PRIVACY NOTICE FOR CANDIDATES, EMPLOYEES AND UNION WORKERS

At PENSKE we are committed to safeguarding the privacy of your personal data, this notice is applicable to Penske Logística, S.A. de C.V., Penske Servicios de Administración, S.A. de C.V., Penske Truck Arrendadora de México, S.A. de C.V. (hereinafter “Penske”), and Penske Truck Arrendadora de México, S.A. de C.V. (hereinafter “Penske”), consequently and in accordance with the provisions of Article 17, section II of the Federal Law for the Protection of Personal Data in Possession of Individuals, we inform you that “Penske” will treat the personal data it collects from you in accordance with the terms of this privacy notice:

Address

For the purposes of this privacy notice, “Penske” indicates its address as Antonio Dovali Jaime No. 70 Torre A Piso 3, Santa Fe, Alcaldía Álvaro Obregón, C.P. 01210, Mexico City, Mexico.

Personal data that may be collected and processed

The personal data you provide to “Penske” will be treated exclusively for the purpose described in this privacy notice and will be treated confidentially and exclusively for the purpose for which it was collected.

The personal data that may be collected under this privacy notice are the following: full name, photograph, full address, telephone, cell phone, RFC, CURP, place of birth, date of birth, nationality, marital status, academic data, courses, languages, use of Penske computer systems, as well as content of emails and visits to web pages through Penske servers, even if the same are under an encryption protocol, availability to travel, passport, visa, work history, recommendations, data of relatives living with the employee, employee's signature, contact for updates on the website and type of company in which he/she worked; the following financial data: social security number, monthly salary, compensation amount and ability to contribute online and the following sensitive data: gender, weight, height and Health information regarding: family inheritance history, family history, pathological personal history, comprehensive health, non-pathological personal history, physical examination results.

In relation to the sensitive personal data mentioned in the preceding paragraph, “Penske” undertakes that the treatment will be the absolutely indispensable for the purposes mentioned and to treat them under appropriate security measures to protect confidentiality.

Purpose of processing your personal data

We inform you that “Penske” may transfer your personal data to other companies of the group or to customers of:

“Penske” only in case it is required.

In accordance with the terms of this notice, “Penske” may use your data for the following purposes:

Primary purposes:

Manage the administration of payroll;
To grant social security benefits;
Calculation and payment of the corresponding taxes;
Investigation of your background and qualifications;
Obtain work references from you;
Complete and manage your employee or worker file; and;
Keeping your proper records in the system
To try and reduce any possibility of virtual vulnerability to Penske's network.
To integrate a medical file to provide the best care in case of any emergency.

Secondary purposes:

Marketing
Corporate image and services

“ARCO” Rights

Likewise, as of January 6, 2012, you will have the right to: (i) access your personal data in our possession and know the details of the processing thereof, (ii) rectify them in case they are inaccurate or incomplete, (iii) cancel them when you consider that they are not required for any of the purposes stated in this privacy notice, are being used for non-consensual purposes or the contractual or service relationship has ended, or (iv) oppose the processing thereof for specific purposes, as stated by law, ( jointly, the “ARCO Rights”).

“Penske” has designated a person in charge of personal data (the ‘Privacy Officer’), therefore you may limit the use or disclosure of your personal data by sending a communication to the Privacy Officer at the following e-mail address: oficialdeprivacidad@penske.com (the ‘Contact Address’). The Privacy Officer will respond to your Request to Exercise ARCO Rights and the reasons for his decision by certified mail (at additional cost) or in person at the corporate offices within a maximum of 20 business days from the day your Request to Exercise ARCO Rights was received. In order for your request to be processed, it must include each and every one of the requirements set forth in Article 29 of the Federal Law for the Protection of Personal Data in Possession of Individuals.

“Penske” may deny access (the ‘Refusal’) for You to exercise Your ARCO Rights in the following instances:

When you are not the owner of the personal data, or you cannot prove the representation of the owner;
When your personal data are not in the database of “Penske”.
When the rights of a third party are harmed.
When there is a legal impediment or the resolution of a competent authority, which restricts your ARCO Rights.
When the rectification, cancellation or opposition has been previously made.

The exercise of the ARCO Rights will be free of charge, but if you repeat your request in a period of less than twelve months, the costs will be three days of the General Minimum Wage in force in the Federal District, plus V.A.T., unless there are substantial modifications to the Privacy Notice that motivate new Requests for the Exercise of ARCO Rights. You must cover the justified shipping costs or the cost of reproduction in copies or other formats.

Requirements for exercising “ARCO” rights

In order to exercise the ARCO rights as mentioned in the previous paragraph, the request must contain:

Your name, complete address (street, interior and/or exterior number, neighborhood, zip code, city and state) according to the format “Request for Exercise of ARCO Rights” in order to communicate the response to the ARCO Request;
The documents that prove your identity (copy of IFE, valid passport, professional license or immigration document) or, if applicable, the documents that prove your legal representation (copy of IFE, valid passport, professional license or immigration document);
A clear and precise description of the personal data with respect to which you seek to exercise any of the ARCO Rights, and;
Any document or information that facilitates the location of your personal data;
In case of requesting a data rectification, you must also indicate the modifications to be made and provide the documentation supporting your request (birth certificate, proof of address, pre-registration document issued by the IMSS in case of requesting modifications to the NSS, etc.).

Revocation of Consent

The holder may at any time revoke his consent to the processing of his personal data (free of charge), the request can be found on the Penske website or by requesting this document at any Penske branch. The request may be submitted digitally or physically when there is a legitimate reason and your specific situation requires it or when you do not want your personal data to be processed for specific purposes. The right to object shall not apply where the processing is necessary for compliance with a legal obligation imposed on ‘Penske’.

The exercise of any of the ‘ARCO’ rights and the revocation of personal data may be restricted for reasons of national security, public order provisions, public safety and health or to protect the rights of third parties, in the cases and to the extent provided for in the applicable laws on the matter, or by means of a resolution of the competent authority, duly founded and reasoned.

Notification of changes to the privacy notice

Penske reserves the right to modify this Privacy Notice in the future to comply with legislative updates, case law, internal policies, new requirements issued by the authority. Any changes to this notice will be notified to you by e-mail, posting, notification at Penske affiliates and in the section of our privacy policy that can be found on the following web page:

https://www.gopenske.com/privacy/

This notice also applies, where applicable, as a compensatory measure to all employees who, prior to July 10, 2010, already had a relationship with Penske.

This Privacy Notice complies with the requirements established in the Federal Law for the Protection of Personal Data in Possession of Individuals in force.

Date Last Update: April, 2018