Summary of the policy

The purpose of this Policy is to establish the requirements under which each of the members of “RGJR, S.A. DE C.V.” (hereinafter, RGJR), must treat the information originated within the organization, protecting such information, as well as avoiding its unauthorized disclosure to third parties that could jeopardize the fulfillment of the objectives of the company.

It shall be considered confidential information:

• Internal information explicitly declared as confidential and that of third parties delivered to RGJR under confidentiality agreement.
• Data of employees, workers, affiliates, suppliers and other third parties related to RGJR that have not been publicly disclosed by RGJR or by the owners of the data.
• Documentation related to the activities of the different areas of RGJR that have not been publicly disclosed by them.

Scope

This Policy applies to all employees and workers of RGJR and refers to individual and/or joint actions performed by or on behalf of the company.

This Policy shall encompass all activities, processes and relationships established by RGJR and its employees and workers, at all levels, whether formally written in contract, policy, procedure or similar, or applied by custom or practice.

General standards of behavior

Duty of discretion, secrecy and confidentiality

The dissemination of confidential information, whether intentional or accidental, can cause serious damage to the image of RGJR and to relations with employees, workers and third parties linked to it. Therefore, in order to ensure that the information is used with the necessary degree of secrecy and confidentiality, the following guidelines are established:

• All employees and workers must comply with the duty of discretion, secrecy and confidentiality in relation to the Confidential Information available to them for the exercise of the tasks of their job or those corresponding to their participation in the different departments, committees or groups existing in RGJR.
• The information will be used for legitimate purposes and in an honest and responsible manner, and will comply with the provisions of the Organic Law on Data Protection and other regulations that ensure the confidentiality of the information.
• It must comply with the duty of confidentiality, as provided in the contracts signed with different customers, affiliates, suppliers, and other third parties related to RGJR.
• No partner, employee or worker shall, either during the term of their partnership / employment relationship, or once it is terminated, disseminate confidential information without the proper authorization of RGJR.
• The hierarchical superior must be immediately informed about:
  • Any use, dissemination and/or publication of confidential information by other employees or workers.
  • Any attempt made by a third party outside RGJR to obtain confidential information from any employee.

Mechanisms in place to ensure confidentiality

• Signing of a confidentiality commitment, at the time of incorporation of an employee to RGJR. The document will inform about the duty of secrecy and confidentiality, what type of information is confidential, etc. The signature is mandatory and implies acceptance of the obligation it represents on the part of the worker.
• Incorporation of a confidentiality clause in the contracts signed by RGJR.
• Signing of a confidentiality document by contractors, subcontractors, consultants, and other individuals or entities outside, who have access to private and confidential information of this, in the development of their work.
• Restricted access to information available on the internal computer network.

Dissemination of information

• The dissemination of confidential information, not previously made public by the relevant RGJR managers, must be authorized by the Management.
• The dissemination of printed or digital material produced by RGJR for any purpose, the capture of photographic images or filming of any kind in the facilities, as well as any other action that involves the publicity of materials owned by RGJR, or with its name, must be authorized by the Management.

Failure to comply with the policy

Any incidence or consultation related to this policy should be communicated directly to any of the members of the “Board of Directors” or through the following e-mail address: jhernandez@grupobrs.mx

RGJR, S.A. DE C.V.
THROUGH ITS SOLE DIRECTOR

C.P. JUAN RAMÓN HERNÁNDEZ MARTÍNEZ