Privacy Policy

Data Privacy Notice

Concepcion Industrial Corporation (“CIC,” “We”) is a publicly listed holdings company. We respect your
privacy and are committed to protecting the personal data you share with us.

This Notice explains what personal data we collect, why we collect it, how we use it, and what your rights
are. It applies to information collected through the CIC website and any direct communications you initiate with us.

HOW WE COLLECT PERSONAL DATA

We collect personal data (full name, company name and address, email address, contact numbers) from
your inquiries through the Contact Us page of the CIC website.

This applies to inquiries under the following categories:

Purpose	Legal Basis
Investor Relations Respond to investor inquiries, send required disclosures, reports, and filings, and maintain accurate investor records for compliance and audit purposes	Consent, Legal Obligation, Legitimate Interest
Corporate Partnerships & CSR Engage potential partners, sponsors, and CSR collaborators. Communicate relevant corporate opportunities and maintain business relationships aligned with CIC’s strategy.	Consent, Legitimate Interest
Media Relations Identify and verify media representatives, respond to press inquiries, distribute official statements, and maintain an up-to-date media contact list.	Consent, Legitimate Interest
Recruitment Process job applications, verify qualifications, schedule interviews, and maintain a talent pool for current and future vacancies.	Consent, Legal Obligation, Legitimate Interest

WHO WE SHARE YOUR DATA WITH

We only share your personal data when necessary, and only with:

• Regulatory bodies and government agencies (e.g., SEC, PSE) as required by law
• External legal counsel or auditors supporting compliance and regulatory filings
• CIC’s internal teams handling investor relations, corporate compliance, business development,
  and communications
• Third-party service providers engaged to support CIC’s official corporate activities (e.g., PR
  agencies, event partners)

We do not sell your personal data to third parties.

HOW LONG WE KEEP YOUR DATA

We keep your personal data only for as long as needed to fulfill the purpose it was collected for, or as
required by law. As a general rule, we retain data for a maximum of 10 years from your last transaction
or interaction with us.

Once your data is no longer needed, we will securely dispose of it — either by shredding physical
documents or permanently deleting electronic records.

HOW WE PROTECT YOUR DATA

We use appropriate technical and organizational safeguards to protect your personal data, including:

• Secured IT infrastructure for data storage and processing
• Locked storage for physical files
• Encryption and security technologies where applicable
• Strict data privacy requirements imposed on our service providers

YOUR RIGHTS AS A DATA SUBJECT

As data subjects, it is important that you are aware of your rights and how to exercise them:

• Right to be informed: You have the right to be notified and furnished with information before
  processing your personal data.
• Right to access: You have the right to request access to the personal data we hold about you.
  This allows you to verify the lawfulness of processing and to understand how your information is
  being used and you may limit the use or transfer of the personal data We hold about you.
• Right to rectification: If you believe that any personal data, we hold about you is inaccurate or
  incomplete, you have the right to request corrections or updates.
• Right to erasure or blocking: Under certain circumstances, you have the right request the
  deletion of your personal data including deletion of your registered account.
• Right to object: As a data subject, you have the right to object to the processing of your personal
  data when such processing is based on consent or legitimate interest. You may also withdraw
  consent for receiving direct marketing communications.

Additionally, you have the option to close your account or request deletion of your personal data. In
such cases, we will make reasonable efforts to delete or de-identify your personal data, as permitted by
applicable law. Please note that if you choose to withdraw consent entirely or request deletion of your
data, we may not be able to continue providing services to you. This action may also lead to the
termination of any agreements with Us.

• Right to portability: You have the right to receive your personal data in a structured, commonly
  used, and machine-readable format, and to transmit it to another controller.
• Right to file a complaint: If you feel your personal data has been misused, maliciously disclosed,
  improperly disposed, or that any of your data privacy rights have been violated, you have the
  right to file a complaint with the National Privacy Commission.
• Right to damages: You have the right to receive compensation for any damages you have
  sustained due to inaccurate, false, and unlawfully obtained or unauthorized use of your personal
  data.

If you wish to exercise any of the rights described above, please email dpo@cic.ph. We aim to respond
to your requests within one (1) month.

UPDATE AND REVISIONS TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time as our business or legal requirements change. We
encourage you to review it periodically. Any changes will not apply retroactively to data already
collected, unless required by law.

CONTACT US

If you have any comments or questions or if you wish to access, correct, update or ask for a copy of
personal information we hold about you, or if you have questions about Concepcion’s privacy practices
in general, please email dpo@cic.ph.