Aviso de Privacidad de GRUPAGO

Dear Customer and/or Merchant:

GRUPAGO, [*] (hereinafter "GRUPAGO"), makes available our Privacy Policy (the "Notice"), so that you are aware of the type of personal data we will handle, the purposes for which we will handle it and the security measures with which we will protect them, and the security measures with which we will protect them, with the intention of preserving their privacy and maintaining the standard of reliability you expect from the GRUPAGO platform. We publish this Policy in compliance with the Federal Law for the Protection of Personal Data in the Possession of Individuals (the "Law"), the Regulations of the Federal Law for the Protection of Personal Data in Possession of Individuals (the "Regulations"), the Federal Civil Code (the "Code") and other Mexican applicable provisions.

GRUPAGO is the "Accountable" for collecting, managing and safeguarding the personal data ("PD") and Sensitive Personal Data ("SPD") that you freely and spontaneously provide us, at any moment and by any communication channel. As well as the Metadata ("MD") that is collected directly or indirectly through the use of the platform.

The Accountable for the treatment of your personal data, in other words, GRUPAGO, for the effects of this Notice, indicates as its address the located at [*].

We will treat the PD and/or SPD that you provide us and the MD collected by our platform, only when you purchase, distribute and/or use our platform, in accordance with the following:

What are the PD and SPD we will be handling?

Those that any of the users of our platform, whether Clients or Merchants, share with us, which can be PD and/or SPD of the Clients and/or Merchants.

Such PD and/or SPD that we may handle include, but are not limited to: (i) full name; (ii) address; (iii) e-mail address; (iv) phone and cell number; (v) date of birth; (vi) CLABE (bank account number); and (vii) name of bank account holder.

Additionally to the aforementioned, the Accountable may handle the following PD and/or SPD to carry out the delivery of the products acquired by the Client: (i) full name; (ii) e-mail address; (iii) phone and cell number; and (iv) address.

In terms of MD, only when these can be obtained using GRUPAGOs platform, the Accountable will collect the following information from the Client, including but not limited to: (i) IP address; (ii) ID of the device used in the platform; (iii) type of electronic device used; (iv) Merchant selling the products; (v) order value; and (vi) items included in the order.

All PD, SPD and/or MDs will be collected by us when using our platform and/or in conjunction with the information provided to the applicable principal Merchant for the purpose of fulfilling its business relationship with the Client. Said PD, SPD and/or MD will be treated only for storage purposes in the platform and in no case will they be transferred, analyzed, disclosed and/or used by GRUPAGO beyond the terms stated in this Notice.

For what will your PD, SPD and/or MD be used?

We will handle your PD, SPD and/or MD, only to fulfill the commercial relationship between the Merchant and the Client and deliver the products acquired by the Client and make the corresponding payment to the Merchant.

Will we transfer PD, SPD and/or MD to third parties?

GRUPAGO will transfer the SPD related to the CLABE (bank account number) and name of the holder of the Clients bank account to its service provider [Arcus Financial Intelligence, Inc.] for the purpose of carrying out the transfer of resources to pay for the products purchased by the Client. This transfer is made in compliance with Article 37 of the Law by virtue of being made to fulfill the commercial relationship between the Customer and the Merchant.

Security Measures and Management System for PD, SPD and/or MD:

GRUPAGO makes its best efforts to protect the integrity of the PD, SPD and/or MD that it may store, through the implementation of physical, administrative and technical security measures, regarding all the information that we keep, and use provided by you to our staff.

Exercise of "A.R.C.O." rights:

You, as the owner of the PD, SPD and/or MD collected by the Accountable, may exercise the rights of Access, Rectification, Cancellation and Opposition (known as "ARCO Rights") over the PD, SPD and/or MD provided to the Accountable and/or collected by it, by sending a of exercise of said rights to the following e-mail address: [*] in which we will attend the requests you make regarding the treatment of the PD, SPD and/or MD stored on the platform.

The request for access, rectification, cancellation or opposition must contain and be accompanied by the following: (i) your name and address or e-mail address to communicate our response; (ii) documents proving the identity of the Client and/or Merchant exercising the right; (iii) the clear and precise description of the PD, SPD and/or DM for which it seeks to exercise any of the aforementioned rights; (iv) any other element or document that facilitates the location of the PD, SPD and/or DM in question; and (v) the modifications to be made in the event that the request is for the rectification of PD, SPD and/or MD. Once we have received your request duly integrated, you will be informed of the determination adopted on the same, within a maximum period of 20 (twenty) working days, counted from the date on which your request has been received in the e-mail account indicated in the immediately preceding paragraph. In the event that your request is accepted, it will be effective within 15 (fifteen) working days following the date on which you are notified of its acceptance. The above in the understanding that the terms previously referred to may be extended once, when the particularities of the case so require, in GRUPAGOs judgment. These procedures will be free of charge for you.

Likewise, you may revoke, at any time, the consent previously granted to GRUPAGO for the treatment and/or transfer of the PD, SPD and/or MD; as well as limit the use or disclosure of the same, by sending an e-mail to the address indicated in the paragraph corresponding to the Exercise of "ARCO" Rights.

GRUPAGO will use all the means at our disposal to make you aware of this Policy in a timely manner so that you may, if necessary, give your consent or object to some degree of information management.

GRUPAGO reserves the right to make, at any time, modifications, or updates to this Policy in order to improve the quality in the treatment of PD, SPD and/or MD or when, for business reasons or legal dispositions, it is required; publishing in our website the duly updated Policy.

Consent of the Holder:

It shall be understood that the Client and/or Merchant who uploads PD, SPD and/or MD to GRUPAGOs platform grants its consent for them to be processed in accordance with the purposes set forth in this Notice and for purposes of fulfilling its contractual relationship with the Client and/or Merchant, as applicable, and therefore GRUPAGO shall not be required to obtain additional consent for the processing of its PD, SPD and/or MD unless this Notice is modified and required by Law.

This Privacy Policy is issued based on the Federal Law for the Protection of Personal Data in Possession of Individuals; its Regulations; as well as other provisions on the subject. If you consider that your right to the protection of personal data has been violated by any conduct of GRUPAGO or our actions or responses, or if you presume that in the treatment of your personal data there is any violation to the provisions of the laws of the matter, you may file the corresponding complaint or denunciation at the INAI (National Institute for the Protection of Personal Data). For more information visit www.inai.org.mx