Web page

Grupo Aeroportuario del Centro Norte, S.A.B. de C.V. and its affiliated and subsidiary companies (hereinafter “OMA”), in compliance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (the “Law”), its Regulation, and other applicable legal provisions, committed to the confidentiality, lawful processing and control of your personal data and collected information, hereby informs you of how we obtain such information, what we do with it and how we protect it, and provides information on how you can exercise your rights of access, rectification, cancellation and opposition (“ARCO”).

OMA, with address at Avenida Patriotismo número 201, Piso 5, Colonia San Pedro de los Pinos, Alcaldía Benito Juárez, C.P. 03900, Ciudad de México, México, is responsible for safeguarding the privacy of the data you provide to us as a user, informing you that your information will be processed exclusively for the purposes specified below, in accordance with the Law, its Regulation, and other applicable legal provisions.

Our personal data protection and processing department is located at:

• Attention: Juan Fernando Espinosa

• datospersonales@oma.aero

• Patriotismo número 201, Piso 5, Colonia San Pedro de los Pinos, Alcaldía Benito Juárez, C.P. 03900, Ciudad de México, México.

OMA does not collect personally identifying information about individuals except when users of the websites www.oma.aero and www.parking.oma.aero (the “OMA Sites”) voluntarily provide information by registering on such sites, by logging in via social networks such as Facebook and Twitter, or by sending an e-mail or other communication addressed to OMA.

The personal data collected may be used to respond to technical or service needs; to provide the user with updates on the status of flights operated at the thirteen airports managed by OMA, as well as airlines and routes; to inform about the different establishments located inside the airports; travel information, security, migration and customs procedures; hotel reservations; information about services provided at the airports such as monetary services, baggage wrapping; business services and activities and related information that are OMA's purpose. In turn, your personal data may be used to conduct surveys about the contracted service, to receive promotional information about the products and services offered by OMA, or its partners and affiliated companies by e-mail or via social networks, all with the purpose of providing you with better service.

Personal identification data collected by the OMA Sites will not be sold or supplied to third parties without the consent of the users of such Sites. Additionally, users of the OMA Sites will have the opportunity to "opt out" of receiving promotional information about the products and services offered by OMA or its partners and affiliated companies.

Despite its general policy of not disclosing personally identifying data to third parties, OMA may disclose certain personal data: (a) when OMA has reason to believe that the disclosure of such information is necessary to identify, communicate with, or take legal action against someone who may be harming or obstructing (whether intentionally or not) the rights or property of OMA, other users of the OMA Sites, or any third party; (b) as necessary to enforce and comply with the Terms and Conditions of use of the OMA Sites; (c) as required by law; or (d) as otherwise indicated by OMA on the OMA Sites.

When requested, OMA will take reasonable steps to allow users to update or correct the personal data they have previously submitted and that are no longer valid. In addition, when the user so requests, OMA will take reasonable commercial steps to systematically delete the user's record and personal data from the database; however, it may be impossible to completely erase the user's data due to backups and records of deleted data.

You are informed that the OMA Sites collect cumulative statistical data about visitors, and that such data may be used for market research and other activities. In addition, OMA may share cumulative and anonymous data with promotional, business or advertising partners. Except for any request made by a user to "opt out" of receiving promotional information, OMA reserves the right to communicate with an affiliate about the status of your account, changes in the affiliate agreement and other matters relevant to the Site and/or the information provided by a user.

You are informed that, if you do not agree with the processing of your personal data for the purposes mentioned, you have a period of 5 days from the date you disclose your personal data to expressly notify the personal data protection and processing department of OMA through the means indicated in this notice, since, if you fail to do so, you will be deemed to have given tacit consent.

Among the personal data that OMA may request are, among others, those listed below:

• Full name
• Contact telephone numbers
• Email address
• Other contact information

You are informed that the data collected by OMA are not sensitive in nature, therefore if you do not agree with the processing that OMA will give to your personal data, you must express your opposition through the means indicated in this notice, since, if you fail to do so, you will be deemed to have given tacit consent.

OMA is guided by the principles of legality, quality, consent, information, purpose, loyalty, proportionality and responsibility established by the Law and its Regulation, with the purpose of collecting the data that the user voluntarily provides when registering on the OMA Sites, or when sending an e-mail or other communication addressed to OMA. In turn, OMA may obtain personal information through lawful means established by the law, such as public databases or any other public agency or source of information.

The OMA Sites use cookies in connection with certain features or functions. Cookies are text files automatically downloaded and stored on the user's computer hard drive when browsing a specific web page, which allow the Internet server to remember some data about this user, including their preferences for displaying pages on that server, username and password.

Web beacons, for their part, are images embedded in a web page or e-mail, which can be used to monitor a visitor's behavior, such as storing information about the user's IP address, duration of interaction time on that page and the type of browser used, among others.

It is established that the installation, permanence and existence of cookies on the client's or Site user's computer depend on their exclusive will and can be deleted whenever they wish.

There is a possibility that OMA may allow other companies that present advertisements or other functions on the OMA Sites to obtain access to the cookies on your computer. You are informed that OMA does not control third-party cookie policies.

We inform you that we may use cookies and web beacons to obtain personal information from you, such as the following:

• Your browser type and operating system;
• The web pages you visit;
• The links you follow;
• The IP address; and
• The site you visited before entering any of the OMA sites

At all times, you may prohibit the use of cookies and web beacons so that we stop using them. To do so you must expressly notify the personal data protection and processing department of OMA through the means indicated in this notice, since, if you fail to do so, you will be deemed to have given tacit consent.

In order for you to limit continuing to receive information about promotions, offers and additional services that we offer by e-mail or through social networks, such as Facebook or Twitter, as well as the use and disclosure of the data collected by OMA, we provide the following means: (i) the registration of data in the Public Registry, which is managed by the Procuraduría Federal del Consumidor ("PROFECO"), with the purpose that your personal data are not used to receive advertising or promotions from companies of goods and services. For more information about this registry you can consult PROFECO's website or contact that agency; (ii) your registration on an exclusion list, so that your personal data are not processed for marketing, advertising or commercial prospecting purposes by OMA.

If you require more information or wish your data to be included on an exclusion list, you must follow the following procedure:

1. Submit a written request addressed to the personal data protection and processing department of OMA, which must contain at least the following information:
   1. Full name of the holder.
   2. Address of the holder of the personal data or email, by which the response to your request can be sent.
   3. Official documents proving the identity of the holder or their representative, as well as the powers and faculties in which the proper representation of the legal representative is recorded.
   4. Make the express request that your data be registered on an exclusion list.
2. Send the request to the personal data protection and processing department, located at Avenida Patriotismo número 201, Piso 5, Colonia San Pedro de los Pinos, Alcaldía Benito Juárez, C.P. 03900, Ciudad de México, México or to the email: datospersonales@oma.aero

You have the right to access the personal data we hold about you and the details of their processing; you may also request the rectification of your personal information if it is inaccurate or incomplete, to cancel them from our records and databases when you consider they are not required or are being used for any of the purposes indicated in this Privacy Notice, and finally you may object to the use and processing of your personal data when they are being used for purposes not consented to or the contractual or service relationship has ended.

To exercise your rights of access, rectification, cancellation or opposition, it is necessary to follow the following procedure, in accordance with Article 29 of the Law:

• Submit a written request addressed to the personal data protection and processing department of OMA, which must contain at least the following information:
  • Full name of the holder.
  • Address of the holder of the personal data or email designated for notifications.
  • Official documents proving the identity of the holder or their representative, as well as the powers and faculties in which the proper representation of the legal representative is recorded.
  • A clear and precise description of the personal data with respect to which you seek to exercise any of your rights.
  • Any other element or document that facilitates the location of the personal data, as well as any other document required by current legislation at the time of submitting the request.
  • A contact telephone number.
• Send the request to the personal data protection and processing department, located at Avenida Patriotismo número 201, Piso 5, Colonia San Pedro de los Pinos, Alcaldía Benito Juárez, C.P. 03900, Ciudad de México, México or to the email: datospersonales@oma.aero

OMA will have a term of twenty business days following the date of receipt of the request to resolve the admissibility or inadmissibility of the request, whose resolution will be communicated by e-mail addressed to you, sent to the e-mail address you have indicated in your request or by sending a letter to the physical address you have indicated for such purposes.

OMA will at all times have the right to extend the aforementioned term on one occasion for an equal period, provided it is justified and the circumstances of the case so require.

If the request is declared inadmissible, it must be accompanied by the respective evidence. When the request is admissible, the exercise of the requested right will be effected within fifteen business days following the date on which the adopted resolution was communicated.

OMA may deny the exercise of ARCO rights in the following cases:

1. When the requester is not the holder or the legal representative of the legal entity does not prove the legal existence of the entity represented or its powers and faculties are not sufficient to exercise the rights in question.
2. When the requester's personal data are not found in OMA's databases.
3. When the rights of a third party are harmed.
4. When there is a legal impediment or resolution of a judicial or administrative authority.
5. When the rectification, cancellation or opposition has been previously carried out so that the request lacks subject matter.

Likewise, OMA will not be obliged to cancel your personal data when any of the following cases apply:

• When they refer to the parties to a private, social or administrative contract and are necessary for its development and fulfillment.
• When they must be processed by legal provision.
• When judicial or administrative proceedings related to tax obligations, investigation and prosecution of crimes or the updating of administrative sanctions would be hindered.
• When they are necessary to protect the legally protected interests of the holder.
• When they are necessary to carry out an action in the public interest.
• When they are necessary to comply with an obligation legally acquired by the holder, and
• When they are the object of processing for the prevention or diagnosis of medical conditions or the management of health services, provided that such processing is carried out by a health professional subject to a duty of secrecy.

If you consider that your personal data have been breached, or that your request to exercise ARCO Rights was not properly attended by OMA, you have the right to go before the Instituto Nacional de Acceso a la Información to initiate a data protection procedure.

At any time, you may revoke the consent you have given OMA for the processing of your personal data by following the following procedure:

1. Submit a written request addressed to the personal data protection and processing department of OMA, which must contain at least the following information:
   1. Full name of the holder.
   2. Address of the holder of the personal data or email by which the response to your request can be sent.
   3. Official documents proving the identity of the holder or their representative, as well as the powers and faculties in which the proper representation of the legal representative is recorded.
   4. Expressly state the request to revoke consent for the processing of personal data, stating the reasons why you wish to do so.
2. Send the request to the personal data protection and processing department, located at Avenida Patriotismo número 201, Piso 5, Colonia San Pedro de los Pinos, Alcaldía Benito Juárez, C.P. 03900, Ciudad de México, México or to the email: datospersonales@oma.aero

We will address your request within a maximum period of twenty days and will inform you of its admissibility through the means indicated in your request.

By this means OMA informs you that your personal data may be transferred to third parties only by: (i) your express consent, (ii) by resolution or order of a judicial or administrative authority and (iii) when it is personal information that by provision of a law is considered public.

The OMA Sites may contain links to other Internet sites. The use of information collected by these sites, as well as the use of cookies and web beacons, is entirely the responsibility of the third-party websites. This Privacy Notice is valid and applicable exclusively to the OMA Sites.

OMA reserves the right to make changes or updates to this Privacy Notice at any time, which may be made in order to address legislative developments, internal policies or new requirements for the provision or offering of our services.

These changes will be made available to the public through the following means: (i) through the OMA Sites; or (ii) physically at the address of the personal data protection and processing department of OMA, at OMA's discretion. The modifications will take effect immediately as soon as any of the circumstances established in this paragraph occur.

You are informed that once the purpose(s) of the processing of personal data have been fulfilled, and when there is no legal or regulatory provision to the contrary, the data will be canceled after blocking them, for their subsequent deletion.

OMA has implemented physical, technological and administrative security measures to protect your personal data from unauthorized processing. To this end, the information you provide us is stored in databases that have the necessary security technology to prevent information leaks.

OMA will do everything within its reach to protect the privacy of information and your personal data. It may happen that, by virtue of court orders or legal regulations, OMA is obliged to disclose information to authorities or third parties, in which case OMA will not be responsible for the information that is disclosed in such ways.

By using the OMA Sites, you indicate that you accept this Privacy Notice. If you do not accept the Privacy Notice, do not use the OMA Sites. This Privacy Notice does not create any legal or contractual right, nor does it intend to do so.

This Privacy Notice complies with all current provisions stipulated in the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, its Regulation, and other applicable legal provisions.