1. Identity and Address of the Data Controller Embag Pack, hereinafter referred to as “Embag Pack” or the “Data Controller,” with its address at Lerdo de Tejada Poniente No. 150, C.P. 59800, Jacona, Michoacán, Mexico, is responsible for the processing, use, protection, and safeguarding of the personal data it collects through the website https://embag.com.mx, its forms, electronic media, and contact channels, in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties and other applicable provisions. For any matter related to privacy and the protection of personal data, you may contact us at [contacto@embag.com.mx](mailto:contacto@embag.com.mx). 2. Personal Data Collected Embag Pack may collect the following categories of personal data:

• Identification data: full name and, where applicable, position or representation within a company.
• Contact information: email address, telephone number, address, and contact information of the company or organization to which you belong.
• Data related to commercial inquiries: company, industry, characteristics of the requested packaging or product, quantities, measurements, specifications, message content, subject, communication history, and data necessary to prepare and follow up on a quotation.
• Billing, transaction, or commercial relationship data: legal name, Federal Taxpayer Registration (RFC), tax address, tax status certificate, tax regime, CFDI use, information regarding orders, payments, and deliveries, when necessary to formalize a transaction.
• Browsing and technical data: IP address, browser and device type, operating system, pages visited, date and time of access, referring URL, online identifiers, and data generated through cookies or similar technologies.
• Data provided for communications: email address and preferences related to newsletter subscriptions or the receipt of commercial information.

The website does not intentionally request sensitive personal data. Please do not provide information regarding your health, racial or ethnic origin, religious beliefs, political opinions, sexual orientation, genetic information, or other sensitive data through forms or free-text fields. If you voluntarily provide such information when it is not necessary, Embag Pack may delete it and will refrain from using it, unless there is a legal obligation or it is essential to address a specific request and the corresponding consent has been obtained. 3. Methods of Obtaining Personal Data Personal data may be obtained directly from you when you:

• complete the contact form or request a quotation;
• subscribe to the newsletter;
• communicate by email, telephone, or another channel enabled by Embag Pack;
• request information, products, samples, services, or commercial assistance;
• initiate or maintain a contractual or commercial relationship; or
• browse or interact with the website.

Personal data may also be obtained from publicly accessible sources or authorized third parties, provided that such processing is lawful and compatible with the purposes stated in this Privacy Notice. 4. Primary Purposes of Processing Embag Pack will process your personal data for the following necessary purposes:

• identify you and respond to your messages, questions, requests, or comments;
• prepare, send, and follow up on quotations;
• provide information regarding products, manufacturing capabilities, specifications, and services;
• maintain communication throughout the evaluation, contracting, manufacturing, delivery, and post-sale support of products or services;
• register and manage customers, prospects, orders, and commercial relationships;
• process payments, deliveries, returns, inquiries, and billing, when applicable;
• verify the information necessary to formalize and fulfill a legal or commercial relationship;
• provide customer support and assistance;
• prevent misuse, fraud, security incidents, or unlawful activities;
• operate, maintain, protect, and improve the functionality and security of the website;
• retain evidence of communications and transactions; and
• comply with contractual, tax, administrative, judicial, and other applicable legal obligations.

5. Secondary Purposes Additionally, Embag Pack may use your contact information to:

• send newsletters, updates, promotions, and information about products or services;
• conduct satisfaction surveys and commercial follow-up activities;
• prepare statistics, audience analysis, and measurements regarding website usage; and
• improve its communications, content, products, and services.

These purposes are not essential to maintaining a commercial relationship. If you do not wish your data to be processed for some or all of these purposes, you may request this at any time by sending an email to [contacto@embag.com.mx](mailto:contacto@embag.com.mx) with the subject line “Limitation on the Use of Personal Data”. Refusing these purposes will not affect the processing of your data for the primary purposes or any existing legal relationship. 6. Legal Basis and Consent The processing of personal data will be carried out based on your consent, the legal relationship you request or maintain with Embag Pack, and compliance with applicable legal obligations. When you provide financial or asset-related information that requires express consent, Embag Pack will obtain such consent through the corresponding mechanism before processing it, except in cases permitted by law. By voluntarily providing your personal data after this Privacy Notice has been made available to you, and by not expressing opposition when the law permits implied consent, you consent to its processing for the purposes described herein. 7. Data Transfers and Data Processors Embag Pack may allow personal data to be processed by service providers acting on behalf of and under the instructions of the Data Controller, including, for example, web hosting, email, forms, newsletters, storage, cybersecurity, billing, logistics, technical support, and analytics services. These providers will act as data processors and must comply with confidentiality, security, and data protection obligations. Likewise, Embag Pack may transfer personal data without requiring consent when the transfer:

• is provided for under an applicable law or treaty;
• is required by a competent authority;
• is necessary for the recognition, exercise, or defense of a legal right;
• is necessary to comply with or maintain a legal relationship with you; or
• falls under any other circumstance permitted by applicable legislation.

Embag Pack does not transfer personal data requiring your consent for the purposes described in this Privacy Notice. If such a transfer becomes necessary in the future, the corresponding consent will be requested in advance and this document will be updated. 8. ARCO Rights You or your legal representative may exercise your Access, Rectification, Cancellation, or Objection (ARCO) rights regarding your personal data at any time:

• Access: to know what personal data Embag Pack retains and the conditions under which it is processed.
• Rectification: to request the correction of inaccurate, incomplete, or outdated data.
• Cancellation: to request that your data be deleted when legally applicable.
• Objection: to request that processing cease for a legitimate reason or in the cases provided by law.

To exercise these rights, you must send a request to [contacto@embag.com.mx](mailto:contacto@embag.com.mx) with the subject line “ARCO Rights Request”, including:

1. the data subject’s name and an address or email address for receiving notifications;
2. a copy of an identity document and, where applicable, documents proving the identity and legal authority of the representative;
3. a clear description of the right you wish to exercise and the related personal data;
4. for rectification requests, the requested modifications and supporting documents; and
5. any information that facilitates the location of the data.

Embag Pack will communicate its decision within a maximum period of twenty business days from receipt of a complete request. If the request is deemed appropriate, it will be made effective within the following fifteen business days. These periods may be extended once for an equivalent period when circumstances justify such an extension. The exercise of ARCO rights is free of charge. Only legally permitted costs for reproduction, delivery, or copies may be charged, where applicable. 9. Withdrawal of Consent You may withdraw the consent you have given for the processing of your personal data, provided that the processing is not necessary to fulfill a legal or contractual obligation. To do so, you must send your request to [contacto@embag.com.mx](mailto:contacto@embag.com.mx) with the subject line “Withdrawal of Consent” and include the information necessary to verify your identity and identify the processing for which you are requesting withdrawal. Withdrawal of consent will not have retroactive effects and, in certain cases, it may not be possible to process the request immediately if there is a legal obligation requiring continued processing. 10. Limitation on Use or Disclosure In addition to the procedure described for secondary purposes, you may request that the use or disclosure of your personal data be limited by sending an email to [contacto@embag.com.mx](mailto:contacto@embag.com.mx), indicating your name, the method by which you wish to receive a response, and the scope of the requested limitation. Where applicable, you may also use the unsubscribe mechanisms included in commercial emails sent by Embag Pack. 11. Cookies and Similar Technologies The website uses or may use cookies, tags, server logs, and similar technologies to enable its operation, retain preferences, maintain security, process inquiries or quotation requests, understand website performance, and measure visitor interaction. These technologies may collect information such as IP address, browser, device, operating system, pages visited, browsing time, selected links, date and time of access, referring URL, and identifiers associated with the session. Certain features or content may be provided by third parties, such as newsletter, hosting, video, social media, e-commerce, or analytics services. These third parties may use their own technologies in accordance with their respective privacy notices. You may manage, restrict, or delete cookies through your browser settings. Disabling technical cookies may prevent certain website functions from operating properly. Where required by applicable law, Embag Pack will provide a mechanism to accept, reject, or configure non-essential cookies before they are installed. 12. Security Measures and Data Retention Embag Pack maintains reasonable administrative, technical, and physical measures to protect personal data against damage, loss, alteration, destruction, unauthorized use, access, or processing. However, no electronic transmission or storage system can guarantee absolute security. Personal data will be retained for as long as necessary to fulfill the purposes described herein and, thereafter, for the retention, limitation, and blocking periods arising from legal, tax, contractual obligations, or potential liabilities. Once these periods have expired, the data will be securely deleted or anonymized, where applicable. 13. Personal Data of Minors The website and services of Embag Pack are primarily directed at adults and representatives of companies. Embag Pack does not intentionally seek to collect personal data from minors. If you become aware that a minor has provided personal data without authorization from the person exercising parental authority or guardianship, please request its deletion by contacting [contacto@embag.com.mx](mailto:contacto@embag.com.mx). 14. Third-Party Links and Services The website may contain links to or content from third-party websites, platforms, and social networks. Embag Pack does not control their privacy practices. Before providing information to such third parties, we recommend reviewing their respective privacy notices and privacy settings. 15. Changes to this Privacy Notice Embag Pack may modify this Privacy Notice to reflect legal, operational, technological, or changes in its data-processing practices. The updated version will be available at https://embag.com.mx, under the “Privacy Notice” section, and will indicate the date of its latest update. When a change requires new consent, such consent will be requested through an appropriate means before the new processing takes effect. Last updated: September 11, 2026.