Privacy Notice — Tres Piedras 

Version 2.0 | Last updated: March 2026

I. Identity and Address of the Data

Controller
Krono-Zam S. de R.L. de C.V. (hereinafter, “Tres Piedras”), with its address at Paseo de los Cedros 22-E, Colonia La Floresta, Zamora, Michoacán, C.P. 59616, Mexico, and with Federal Taxpayer Registry (RFC) KRO191002UD2, is the data controller responsible for the processing and protection of your personal data.

For any questions about the processing of your data, you may contact us through the following:

• Email: [email protected]

• Phone / WhatsApp: +52 351 351 5831

• Business hours: Monday through Friday, 9:00 a.m. to 6:00 p.m. (CST)

II. Scope of Application and Markets

This notice applies to all individuals who interact with the website https://trespiedras.mx, as well as with any other digital platform operated by Tres Piedras, including Amazon and other sales platforms.

Tres Piedras conducts commercial operations in Mexico, the United States, Canada, and Spain. Depending on your country of residence, additional rights and protections may apply, as described in Section VII of this document.

III. Personal Data Processed

To fulfill the purposes described in this notice, we process the following categories of personal data:

Identification and contact data: full name, delivery address, phone number, email address.

Tax data: RFC, tax address, tax regime, and legal name (business name), collected only when the user requests the issuance of a tax receipt.

Payment and transactional data: credit or debit card information, account data on payment platforms, purchase history. Tres Piedras does not store bank card data directly; processing is carried out entirely through the certified platforms indicated in Section VI.

Browsing and device data: IP address, browser type, operating system, cookie identifiers, pages visited within the site, session duration, and approximate geolocation information.

Communication data: messages sent through the contact form, WhatsApp, or email.

Tres Piedras does not process special categories of personal data (health data, racial or ethnic origin, religious beliefs, biometric data, or sexual orientation) and does not aim to collect data from minors under 18 years of age. If you are a minor, please do not provide your personal data without the consent of your parents or legal guardians. If we detect data from minors provided without authorization, we will delete it immediately.

IV. Purposes of Processing and Legal Basis

A. Primary Purposes

These are necessary to formalize and perform the commercial relationship. Their legal basis is the performance of a contract (for Mexico: LFPDPPP Art. 8; for users in Spain/EU: Art. 6(1)(b) GDPR; for Canada: PIPEDA Principle 4.3).

1. Process, confirm, and manage orders and purchases.

2. Ship and deliver products to the indicated address.

3. Process payments and issue tax receipts when applicable.

4. Provide customer service, including follow-up on inquiries, complaints, exchanges, returns, and warranty.

5. Manage the creation and administration of user accounts.

6. Comply with legal obligations and respond to requests from competent authorities. Additional legal basis: legal obligation (Art. 6(1)(c) GDPR for users in the EU).

B. Secondary Purposes

These are optional and do not affect the provision of the service. Their legal basis is the user’s consent (for Mexico: LFPDPPP Art. 8; for Spain/EU: Art. 6(1)(a) GDPR).

1. Send marketing communications, promotions, and news by email or other digital means.

2. Conduct statistical analyses and market research to improve products, services, and user experience.

3. Personalize the browsing experience on the website.

4. Retargeting and personalized advertising through digital platforms.

If you do not want your data to be processed for these secondary purposes, you may state so at any time by emailing [email protected] or through the preference options available when creating your account. Your choice does not, under any circumstances, affect the provision of contracted services.

V. Data Retention Periods

Personal data is retained for the time necessary to fulfill the purposes for which it was collected, considering the following criteria:

• Transaction and purchase data: retained for a minimum of five years, in accordance with tax obligations established in the Federal Tax Code (Mexico) and equivalent provisions in destination countries.

• User account data: while the account remains active. Upon requesting account cancellation, the data is deleted within the following 30 business days, except for data that must be retained due to a legal obligation.

• Browsing data and cookies: according to the expiration periods defined in the Cookies Policy, which range from the active session to a maximum of 24 months for analytics cookies.

• Customer service communications: up to three years from case closure, for quality purposes and to address potential claims.

After these periods, the data is securely deleted or anonymized for statistical use.

VI. Disclosure of Data to Third Parties

Your personal data is shared with the following recipients, solely for the purposes indicated:

Tres Piedras does not sell personal data to third parties. The disclosures above are necessary for the provision of the service or are carried out based on legal obligations. For disclosures that involve sending data to countries with legal frameworks different from Mexico’s, Tres Piedras verifies that recipients have appropriate data protection policies.

VII. Data Subject Rights

A. ARCO Rights (applicable to all data subjects under the LFPDPPP)

You have the right to:

• Access: know what personal data we have about you and how we process it.

• Rectification: request the correction of inaccurate or incomplete data.

• Cancellation: request the deletion of your data when it is no longer necessary for the purposes for which it was collected.

• Opposition: object to the processing of your data for specific purposes.

To exercise any of these rights, send a request to [email protected] or contact us at +52 351 351 5831, including: your full name, an email address to receive our response, an official ID, and a description of the right you wish to exercise. We will respond within 20 business days following receipt of your request, in accordance with the LFPDPPP.

B. Additional rights for users in Spain and the European Union (GDPR)

If you reside in Spain or another European Union country, you have the following additional rights:

• Data portability: receive your data in a structured, commonly used format to transfer it to another controller.

• Restriction of processing: request that we suspend processing while a dispute about its accuracy or lawfulness is resolved.

• Erasure (“right to be forgotten”): request deletion of your data when it is no longer necessary, when you withdraw consent, or when processing is unlawful.

• Withdrawal of consent: you may withdraw consent at any time for secondary purposes, without affecting the lawfulness of processing carried out prior to withdrawal.

• Complaint to a supervisory authority: you have the right to file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you believe the processing of your data does not comply with applicable regulations.

These rights are exercised by emailing [email protected]. We respond within a maximum of 30 calendar days, in accordance with Art. 12 GDPR.

C. Rights for users in California, U.S. (CCPA/CPRA)

If you reside in California, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Know the categories of personal data collected and the purposes of its processing.

• Request deletion of your personal data.

• Correct inaccurate personal data.

• Opt out of the sale or sharing of your personal data. Tres Piedras does not sell or share users’ personal data with third parties for commercial purposes.

• Not be discriminated against for exercising your privacy rights.

To exercise these rights, contact [email protected]. We will respond within 45 calendar days of your request.

D. Rights for users in Canada (PIPEDA / Quebec Law 25)

If you reside in Canada, the processing of your data is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) at the federal level. If you reside in Quebec, Law 25 also applies (An Act to modernize legislative provisions as regards the protection of personal information), fully in force since September 2023.

Your rights include:

• Access your personal data and request corrections.

• Withdraw your consent for processing for secondary purposes.

• Request deletion of your data when it is no longer necessary.

• Be notified in the event of a privacy incident that could create a real risk of significant harm to you, in accordance with Quebec Law 25.

• File a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or with the Commission d’accès à l’information du Québec (CAI) if you reside in that province.

International transfers from Canada: your data is processed on servers located in Mexico, the United States, and other countries. Before making these transfers, Tres Piedras verifies that recipients apply comparable safeguards. You may request information about applicable safeguards by writing to [email protected].

VIII. Cookies and Tracking Technologies

The website trespiedras.mx uses cookies and similar technologies for the following purposes:

• Strictly necessary cookies: enable basic site functionality (shopping cart, login). They do not require consent.

• Analytics cookies: collect aggregated information about browsing behavior to improve the site (Google Analytics). They require consent.

• Advertising and remarketing cookies: enable personalized ads on third-party platforms (Meta, Pinterest, Google Ads). They require consent.

When you enter the site for the first time, you will be presented with a cookie management panel where you can accept, reject, or customize the use of each category. You can also change your preferences at any time via the cookie settings link available in the site footer.

In addition, you can disable cookies through your browser settings, although doing so may affect the operation of certain sections of the site.

For users in Spain and the EU, the use of non-essential cookies is suspended until you provide your express consent, in accordance with the GDPR and the ePrivacy Directive.

IX. Security Measures

Tres Piedras implements reasonable technical, administrative, and physical measures to protect your personal data against unauthorized access, loss, alteration, or disclosure, including:

• Encryption of data in transit using SSL/TLS protocols.

• Payment processing exclusively through certified platforms with the PCI-DSS standard.

• Restricted access to personal data based on operational need.

• Periodic security reviews of systems that store data.

In the event of a security incident that may pose a risk to your rights and freedoms, Tres Piedras will notify affected data subjects and, when applicable, the competent supervisory authorities, within the timeframes established by the legislation in force in each country.

X. Photos and Video Recordings at Events

If you attend exhibitions, fairs, pop-up events, or any promotional event of Tres Piedras, photographs may be taken and/or video recordings may be made at the event. These images may be used for dissemination and promotion on social media, the website, and communication materials. Your participation in such events implies consent for this processing, unless you expressly state otherwise.

XI. International Data Transfers

Some of our service providers and technology platforms have their servers outside Mexico, mainly in the United States. When your data is transferred internationally, Tres Piedras ensures that such transfers are carried out under mechanisms that guarantee an adequate level of protection, such as standard contractual clauses or data processing agreements, as applicable.

For users in Spain and the EU: transfers to countries outside the European Economic Area are carried out under the safeguards provided in Art. 46 GDPR (standard contractual clauses approved by the European Commission).

XII. Changes to the Privacy Notice

This notice may be updated at any time to reflect changes in our practices, applicable legislation, or the services we offer. When changes are material, we will notify you through a visible notice on the website or, when possible, via an email to registered users.

The current version is always the one published at https://trespiedras.mx/us/privacy-policy

XIII. Contact and Supervisory Authorities

Tres Piedras — Krono-Zam S. de R.L. de C.V. [email protected] | +52 351 351 5831 Paseo de los Cedros 22-E, Col. La Floresta, C.P. 59616, Zamora, Michoacán, Mexico

Supervisory authorities by country:

• Mexico: National Institute for Transparency, Access to Information and Protection of Personal Data (INAI) — www.inai.org.mx

• Spain / EU: Spanish Data Protection Agency (AEPD) — www.aepd.es

• Canada: Office of the Privacy Commissioner of Canada — www.priv.gc.ca; Commission d’accès à l’information du Québec (CAI) — www.cai.gouv.qc.ca

• U.S. (California): California Privacy Protection Agency (CPPA) — www.cppa.ca.gov

This privacy notice complies with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations, the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and Quebec’s Law 25.