PRIVACY NOTICE OF

GRUPO GIGANTE, S.A.B. DE C.V.

In compliance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter the “Law”), its regulations (hereinafter the “Regulations”), and the Privacy Notice Guidelines published in the Federal Official Gazette on January 17, 2013, we hereby inform you of the following:

1. DATA CONTROLLER

Grupo Gigante, S.A.B. de C.V. (hereinafter the “Company”), with domicile for the purposes of this Privacy Notice at Av. Ejército Nacional Mexicano No. 769, Torre B, 12th Floor, Granada, 11520, Miguel Hidalgo, Mexico City, Mexico, shall be the data controller of the personal data provided concerning the natural persons to whom such data corresponds (hereinafter the “Data Subject” or “Data Subjects”).

2. PERSONAL DATA REQUESTED FROM THE DATA SUBJECT

2.1. Processed Personal Data

For the purposes outlined in this Privacy Notice, the Company shall collect the following personal data of the Data Subject: name, date of birth, age, gender, address, email, phone number, and image (captured through surveillance and security cameras located in the Company’s facilities when the Data Subject visits such facilities), as well as their purchase preference and interest history related to the goods and/or services offered by the Company, its Affiliates, and Third Parties (as such terms are defined in sections 5.1 and 5.2). Hereinafter, such information shall be referred to as the “Personal Data”.

The Personal Data may be collected by the following means: (i) when the Data Subject provides it personally or directly to the Company, and (ii) when the Company obtains it indirectly, through public access sources, including social media, or transfers.

2.2. Use of Cookies on Website

The Data Subjects are informed that if they use the Company’s website (www.grupogigante.com.mx), such website (hereinafter the “Website”) uses “cookies,” through which the following data is obtained: IP address, geolocation, unique identifiers to facilitate specific marketing campaigns, links followed, websites visited, duration of interaction time on the Website, as well as browser type and version. The collection of such Personal Data is carried out generally, with the primary purpose of performing statistical analysis of Website usage and optimizing design, functionality, and performance across the various devices that access the Website. Additionally, a code is incorporated in the Website’s origin cookie that allows the use of Personal Data for online and multi-channel advertising. Such Personal Data may be transferred in accordance with the provisions of section 5 of this Privacy Notice in order to enable interest-based content or targeted advertising throughout your digital experience (e.g., on websites, emails, connected devices, and mobile applications).

The Data Subject may, at any time, disable or restrict the use of cookies through the settings of the browser used to access the Website, in its cookies, privacy, and/or security sections. Browsers allow users to manage how cookies are set and used while browsing the Website, as well as to delete cookies and data afterward.

Disabling cookies does not prevent navigation on the Website; however, it may affect certain Website functionalities, and optimal performance is not guaranteed if the Data Subject chooses to block them wholly or partially.

3. PURPOSES FOR WHICH PERSONAL DATA IS COLLECTED

3.1. Primary Purposes. The Data Subject’s Personal Data is processed by the Company to fulfill the following purposes, which are necessary to comply with obligations arising from the legal relationship between the Company and the Data Subject: (i) identify the Data Subject; (ii) safeguard the Data Subject’s data; and (iii) consolidate the Data Subject’s data.

Regarding the image of the Data Subjects captured through surveillance and security cameras located in the Company’s facilities, it shall be used to identify the Data Subject, safeguard their data, maintain the security of the Company’s facilities, and the safety of the Data Subject, clients, collaborators, suppliers, and other persons within the facilities, as well as to protect the Company’s assets.

3.2. Secondary Purposes. Additionally, the Company will use the Data Subject’s Personal Data to: (i) carry out profiling activities and gain knowledge about the customers of the Company, its Affiliates and/or Third Parties (as such terms are defined in sections 5.1 and 5.2), through the integration and generation of customer profiles using various data analysis technologies; (ii) inform the Data Subject of promotions, purchases with benefits and/or discounts, and new store openings by the Company, its Affiliates and/or Third Parties; (iii) provide advertising about goods and/or services offered by the Company, its Affiliates and/or Third Parties; (iv) invite the Data Subject to participate in events, contests, sweepstakes, and activities, and, where appropriate, deliver the corresponding prize, in accordance with the applicable terms and conditions; (v) contact the Data Subject through various physical or electronic means, and through social media, and where appropriate, respond to their requests through such means; (vi) identify the consumption habits of the Data Subject and carry out personalized commercial prospecting activities according to their interests and preferences regarding consumption; and (vii) develop and improve the products and services of the Company, its Affiliates and/or Third Parties, by assessing their quality, including conducting surveys and collecting information for the purposes outlined in this paragraph (the “Secondary Purposes”).

The Secondary Purposes mentioned in this section 3.2 are not necessarily required to comply with obligations derived from the legal relationship between the Company and the Data Subject; therefore, should the Data Subject not agree to the processing of their Personal Data for one or more of these Secondary Purposes, Data Subjects may at any time oppose or revoke their consent for such processing by following the procedure outlined in section 6 of this Privacy Notice.

When the Company does not directly or personally disclose this Privacy Notice to the Data Subjects but rather indirectly, the Data Subjects may express their objection to the processing of their Personal Data for Secondary Purposes, such objection to be expressed according to section 6 herein; otherwise, if no objection is made, it shall be understood that consent is granted to the Company for such purposes.

4. DURATION OF PERSONAL DATA PROCESSING

The duration of the handling of the Data Subjects’ Personal Data shall not exceed the preservation period necessary for (i) fulfilling the purposes established in this Privacy Notice, and (ii) complying with the obligations required by the applicable legislation and competent authorities. However, regarding the Personal Data related to the image of the Data Subjects captured by the video surveillance cameras located in the facilities of the Company, such information shall be kept by the Company only for a period of 30 calendar days following the date on which it is obtained (unless it is necessary to retain it for a longer period pursuant to applicable legislation or at the request of a competent authority), and once such period has elapsed, it shall be deleted. Once the purpose(s) of the processing of the Personal Data have been fulfilled, and provided that no legal or regulatory provision establishes otherwise, the Company shall cancel the Personal Data after prior Blocking [1], for its subsequent Deletion [2].

The information delivered to the Company shall be safeguarded, preserved, and protected by the latter in accordance with applicable legislation to maintain the confidentiality of such information.

5. TRANSFERS OF PERSONAL DATA

5.1. Transfers of Personal Data not requiring the Data Subject’s consent. The Company may transfer the Personal Data referred to in Section 2 of this Privacy Notice:

(a) To its affiliate, subsidiary companies and/or companies belonging to the same corporate group as the Company (hereinafter and collectively, the “Affiliates”), so that the Affiliates may: (i) identify the Data Subject and safeguard their Personal Data; (ii) carry out profiling activities and gain knowledge about the customers, including consumption habits, through the integration and generation of customer profiles using various data analysis technologies; (iii) conduct commercial prospecting activities and contact and send advertising, promotional and/or informational materials from the Company, its Affiliates and/or Third Parties; (iv) carry out research and development of new business lines; (v) conduct marketing campaigns, as well as statistics, surveys, and studies on consumption habits in relation to the goods and/or services offered by the Company, its Affiliates and/or Third Parties; (vi) transfer the Personal Data to their affiliate, subsidiary companies and/or companies belonging to the same corporate group; and (vii) transfer the Personal Data to Third Parties.

(b) In the event that the safeguarded Personal Data is required by an authority of any kind or must be delivered to such authority in accordance with applicable legislation, said data shall be made available in strict compliance with the Law.

The transfers of Personal Data referred to in this Section 5.1 do not require the Data Subjects’ consent pursuant to Article 36 of the Law.

5.2. Transfers of Personal Data requiring the Data Subject’s consent. Should the Data Subject’s consent be obtained in accordance with this Section 5.2, the Company may transfer the Personal Data referred to in Section 2 of this Privacy Notice to: (i) Mascotas y Compañía, S.A.P.I. de C.V., (ii) Matriz Ideas Mex, S.A.P.I. de C.V., (iii) Inmobiliaria Conjunto Polanco, S.A.P.I. de C.V., and (iv) the companies that form part of “Grupo Presidente” (hereinafter and collectively, the “Third Parties”), so that the Third Parties may: (i) identify the Data Subject and safeguard their Personal Data; (ii) carry out profiling activities and gain knowledge about the customers carry out profiling activities and gain knowledge about the customers, including consumption habits, through the integration and generation of customer profiles using various data analysis technologies; (iii) conduct commercial prospecting activities and contact and send advertising, promotional and/or informational materials from the Company, its Affiliates and/or the Third Parties; (iv) carry out research and development of new business lines; (v) conduct marketing campaigns, as well as statistics, surveys, and studies on consumption habits in relation to the goods and/or services offered by the Company, its Affiliates and/or the Third Parties; (vi) transfer the Personal Data to their affiliate, subsidiary companies and/or companies belonging to the same corporate group; and (vii) transfer the Personal Data to the Affiliates.

If the Data Subjects do not agree that the Company transfers their Personal Data to the Third Parties under the terms and for the purposes described in this Section 5.2, the Data Subjects may express their objection following the procedure established in Section 6 of this Privacy Notice. If the Data Subjects do not express such objection, it shall be understood that they grant their consent to the Company for these purposes.

6. RIGHTS OF ACCESS, RECTIFICATION, CANCELLATION AND OBJECTION, REVOCATION OF CONSENT, AND LIMITATION ON THE USE OR DISCLOSURE OF PERSONAL DATA

The Data Subjects shall have the right to request access, rectification and/or cancellation of their Personal Data, as well as to object to its processing for specific purposes, revoke their consent, and limit the use or disclosure of the Personal Data, by sending a free-form request to the following email address: [email protected], which shall be attended to by the Company’s Personal Data Department.

The Company will respond to the Data Subject’s requests provided that none of the exceptions set forth in the Law apply.

In order for the Company to process a Data Subject’s request regarding access, rectification, revocation of consent, cancellation, objection and/or limitation on the use or disclosure of their Personal Data, the request must include the following information and documentation:

1. Name, address, and email or other means by which the Company may communicate the response to the request.
2. Documents proving the identity of the Data Subject or, where applicable, the legal capacity and of their legal representative.
3. A clear and precise description of the Personal Data for which the right of rectification, cancellation, objection, revocation of consent and/or limitation on use or disclosure is sought to be exercised, as well as any other information or document that may help locate the Personal Data.
4. In the event of a request for rectification of Personal Data, the modifications to be made must be indicated, accompanied by documentation supporting the request.

The Company shall respond to the Data Subject’s request for access, rectification, cancellation, objection, revocation of consent and/or limitation on use or disclosure of their Personal Data within the timeframes established in the Law, namely, within 20 business days following receipt of the Data Subject’s request. If the request is appropriate, it will be implemented within 15 business days following notification of the response to the Data Subject. These timeframes may be extended by the Company in accordance with Article 31 of the Law.

The Company shall be deemed to have complied with the obligation of access to information when, if requested by the Data Subject, the Personal Data is made available in simple copy form at the Company’s address within 15 business days following notification of the response to the Data Subject´s request, or through any of the forms provided in Article 32 of the Law, which will be notified to the Data Subject in the response.

7. AMENDMENTS TO THE PRIVACY NOTICE

If the Company changes its identity, requires the use of the Personal Data for purposes different from those established in this Privacy Notice, or requires Personal Data from the Data Subject other than those specified in this Privacy Notice and/or intends to make transfers of the Personal Data different from those stated herein, it will be notified to the Data Subject in writing, by telephone, electronically (including via email), or by any optical, sound, visual, or other means that technology permits now or in the future, explaining, as applicable, the new intended uses of such information, in order to obtain their consent when required under the Law. By this Privacy Notice, the Data Subjects are duly informed of the Personal Data collected and for what purposes, as well as the fact that Privacy Notice may be consulted at any time on the Company’s website: www.grupogigante.com.mx.

The Company reserves the right to make any changes or updates to this Privacy Notice other than those provided in the preceding paragraph, including to reflect legislative and/or jurisprudential developments. In such cases, the changes will be notified to the Data Subjects by publishing the updated Privacy Notice on the website www.grupogigante.com.mx.

This Privacy Notice, as well as the processing of Personal Data carried out by the Company, is governed by the legislation in force and applicable in the United Mexican States. Any dispute arising from its application shall be brought before the Secretariat for Anti-Corruption and Good Governance and/or before the competent Jurisdictional Authorities in Mexico City, Mexico.

The Data Subject acknowledges having read and consented to this Privacy Notice, authorizing the Company to process their Personal Data in accordance with the terms and conditions set forth herein.

Date of last update: July 1, 2025.

[1] Article 2 of the Law defines Blocking as: The identification and preservation of personal data once the purpose for which it was collected has been fulfilled, with the sole purpose of determining possible liabilities related to its processing, until the expiration of the legal or contractual limitation period. During this period, the personal data may not be subject to processing and, once it has elapsed, the data shall be cancelled from the corresponding database.

[2] Article 2 of the Regulations defines Deletion as: The activity consisting of eliminating, erasing or destroying one or more personal data items, once the blocking period has concluded, under the security measures previously established by the data controller.

This Privacy Notice is a translation of the original Spanish version. In the event of any discrepancy or contradiction between the two versions, the original Spanish version shall prevail and govern for the interpretation and application of this Privacy Notice.