Notice of Privacy

To buy tickets via internet, telephone and directly

Dear Customer and/or User:

In compliance with the Mexican Data Protection Law (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) (the “Law”), Ferrocarril Mexicano, S.A. de C.V., (“Ferromex”) (and/or Chepe®), with address at Bosques de Ciruelos No. 99, Colonia Bosques de las Lomas, Alcaldia Miguel Hidalgo, Mexico City, Mexico 11700, hereby informs you of the following regarding protecting the Personal Data of our customers and/or users of our products and services:

Purposes of the treatment of customer and/or user Personal Data

The Personal Data and credit information requested will be treated for the following purposes:

A) Primary Purposes

  • • Provide the services requested by the customer and/or user.
  • • Inform the customer and/or user of changes or new products or services related to those contracted or purchased.
  • • Comply with obligations contracted with our customers and/or users.
  • • Billing for the service(s) provided.
  • • Collection and payment procedures.

B) Secondary Purposes

  • • Communicate news regarding our services.
  • • Send advertising and promotions for our products and services.
  • • Analyze the effectiveness of our advertising and promotions.

Personal Data of minor-aged children and persons who are mentally incompetent or differently abled will be treated for the primary purpose of providing the services associated with their purchase.

Personal Data, privacy and protection

Personal Data is defined by the Law as any identifying information concerning a person. Such information will be used for the purposes described in this privacy statement and includes the following:

  • • Name
  • • Address
  • • Home and/or mobile telephone number
  • • Age
  • • Date of birth
  • • Gender
  • • Nationality
  • Email
  • • Financial and credit information: tax identification number, physical address for tax purposes.
  • • Credit card number, expiration date, security code, cardholder’s name and issuer bank; on providing this information you are giving the company your express consent to its treatment.
  • • Video recorded images taken from waiting rooms and on board passenger trains; the company will erase these images 72 hours after the completion of each trip, provided no incident has occurred; images will only be shared on the request of the authorities.

We inform you that we take special care of the Personal Data of minor-aged children and persons who are mentally incompetent or differently abled, as provided for by law and with the following specific measures:

  • • Obtain the consent of a parent or guardian, which is given with the tacit acceptance of this Privacy Statement unless objection is raised by sending an email to chepe@ferromex.mx
  • • The implementation and maintenance of stricter security measures to ensure the confidentiality of minor-aged children and persons who are mentally incompetent or differently abled.

Regardless, “Ferromex” will only collect the following information for minor-aged children and persons who are mentally incompetent or differently abled:

  • • Name
  • • Contact address
  • • Home and/or mobile telephone number
  • • Gender
  • • Age
  • • Date of birth
  • • Nationality

“Ferromex” will make every effort to ensure Personal Data for minor-aged children and persons who are mentally incompetent or differently abled are gathered and used only in accordance with applicable legislation, ensuring their fundamental rights are respected. “Ferromex” will not gather Personal Information from Users and/or Customers under 13 (thirteen) years of age and who are Mexican nationals.

“Ferromex” will treat Personal Data for the time necessary to fulfill the purposes described in this Privacy Statement and/or as required by law.

“Ferromex” will treat, store and manage Personal Data provided in accordance with applicable Mexican legislation, and we promise to safeguard this information according to the principles of loyalty and responsibility.

The Personal Data gathered will be stored on electronic media for 6 years (taking into consideration administrative, accounting, fiscal and legal aspects) following the conclusion of the business relationship. At the end of this period, Personal Data will be deleted or destroyed to prevent any improper treatment.

On registering, the owner of the data gives their free and voluntary consent to provide the Personal Data required, with the understanding that if the user should decide to not provide this information, the user will not be able to access the services for which such information is required. However, the user will be permitted to access all other services that do not require this information. “Ferromex” will not, under any circumstance, store sensitive Personal Data, such as race or ethnic origin, current health condition, genetic information, religious, philosophical or moral beliefs, union affiliation, political opinions or sexual preference, among others.

On giving consent for the transfer of their Personal Data, the owner of this information acknowledges and accepts that “Ferromex” may use the information internally. “Ferromex” may also collect information concerning tastes, preferences and, in general, usage of our services. This secondary information, as well as the personal information the owner provides, may be used for different commercial purposes, such as for internal statistical data, market research and other activities or promotions that “Ferromex” considers appropriate. “Ferromex” may also reveal information under order of law and/or the authorities or on good faith that such disclosure is necessary to: I) comply with legal processes; II) answer complaints involving any content claimed to violate third party rights, or III) protect the rights, property or security of “Ferromex”, our Customers and/or Users and the general public.

Responsibility regarding the use of Financial and/or Credit Information

“Ferromex” may use your financial and/or credit information to verify compliance with the requirements set by the Mexican financial institutions, to transact sales and other transactions on this Site efficiently, to deliver the goods and services requested, to register the user for discount programs, refunds and other programs in which the customer or user chooses to participate, and for quality assurance. In some cases, we may use, and by consequence we may share with service providers, your financial information to help us with these tasks. In such cases, “Ferromex” will require the service provider to sign an agreement regarding the confidential handling of your information according to terms that are at least as stringent as those employed by “Ferromex”.

We may reveal specific financial and/or credit information when we determine that such action may be necessary to comply with the law, to cooperate with or to seek the assistance of the authorities, or to protect the interests or security of “Ferromex” or that of visitors to the Site www.chepe.com.mx or users of services or products provided by “Ferromex” or to participate jointly with other entities on anti-fraud actions. Your financial information may also be shared with third parties in the case of a transfer of ownership or properties, or should “Ferromex” fall into bankruptcy. “Ferromex” is not responsible for any other dissemination of your financial and/or credit information by a third party with which “Ferromex” holds an agreement on the disclosure of financial information under this privacy statement.

“Ferromex” is not responsible for any use or dissemination of financial and/or credit information by a third party with which “Ferromex” holds an agreement on the disclosure of information under this privacy statement.

Exercising “ARCO” rights and revoking consent:

The user can exercise their rights to access, rectify, cancel and object (ARCO) as stipulated by law, and can also limit the use and dissemination of their Personal Data by sending an email with their request to: chepe@ferromex.mx, providing the necessary information, including full name (given name(s) and surname(s)), attaching a scanned copy of their government-issued identification, phone number and a physical or electronic address for communications related to the matter. This information will be stored in accordance with law.

On receiving the request, “Ferromex” has 10 (ten) business days to ask for any additional information and/or documentation as may be necessary to process the request and to verify the user’s identity, as provided for by law. The user will then have 10 (ten) business days to respond, otherwise their request will be cancelled.

“Ferromex” will notify the user of their decision within 20 (twenty) business days, via the means of contact noted in the request. Unless there is any objection, “Ferromex” will then take action on the decision within 15 (fifteen) business days following.

The times established above may be extended one time, if necessary, on notification via the means of contact indicated.

The revocation and exercising of “ARCO” Rights is free of charge, however you may be asked to cover reasonable mailing expenses, or the cost of photocopies or other forms as required according to the request.

We also inform you of your right to consult the Mexican Institute on Access to Information and Data Protection (Instituto Federal de Acceso a la Información y Protección de Datos) if you believe your Personal Data protection rights have been violated. For more information, visit www.ifai.org.mx.

Use of cookies, web beacons and other similar technologies

“Ferromex” may contract one or more third party service providers to manage both this Website and the Personal Data gathered through the site, or by any other means, and may transfer Personal Data to these third parties for non-commercial purposes.

The Personal Data you provide to “Ferromex” may be compiled and stored in a database that is the exclusive property of “Ferromex”. “Ferromex” may use “cookies” or similar technologies to confirm your identity, to customize your access to this website and to monitor usage for the sole purpose of improving your experience and the functions of this website. Therefore, “Ferromex” will not use “cookies” or similar technologies to collect Personal Data from users that they do not provide or without their consent. This website contains links to other, third party sites, the content and privacy policies for which “Ferromex” is not responsible. Users who visit these outside sites do so subject to the corresponding privacy policies, at no responsibility of “Ferromex”.

“Ferromex” has administrative, technical and physical measures in place to protect personal data, and “Ferromex” service providers and vendors are required to employ similar measures.

Cookie names Type of cookie First or Third party Can be blocked Session or Persistent Expiry Time Purpose

Changes to the Privacy Statement and security breaches:

“Ferromex” may change or amend this Privacy Statement at any time. Such changes will be posted at: www.chepe.mx and/or www.ferromex.mx.

In the event of a security breach at any time during the treatment of Personal Data, “Ferromex” will inform users via our websites: www.chepe.mx and/or www.ferromex.mx, for users to take the necessary measures to protect their rights.

Updated: 2019