CEMEX will not sell or share your Personal Information with non-affiliated third parties for their own marketing purposes without your consent. If CEMEX is involved in any merger, acquisition, sale of company assets, transition of service to another provider, or insolvency, bankruptcy or receivership, we have a legitimate interest in transferring your Personal Information in connection with such transaction. Also, CEMEX may disclose your information (including your Personal Information), as necessary, to regulators, courts, legal advisers and law enforcement authorities (1) if we determine a policy violation has occurred, including to enforce the CEMEX API Terms and Conditions of Use and Developer Portal Terms and Conditions; (2) if we believe such disclosure is necessary to identify, contact or bring legal action regarding injury or interference with the rights and property of CEMEX, including to enforce CEMEX’s rights against unauthorized access or attempted unauthorized access to CEMEX’s information technology assets or against other inappropriate use of the Services; (3) to comply with laws, regulations, court orders and subpoenas or similar requests for information by authorities, or as otherwise required by law; (4) to protect your safety and the safety of others; and (5) to assist us in fraud prevention or investigation. We have a legitimate interest in sharing the Personal Information of EU users for purposes (1) and (2).

3. Portal Data and API Data

In addition to the uses described above, CEMEX may use, and we have a legitimate interest in using, Portal Data and API Data to improve the Portal and the APIs and to help CEMEX understand how users are using the Portal and the APIs. This information is also collected for statistical analysis, to improve the utility of the Portal and the APIs, and for other purposes described in this Privacy Statement.

V. OPTING-OUT OF OUR MAILING LIST

CEMEX will only send you marketing or promotional communications and/or communications about other topics if you have provided your consent to receive these types of communications. To contact you, CEMEX may use the information you provide to us, including email, address, fax or phone. You may, at any time, inform us that you no longer want CEMEX to contact you for marketing purposes by sending your request to us using the contact information in the “Contact Us” section below. You may also opt-out of promotional email communications by clicking on a link provided in the promotional email message. After opting-out, you will no longer receive marketing or promotional communications but will continue to receive other messages, such as emails relating to your account or use of the Services.

VI. TRACKING

Certain web browsers may provide a do-not-track (“DNT”) option. You may be able to ask your browser to inform websites that you do not wish your activities to be tracked, either with cookies or other persistent identifiers, commonly called “DNT signals.” The Portal currently does not respond to DNT signals. However, the Portal does not track your online activities over time and across different websites.

VII. SAFEGUARDING YOUR INFORMATION

CEMEX is committed to maintaining the security of the data you provide us. However, please note that there is always some risk in transmitting information over the Internet. Because the Services are provided through the Internet, when you use the Services, your communications may be intercepted by others. For this reason, CEMEX cannot guarantee the security and privacy of transmissions via the Internet, and we will not be liable for any lack of security relating to the use of the Services by you. You agree that you will not hold CEMEX liable for any damages resulting from any loss of privacy or security occurring in connection with any communications over such networks.

VIII. TRANSFERS OF PERSONAL INFORMATION OUTSIDE OF THE EEA

CEMEX is a worldwide service. By using our Services, you authorize us to transfer and store your information outside of your home country, including in the EEA, for the purposes described in this Privacy Statement. Where we transfer Personal Information from the EEA to a country that do not provide an adequate level of protection, we will only do so under appropriate safeguards put in place to protect your information, such as standard contractual clauses or Privacy Shield certification. Personal Information may be transferred mainly to Mexico and the United States. If you would like more information about these safeguards or where to gain access to a copy of these safeguards, please contact us using the information in the "Contact Us" section below.

IX. AUTOMATED DECISION-MAKING

We do not envisage that any decisions will be taken about you using automated means.

X. HOW LONG WE KEEP YOUR PERSONAL INFORMATION FOR

We only keep your Personal Information for as long as we need it to provide the Services to you and fulfil the purposes described in this Privacy Statement. This is also the case for anyone that we share your Personal Information with and who carries out Services on our behalf. To determine the appropriate retention period for your Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable requirements.

In relation to the foregoing, we will keep your Personal Information for as long as you have an active account in the Portal and, unless otherwise expressly stated in this Privacy Statement, for one year after you have deleted your account and stopped using the Services. When we no longer need to use your Personal Information as mentioned above and there is no need for us to keep it to comply with our legal or regulatory obligations, we'll either remove it from our systems or depersonalize it so that we can't identify you.

XI. EXCLUSIONS

The Portal may contain links to websites owned by other companies. Because CEMEX has no control over the privacy practices or content of these linked sites, we recommend that you carefully review the privacy statement of each website you visit. CEMEX is not responsible for the content or privacy practices of websites owned by other companies.

This Privacy Statement addresses CEMEX’s procedures for handling the Personal Information of customers who have reached the age of majority. We do not seek to, nor do we knowingly collect, information from children. If a child has provided us with Personal Information, a parent or guardian of that child may contact us to have the information deleted from our records. To do so, contact CEMEX through the information provided below in the “Contact Us” section.

XII. CONTACT US

CEMEX has a Chief Privacy Officer located in Mexico, as well as Data Protection Officers in European countries where we have operations. You may contact CEMEX’s data privacy office at any time if you have questions, general concerns about the processing of your personal information, or any data protection issue, by sending an e-mail to dataprivacy@cemex.com.

Additionally, for the benefit of EEA data subjects and pursuant to article 27 of the General Data Protection Regulation, we have appointed CEMEX España, S.A. (“CEMEX España”), a Spanish corporation that has a registered address at Hernandez de Tejada, 1 28027 Madrid, Spain, as our representative in the EU. If you are an EEA data subject, you may address CEMEX España as to any issues relating to the processing of your Personal Information under this Privacy Statement in addition to or instead of the controllers mentioned above which are located in Mexico. Please consider that any information, including Personal Information, sent to CEMEX España under this Privacy Statement may be shared with PwC as CEMEX España’s advisor for personal data protection matters in Europe. You can contact CEMEX España by sending an e-mail to dataprivacyeurope@cemex.com.

If you are a Mexican user and you consider that we have infringed upon your personal data protection rights, you have the right to make a complaint to the Personal Data Transparency, Access and Protection National Institute (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales). For more information, please visit www.inai.org.mx.

If you are an EEA user and you feel that we have not answered your concerns appropriately you have the right to make a complaint to your local data protection authority. Contact details for EU data protection authorities can be found here.

If you are located elsewhere and consider we have infringed upon your personal data protection rights, please contact your local data protection authority for more information on how to exercise your right to file a complaint.

In any case, we would appreciate the chance to deal with your concerns before you approach the corresponding data protection authority, so please contact us in the first instance.

XIII. UPDATES TO PRIVACY STATEMENT

From time to time, we may update this Privacy Statement. If we do, we will note near the top of this page the date that any changes are made and/or when they become effective. If the changes being made are material, we may alert you to the changes in a more prominent way. Your inaction or continued use of the Services, including access of the Portal, after any such notices, will tell us that you agree to these changes.