relationship with You, as well as those purposes set out in this Privacy Notice, the Society may transfer Your Personal Data to third parties, whether Mexican or foreign ones, without the need to obtain Your consent, when the transfer is to

(a) Those societies that are part of the American Express economic group, including: our holding company, as well as subsidiaries and affiliates of the Society for the provision of the service contracted with You. We inform You that this transfer does not require Your consent in accordance with the regulations because the companies of the Group operate under the same processes and policies of respect for privacy.

(b) The insurance companies AXA Seguros, S.A. de C.V., Chubb Seguros Mexico, S.A., and Zurich Vida, Compañía de Seguros S.A., if You acquire insurance products from such insurance companies through the intervention of the Society or any of its subsidiaries or affiliates that are also empowered by law to intervene in the sale of such products.

(c) Bupa México, Compañía de Seguros, S.A. de C.V., with whom the Society has duly formalised commercial agreements so that, directly, said insurer offers, promotes, sells, markets and/or provides advice on the insurance products it operates.

(d) Payback México, S. de R.L. de C.V. and Priority Pass, Inc. for your enrolment in the loyalty programmes operated by such companies and offered as part of the benefits of the Card, including the preparation of analytical and/or statistical reports related to these companies and programmes (you may consult the privacy notice of each of these companies at the following e-mail addresses www.payback.mx/aviso-de-privacidad and www.prioritypass.com/ES/Proteccion-de-datos.cfm, respectively.

(e) Third parties with whom the Society formalises or intends to formalise agreements related to the assignment, credit portfolio discount, endorsement, or any other form of transfer of the rights and/or obligations arising from the legal relationship it maintains with us, including, without limitation, the information of Supplementary Cardholders.

(f) Competent authorities, in particular tax and banking authorities, in the cases legally foreseen for the purposes required by the applicable laws.

(g) Governmental authorities and agencies, including but not limited to: (i) in health matters for registration, monitoring and prevention of contagion, diagnosis, or medical treatment or for the management of health services for contagious diseases, (ii) tax authorities, for the validation/verification of your tax information, RFC, identification and contact details, (iii) financial, in relation to the products and services contracted with the Society, among others, as well as for any other purpose provided for in the current and applicable legislation. In addition, Personal Information that is not subject to secrecy provisions may be transferred to insurers and/or other business partners and/or providers of additional services and/or products linked to the products and/or services contracted with the Society, if applicable.

The Society undertakes to ensure compliance with all legal principles of protection regarding the transfer of your Personal Data. It is also committed to ensuring that this Privacy Notice is always respected by us and by our business partners.

5. Limiting the Use or Disclosure of Personal Data

You may limit the use or disclosure of your data in order to stop receiving promotions, offers and advertising regarding the Society's products and services by calling the Personal Data Department. If your request is successful, the Society will register you on its own opt-out list so that you will no longer receive promotions from us.

6. Means of Exercising ARCO Rights and/or Revoking Consent

In accordance with the provisions of the Law and its Regulations, the holder of the Personal Data, by themselves or through a legal representative, who must identify themselves or be properly accredited, may exercise their rights of access, rectification, cancellation and opposition ("ARCO Rights"), as well as revoke their consent directly by calling the telephone numbers of the Personal Data Department, clearly and precisely describing the personal data for which they are seeking to exercise any of the ARCO Rights.

It is important to mention that in the call to exercise ARCO Rights you must provide an email address and/or telephone number so that we can notify you of the response to your request or contact you in case we require additional information in relation to your request. Likewise, you must send us a copy of your official identification in order to prove your identity.

Finally, we inform You that the determination adopted will be notified to You within a maximum period of 20 (twenty) working days, counted from the date on which You comply with all the requirements established in the request for access, rectification, cancellation, or opposition, so that, if it is appropriate, it becomes effective within 15 (fifteen) working days following the date of said notification.

7. Changes to the Privacy Notice

Any substantial or total change to this Privacy Notice may be made by the Society and will be communicated by publication in a newspaper of wide circulation, through our web page www.americanexpress.com.mx, or by e-mail to the address of the holder that the Society maintains on record for such purposes.

8. Personal Data Department

Telephone numbers:

8008392871

5551693283

Opening hours: Monday to Friday, from 9:00 A.M. to 6:00 P.M.

9. Use of Cookies

The different Internet sites and online services of the Company rely on the use of Cookies and/or Web Beacons that allow the Society to automatically collect personal data. By accessing and continuing to use the Website, You consent to the collection and processing of Your personal data by the Society. The use of these technologies is necessary for operational, technical and security reasons. For more information, please refer to the Terms and Conditions.

In accordance with the provisions of the Law and its Regulations, (i) I acknowledge that I have read and understood the content and scope of this Privacy Notice; (ii) I expressly authorise the Society to collect and process my Personal Data, including sensitive data, for those purposes for which my consent is required, as informed in this Privacy Notice; and (iii) I expressly authorise the Society to carry out those transfers of personal data that are subject to my consent.

Comprehensive Privacy Notice - American Express Company (Mexico), S.A. de C.V.

Your privacy and trust are very important to American Express Company (Mexico), S.A. de C.V. (hereinafter referred to as "American Express Company Mexico"). Therefore, we want to ensure that you know how we protect and safeguard the integrity and privacy of your personal data, in accordance with the Federal Law for the Protection of Personal Data in Possession of Individuals (hereinafter, the "Law") and its Regulations.

For American Express Company Mexico it is necessary to collect certain personal data to carry out the activities intrinsic to its commercial and mercantile business; likewise, American Express Company Mexico has the obligation to comply with sufficient legal and security measures to protect the personal data it has collected for the purposes described in this Privacy Notice.

All of the above is done so that you have full control, knowledge and decision over your personal data and its processing. We therefore recommend that you read the following information carefully.

1. Details of the Person in Charge

American Express Company Mexico is a society incorporated under the laws of the United Mexican States with registered office at Avenida Patriotismo 635, Colonia Ciudad de los Deportes, Alcaldía Benito Juárez, C.P. 03710, Mexico City, Mexico.

2. Personal Data to Be Processed

For the proper provision of our services and to comply with the purposes stated in this Privacy Notice, American Express Company Mexico will collect and process the following personal data:

• Personal identification data, including your personal image (photograph)
• Personal contact details
• Authentication data
• Biometric data
• Financial and/or property data
• Employment data
• Location data
• Geographical coordinates of latitude and longitude where the optical and/or electronic devices used for the application and contracting of American Express Company Mexico products and services are located ("geolocation").

The personal data you provide to us will be processed only for the purposes set forth in this Privacy Notice with all applicable security and confidentiality measures.

In addition, American Express Company Mexico will collect identification and contact details of the persons you have designated as references. It is important to mention that, by providing this data, you acknowledge that you have the consent of such persons to the processing of their data for contact and/or collection purposes, as well as to perform validations with respect to the information provided.

Finally, American Express Company Mexico may collect the personal identification and contact details of the persons you have designated as Additional or Supplementary Cardholders, as well as of the persons who are the direct or final beneficiaries of the services contracted with American Express Company Mexico and/or of the products in which the latter acts as an intermediary in their sale. By providing this data, you acknowledge that you have the consent of such persons for their personal data to be processed for the purposes indicated in this Privacy Notice.

3. Sensitive Personal Data that Will Be Processed

American Express Company Mexico may collect sensitive personal data, such as health data, including, but not limited to, information regarding conducts you have performed and/or which are directly related to the detection and care of any disease that is classified as a health emergency and/or health contingency by the competent authorities, with the strictest security and confidentiality measures in accordance with the provisions of this Privacy Notice.

4. Primary Purposes of Data Processing

American Express Company Mexico will process your personal data solely and exclusively in accordance with the terms of this Privacy Notice.

The personal data that you have provided to us will be used for the following primary purposes, which are necessary and which give rise to the contractual relationship between American Express Company Mexico, in its capacity as Data Controller, and You as the Data Subject:

a) Conduct activities related to the operation of the service and/or credit cards you contract with American Express Company Mexico, as well as the services and benefits associated therewith (collectively "the Card(s)"), including but not limited to: requests processing, administration, issuance, delivery and activation of the Card(s); collection activities, including sending communications via email, telephone calls, instant messaging services, short messages and other physical and/or electronic means of communication; clarification, investigation and billing of charges related to the Card(s); conducting periodic research and monitoring of your credit behaviour; conducting home visits for data validation, delivery of the Card(s) and/or requests management; creating consumer profiles, spending and enrolment averages, accumulation of points, and redemptions and administration of our own and third party loyalty programmes.

As part of the processing of requests and, where appropriate, for the fulfilment of the legal relationship arising from such application(s), American Express Company Mexico, including the suppliers that provide services for such purposes, will process your personal data in order to: carry out risk analysis and credit viability and monitoring, as well as for statistical analysis and generation of information models and/or current and predictive behavioural profiles.

b) Provide services related to the promotion and sale of leisure and/or business travel, including the processing of reservations, outsourcing of services to tourism suppliers, as well as invoicing, collection, and preparation of travel profiles.

c) Contact you about any matter related to the Card(s) and/or services of American Express Company Mexico, or to those insurance products you have taken out in which American Express Company Mexico acts as an intermediary in their sale.

d) Generate authentication data in order, on the one hand, to create an access profile to electronic systems to provide you with personalised attention and, on the other hand, to accredit your identity when you use electronic and/or automated equipment or systems to provide our services; if you are in our facilities, to maintain access control and maintenance programmes to guarantee the security and protection of customers, employees, visitors and suppliers by means of electronic, optical or any other technology devices and means.

e) Perform the origination, operation, management, processing, and administration of the Card(s) and/or services contracted with American Express Company Mexico.

f) Send all kinds of notices, notifications, communications, service surveys and additional information related to the Card(s) and/or services, as well as monitor through telephone calls, emails, text messages and/or any other means of contact, regarding any activity that is directly or indirectly related to the Card(s) and/or services offered by American Express Company Mexico.

g) Evaluate through surveys the quality of the Card(s) and/or services contracted with American Express Company Mexico.

h) Comply with the obligations associated with the Card(s) and/or services you have contracted with American Express Company Mexico.

i) Verify your identity, information and/or data declared in accordance with American Express Company Mexico's internal procedures, including requesting your financial and/or property information, as well as credit information to match and/or validate such information, or even demographic information, such as your address, with the service provider or credit bureau of our choice.

j) Compile files and databases and process them, either directly by American Express Company Mexico or through third parties or suppliers necessary for American Express Company Mexico to provide the services inherent to its purpose and report such information to the corresponding authorities, when so established by the legal provisions in force.

k) Include in your file documentation that may contain your photograph, as a measure to prevent and/or mitigate fraud and/or identity theft.

l) Verify and/or validate the personal data provided, including its accuracy, directly with governmental authorities and/or against databases and, in case of discrepancy, carry out the necessary rectifications or corrections to keep your information up to date.

m) Make recordings of your calls with American Express Company Mexico for any purpose related to the Card(s) and/or services and/or to evaluate the quality of service.

n) Conduct, address and follow up on enquiries, investigations and/or reviews of complaints, clarifications and/or claims related to American Express Company Mexico Card(s) and/or services, or any conduct that may contravene applicable regulations and/or our service agreement.

o) Proactively contact you in order to address and follow up on investigations and/or reviews of complaints, clarifications and/or claims related to American Express Company Mexico Card(s) and/or services.

p) Perform any complementary or ancillary activity associated with the Card(s) and/or services of American Express Company Mexico.

q) Determine, manage, and use as a test mechanism the information related to the "geolocation" of the optical and/or electronic devices used in the request and contracting of the Card(s) and/or services of American Express Company Mexico.

r) To carry out verification, certification, and consultation processes of third party, public and/or private databases for the purpose of keeping in contact with you for any matter related to the Card(s) and/or services of American Express Company Mexico.

s) Create and implement necessary analytical and statistical processes associated with American Express Company Mexico Card(s) and/or services.

t) Carry out disassociation procedures, the purpose of which is to use the disassociated information for statistical and behavioural modelling purposes.

u) Carry out monitoring activities for the purposes of maintaining the security of our technological infrastructure and detecting possible fraudulent activities, failures and/or errors.

v) Carry out internal or external audits, as well as comply with collaboration obligations and/or requests of information formulated by the competent governmental authorities, when necessary to safeguard the public interest, the procurement or administration of justice and/or in terms of the applicable legislation in force.

w) Use personal data in cases of merger, spin-off, or acquisition of American Express Company Mexico, including its subsidiaries and/or affiliates, as well as for portfolio assignment or discount, endorsement, or any other form of negotiation of the portfolio even before its maturity.

x) Inform and/or provide to the competent authorities any personal data, including sensitive personal data, that may be required in the event of a health emergency and/or of any other nature.

y) Comply with obligations to cooperate with competent authorities under the terms of the applicable legislation.

z) Comply with applicable laws, regulations, and legal provisions.

5. Secondary Purposes of Data Processing

In addition, unless you indicate otherwise, American Express Company Mexico will process your personal data for the following secondary purposes:

a) Carry out promotions, offers and advertising regarding the products and services of American Express Company Mexico, including the offer of service and/or credit cards, or any other product issued with the American Express brand, promotions, and benefits, as well as the offers we make with commercial establishments that accept American Express Cards as a means of payment through electronic, telephonic and/or printed media.

b) Offer, promote, sell and/or market insurance products operated by insurance companies that is done by any of the following:

- By American Express Company Mexico.

- Directly by the insurance companies.

- Through any subsidiary or affiliate of American Express that is empowered by law to intervene in the sale of such products.

- Through any other intermediary with whom American Express Company Mexico has duly formalised commercial agreements.

c) Carry out communications related to invitations and/or events organised by American Express Company Mexico.

If you do not wish your personal data to be processed for the aforementioned secondary purposes, please contact our Personal Data Department by telephone: 8008392871 or 5551693283, Monday through Friday from 9:00 A.M. to 6:00 P.M.

6. Transfer of Personal Data.

In order to comply with the obligations arising from your legal relationship with American Express Company Mexico, as well as those purposes set forth in this Privacy Notice, American Express Company Mexico may transfer your personal data to third parties, whether Mexican or foreign ones, without the need to obtain Your consent, when the transfer is to:

a) Those companies that are part of the American Express economic group including our holding company, as well as subsidiaries and affiliates, in order to carry out any activity related to the Card(s) and/or services you have contracted with us. We inform you that such transfer does not require your consent in accordance with the Law since the companies of the economic group to which American Express Company Mexico belongs operate under the same processes, policies and standards of privacy and data protection.

b) The insurance companies AXA Seguros, S.A. de C.V., Chubb Seguros México, S.A. and Zurich Aseguradora Mexicana, S.A. de C.V., if you purchase insurance products with such insurance companies through the intervention of American Express Company Mexico and/or any subsidiary or affiliate of American Express that is empowered by law for such purpose.

c) Bupa México, Compañía de Seguros, S.A. de C.V., with whom American Express Company Mexico has duly formalised commercial agreements so that this insurer directly offers, promotes, sells, markets and/or advises on the insurance products it operates.

d) The following companies, for your enrolment in the loyalty programmes operated by these companies and offered as part of the benefits of the Card(s) of which you are the holder, as well as for the preparation of analytical and/or statistical reports related to these companies and programmes. Remember that you can consult the Privacy Notices of each of these companies on their respective websites:

• Payback de México, S. de R.L. de C.V.
• Priority Pass, Inc.
• Aerovías de México, S.A. de C.V. (Aeroméxico)
• Hilton Worldwide Holdings Inc., for the benefit of Hilton Honors Diamond Status
• Starwood Hotels and Resorts Worldwide, for the benefit of Starwood Preferred Guest® Gold Level
• Intercontinental Hotels Group for the benefit of InterContinental Hotel Group Rewards Club Platinum Level
• The Hertz Corporation, for the benefit of Hertz Gold Plus Rewards® President's Circle and Hertz Gold Plus Rewards® Five Star
• Relais & Châteaux Enterprise, for the benefit of Club 5C Relais & Châteaux
• Preferred Hotel Group, for the benefit of Preferred Golf & I® Prefer
• Fairmont Hotels & Resorts, for the benefit of President´s Club Platinum Level
• Grupo Posadas S.A.B. de C.V., for the benefit of Membresía Fiesta Rewards Platinum Level
• Rezidor Hotel Group AB, for the benefit of Club CarlsonSM Gold Elite
• Accor SA (Accor Hotels), for the benefit of Le Club Accor Platinum level hotels
• PLM Premier, S.A.P.I. de C.V. (Club Premier), for the benefit of Club Premier
• Meliá Hotels International S.A., for memberships of MeliáRewards Gold and MeliáRewards Platinum.

e) To the different suppliers of the loyalty programmes, in order to deliver the Rewards or Certificates of said programmes.

f) To other business partners and/or service providers, for American Express Company Mexico to carry out any activity directly or indirectly related to the Card(s) and/or services it offers, as well as to comply with any of its legal, regulatory and/or other applicable obligations.

g) Those third parties with whom American Express Company Mexico enters or intends to enter into agreements relating to the assignment, portfolio discount, endorsement, or any other form of transfer of the rights and/or obligations arising from your legal relationship with us, including, without limitation, the information of Supplementary Cardholders.

h) Competent authorities and government agencies, whether local or federal, including but not limited to:

- In health matters: for registration, monitoring and prevention of contagion, diagnosis, or medical treatment or for the management of health services in the event of any disease that is classified as a health emergency and/or health contingency by the competent authorities.

- Tax authorities: for validation/verification of your tax information, Federal Taxpayers Register (RFC), and identification and contact details.

- Consumer protection: in relation to the Card(s) and/or services you have contracted with American Express Company Mexico.

- Any other authority, for any purpose provided for in the legislation in force and applicable.

American Express Company Mexico is committed to ensuring compliance with all legal principles of protection regarding the transfer of your personal data. It is also committed to ensuring that this Privacy Notice is always respected by us and by our business partners and/or service providers.

7. Limiting the Use or Disclosure of Personal Data

You may limit the use or disclosure of your data to stop receiving promotions, offers and advertising regarding the Card(s) and/or services of American Express Company Mexico, as well as the products and/or services in which the latter acts as an intermediary in their sale. Please contact the telephone numbers of our Personal Data Department: 8008392871 or 5551693283, Monday through Friday from 9:00 A.M. to 6:00 P.M.

If your request is successful, American Express Company Mexico will carry out the respective exclusion process, so that you will no longer receive our promotions.

8. Means of Exercising ARCO Rights and/or Revoking Consent

In accordance with the provisions of the Law and its Regulations, you may exercise, either personally or through a legal representative, your rights of access, rectification, cancellation and/or opposition ("ARCO Rights") with respect to your personal data, as well as revoke any consent that you have previously granted us in relation to this Privacy Notice, by calling directly to the telephone numbers of our Personal Data Department: 8008392871 or 5551693283, from Monday to Friday from 9:00 A.M. to 6:00 P.M., proving your identity and/or that of your legal representative, and describing clearly and precisely the personal data for which you seek to exercise your ARCO Rights.

Please note that in the call to exercise your ARCO Rights, you as the Data Subject, or your legal representative, must provide an email address and/or telephone number for us to notify you of the response to your request or to contact you in case we require additional information related to your request.

Likewise, you must send us a copy of your official identification, and in the case of your legal representative, they must send us a copy of your official identification, as well as the documentation that accredits their representation, in order to verify their identity.

Lastly, we inform you that the decision taken will be notified within a maximum period of 20 (twenty) working days, counted from the date on which all the requirements set forth in the request for access, rectification, cancellation and/or opposition are fulfilled. If such notification is successful, it shall be effective within 15 (fifteen) working days from the date of such notification.

9. Personal Data Department

American Express Company Mexico has a Personal Data Department which you may contact for any matter related to your personal data or to this Privacy Notice, at the following telephone numbers:

8008392871

5551693283

Opening hours: Monday to Friday, from 9:00 A.M. to 6:00 P.M.

10. Use of Cookies

The different American Express Company Mexico websites and online services are based on the use of Cookies, Web Beacons and/or Similar Technology that allow American Express Company Mexico to automatically collect personal data and monitor your behaviour as user of our services, in order to provide you with the best browsing experience, as well as to store information about your access to improve the security of your account, define your content preferences, and personalise information based on your interests or to track your online purchases. The use of these technologies is necessary for operational, technical and security reasons, and for the basic performance of our Website.

If you wish, you can disable or adjust the use of these technologies by following the procedures of the internet browser you use to access our Websites and/or the mobile device through which you access our services.

By accessing and continuing to use our Website, you consent to the collection and processing of your personal data by American Express Company Mexico.

For more information, please refer to our Website terms and conditions and terms and conditions for the use of Cookies, Web Beacons and/or Similar Technology.

11. Changes to the Privacy Notice

American Express Company Mexico may make changes to this Privacy Notice at any time by maintaining the current version of this Privacy Notice permanently on our website www.americanexpress.com.mx.

If applicable, American Express Company Mexico may notify you of any material changes to this Privacy Notice by means of your account statement or the e-mail address you have on file with us.

We remind you to periodically visit our website so that you can be up-to-date on possible changes to this Privacy Notice.

American Express Company (Mexico), S.A. de C.V.

INSURANCE SERVICES

Last Updated February 2020

Your privacy and trust are very important to American Express Insurance Services, Agente de Seguros, S.A. de C.V. (hereinafter referred to as the “Society”). Therefore, we want to ensure that you are aware of how we safeguard the integrity, privacy, and protection of your personal data, in compliance with the Federal Law for the Protection of Personal Data in Possession of Private Parties (hereinafter, the “Law”), and its Regulations.

It is necessary for the Society to collect certain personal data in order to carry out the activities intrinsic to its business and commercial activities. The Society has the legal and social obligation to comply with sufficient legal and security measures to protect the personal data it has collected for the purposes described in this Privacy Notice.

All of the above is done with the objective that you have full control and decision over your personal data. We therefore recommend that you read the following information carefully.

1. Details of the Person in Charge

The Company is an Insurance Agent duly incorporated and authorised in accordance with the laws of the United Mexican States with registered office at Avenida Patriotismo 635, Col. Ciudad de los Deportes, Delegación Benito Juárez, C.P. 03710, Mexico City, Mexico.

2. Personal Data

For the proper provision of our services and to comply with the purposes set out in this Privacy Notice, the Society will collect and process your personal identification data, including your personal image (photograph), contact, authentication, employment, and property and/or financial data (hereinafter, the "Personal Data"), in accordance with the provisions herein.

Likewise, the Society shall collect identification and contact details of your economic dependants. By providing this data You acknowledge that you have the consent of such persons for their personal data to be processed for the purposes set out in this Privacy Notice.

The Society will not collect nor process sensitive personal data, as such term is defined in the Law.

3. Primary and Secondary Purposes of Data Processing

The Society will process your Personal Data solely and exclusively in accordance with the terms of this Privacy Notice.

The Personal Data You have provided to us will be used for the following primary purposes, which are necessary and which give rise to the contractual relationship between the Society, in its capacity as the responsible entity, and You as the owner of the Personal Data:

(i) the provision of services related to the offering, promotion, sale, marketing, advice, and operation of insurance products operated by insurance companies, as well as for the provision of services requested or contracted by You with the Society. As part of the processing of requests and, where appropriate, for the fulfilment of the legal relationship arising from such requests; the Society, including the suppliers that provide services for such purposes, will process your Personal Data to: carry out risk analysis and credit viability and monitoring, as well as for statistical analysis and generation of information models and/or current and predictive behavioural profiles.

(ii) the elaboration of statistical and financial reports for your company or your partner company;

(iii) the creation and implementation of analytical and statistical processes necessary for the provision of services;

(iv) performance of any complementary or ancillary activities necessary for the provision of the services;

(v) making enquiries, investigations and reviews related to your complaints or grievances;

(vi) contacting you on any matter relating to the Services or this Privacy Notice;

(vii) fulfilling obligations arising from any legal relationship that arises between the Society and You in connection with the provision of the Services;

(viii) evaluation of the quality of the services by means of surveys; and

(ix) complying with applicable laws, regulations, and legal provisions.

In addition, unless You state otherwise, the Society will process your Personal Data for the following secondary purposes: to make promotions, offers and advertising regarding the Society's products and services, including sending communications through e-mails, telephone calls, short messages and other physical and/or electronic means of communication.

If You do not want Your Personal Data to be processed for the aforementioned secondary purposes, please call the Personal Data Department.

4. Transfer of Personal Data

In order to comply with the obligations arising from the legal relationship with you, as well as those purposes set out in this Privacy Notice, the Society may transfer, without requiring your consent, your necessary personal data to:

(a) Those societies that are part of the American Express economic group, including, but not limited to: our holding company, as well as subsidiaries and affiliates of the Society for the provision of the service contracted with You. We inform You that this transfer does not require Your consent in accordance with the regulations because the companies of the Group operate under the same processes and policies of respect for privacy.

(b) To the company Marsh & Mclennan Servicios, S.A. de C.V., which provides customer support services, as well as to the insurance companies AXA Seguros, S.A. de C.V., Chubb Seguros México, S.A., and Zurich Vida, Compañía de Seguros, S.A., if You acquire insurance products from such insurance companies through the intervention of the Society or any of its subsidiaries or affiliates that are also empowered by law to intervene in the sale of such products.

(c) Third parties with whom the Society formalises or intends to formalise agreements related to the assignment or transfer of the rights and/or obligations arising from the legal relationship it maintains with us.

The Society undertakes to ensure compliance with all legal principles of protection regarding the transfer of your Personal Data. It is also committed to ensuring that this Privacy Notice is always respected by us and by our business partners.

5. Limiting the Use or Disclosure of Personal Data

You may limit the use or disclosure of your data in order to stop receiving promotions, offers and advertising regarding the Society's products and services by calling the Personal Data Department.

If your request is successful, the Society will register you on its own opt-out list so that you will no longer receive promotions from us.

6. Means of Exercising ARCO Rights and/or Revoking Consent

In accordance with the provisions of the Law and its Regulations, the holder of the Personal Data, by themselves or through a legal representative, who must identify themselves or be properly accredited, may exercise their rights of access, rectification, cancellation and opposition (“ARCO Rights”), as well as revoke their consent directly by calling the telephone numbers of the Personal Data Department, clearly and precisely describing the personal data for which they are seeking to exercise any of the ARCO Rights.

It is important to mention that in the call to exercise ARCO Rights you must provide an email address and/or telephone number so that we can notify you of the response to your request or contact you in case we require additional information in relation to your request. Likewise, you must send us a copy of your official identification in order to prove your identity.

Finally, we inform You that the determination adopted will be notified to You within a maximum period of 20 (twenty) working days, counted from the date on which You comply with all the requirements established in the request for access, rectification, cancellation, or opposition, so that, if it is appropriate, it becomes effective within 15 (fifteen) working days following the date of said notification.

7. Changes to the Privacy Notice

Any substantial or total change to this Privacy Notice may be made by the Society and will be communicated by publication in a newspaper of wide circulation, through our web page www.americanexpress.com.mx, or by e-mail to the address of the holder that the Society maintains on record for such purposes.

8. Personal Data Department

Telephone numbers:

8008392871

51693283

Opening hours: Monday to Friday from 9:00 A.M. to 6:00 P.M.

9. Use of Cookies

The different Internet sites and online services of the Company rely on the use of Cookies and/or Web Beacons that allow the Society to automatically collect personal data. By accessing and continuing to use the Website, You consent to the collection and processing of Your personal data by the Society. The use of these technologies is necessary for operational, technical and security reasons. For more information, please refer to the Terms and Conditions.