The company owning the PagoBoom application, in order to protect the personal data of its clients and users, as well as its use, storage and confidentiality, in accordance with the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter "LFPDPPP") and other applicable provisions, is responsible for processing the following personal data of its clients and/or users (hereinafter "Data Subjects"):

Personal data subject to processing

  • •Identification data;
  • •Contact data;
  • •Financial data;
  • •Patrimonial data;
  • •Employment data;
  • •Academic data;
  • •Migration data; and
  • •Geolocation data.

The personal data listed above consists of: full name, address, date and place of birth, nationality, Unique Population Registry Code (CURP), Federal Taxpayers Registry (RFC), phone number; email address; marital status; education level; employment; geolocation data; patrimonial data; social media data when authorized by the Data Subject; income and expenses through access to the Tax Administration Service account and/or bank accounts; reason for the requested credit; type of business; emergency contact references; and calendar, including the agenda.

Additionally, the following will be collected:

Sensitive Personal data subject to processing

  • •Biometric data; and
  • •Data of persons with different abilities.

The sensitive personal data listed above consists of: biometric data comprising facial recognition elements, such as the Data Subject's facial photo, in order to verify their identity and validate it for security purposes. Consent will be requested to access the camera to capture images. For example, we will collect the Data Subject's facial photograph after a successful live detection, primarily to prevent fraud and ensure that the loan was requested by the individual themselves.

In order to protect the biometric information of Data Subjects, the biometric data we collect (such as facial data) will be stored on our servers and retained for the period required by applicable law and for the provision of the service. Such period shall be no less than the term of the loan nor more than ten (10) years or the applicable statute of limitations.

We store facial data primarily to ensure the proper performance of the loan and present it as evidence of the existence of a lending relationship to dispute resolution institutions, such as courts or arbitration committees in the event of disputes with the Data Subject related to loans. For dispute resolution and file management purposes, courts and arbitration committees will use the relevant information in accordance with the requirements of applicable laws and for the period required by applicable law. Except as mentioned above, we will not share the Data Subject's biometric data, such as facial data, with third parties.

Sensitive personal data of persons with different abilities will be collected for the purpose of providing Data Subjects with an accessible and efficient contracting and service experience.

Means of Collecting Personal data subject to processing

The personal data mentioned above will be collected through the PagoBoom website and/or the mobile application available to you (hereinafter the "App"), through text messages, or by any other electronic, telephone, computer, video or other technology means (hereinafter "Electronic Means"). Such data will be used automatically and/or simultaneously at the time the Data Subject interacts with them, in order to provide the services and/or products offered by PagoBoom (hereinafter the "Services"), in compliance with the provisions of this Privacy Notice.

Device permissions accessed

Contacts

We will not access your contact list. We will ask for your emergency contact information, including name and phone numbers, etc., to enhance your credit profile. Before providing this information to PagoBoom, please ensure that the person you are listing as an emergency or reference contact has consented to sharing their information, as by providing it to us, the Data Subject guarantees they have obtained consent for the processing of their data in accordance with the scope of this Privacy Notice.

The information mentioned is used for customer evaluation and auditing, for the purpose of fraud prevention. With the information provided, the audit system is strengthened and the approval process is accelerated, thus providing a better service for customers. Furthermore, we promise that we will only call your authorized emergency contact if we are unable to reach you when you are behind on your loan payment. The sole purpose is to transmit relevant information to you or obtain your valid contact information. We will not provide any information about your account to third parties.

We will not read the Data Subject's call records under any circumstances.

Location

We will collect approximate location information from your device to facilitate the loan application service and provide personalized offers. We will collect approximate location data when the App is running in the foreground on your device in order to auto-fill your address information. When the App is in the background, we will stop collecting your geolocation data. You can always choose to disable location tracking on your mobile device.

Camera

We do not access stored photos and videos, but your consent to access the camera is required. Granting camera permissions allows us to capture images/videos and thus expedite the loan application process. If access is not permitted, images cannot be taken or updated.

SMS

We use only the Data Subjects' financial text messages to automatically complete the verification code during the financial account validation process when adding the beneficiary's bank account; other text message data will be filtered and relevant content involved in our storage (if any) will be deleted.

PagoBoom will obtain the text message information stored on your device (including the timestamp, phone number and message content). These messages will be uploaded and stored on servers. If you disagree, you may refuse to grant the permission or disable the corresponding authorization in the settings.

PagoBoom uses this information in its credit and underwriting models to determine your eligibility for our service. We use automated processing to understand your financial activity, and this also helps our fraud models verify your identity. PagoBoom will never share the content of your text messages, except as permitted by applicable exceptions.

Call log

When Data Subjects use the voice verification code function to register or access their accounts, we will need to obtain permission to access the Data Subjects' call logs (e.g., call duration, call number, call status). This is to verify that the SIM card on which the Data Subjects receive the voice verification codes can effectively use and receive the corresponding verification codes, and to verify the consistency of SIM cards and devices, thereby reducing the risks of account theft and fraud.

All collected data will be stored on our servers and, except in the cases established in this document, we will not share such data with third parties.

Device information

Device information includes the International Mobile Equipment Identity (IMEI), device brand, model, operating system version, unique device identifier, device network environment, WiFi connection, device status, international mobile subscriber identification, application software information, and device memory information. This allows us to ensure that other phones cannot replace the primary device when applying for a loan, thereby preventing fraud. In addition, authorization to access this information helps us identify your user profile and preferences to recommend appropriate credit products.

Installed apps

We need metadata information from each installed application, including the app name, package name, installation time, update time, version name and version code of each application installed on the device to evaluate your credit and provide you with personalized pre-approved loan offers. However, under no circumstances will we access the apps installed on your device, and we will attempt to obtain the required information through other lawful and reasonable means.

Calendar

Authorization to access your calendar helps us remind you of the payment due date.

Account deletion

You may request the closure and deletion of your "PagoBoom Account" (understood as your user profile in the PagoBoom mobile application) through the Personal Center – Delete Account section within the App. PagoBoom reserves the right to deny the request when it cannot be verified, when your PagoBoom account has an outstanding loan balance or is under investigation, or when we have any other legal basis to retain your PagoBoom account and the customer data associated with said account.

Under anti-money laundering regulations, PagoBoom is required to retain customer information for at least ten (10) years. Notwithstanding deletion requests for a PagoBoom account, PagoBoom will retain customer information records (such as: customer AML profile information and identification records and transaction records) until the legal retention period has expired.

Express and tacit consent for the processing of personal data

The processing of personal data is subject to the express or tacit consent of the Data Subject, except for the exceptions provided by the LFPDPPP. In accordance with the provisions of Article 8 of the LFPDPPP, consent shall be tacit when, having been made available to the Data Subject, they do not express any opposition, and shall be express when the Data Subject manifests it verbally, in writing, through electronic, optical or any other technology means, or through unequivocal signs.

The Data Subject of the personal data provided to PagoBoom declares that they have read and fully understood the terms and scope of this Privacy Notice, that they are aware of the categories of personal data collected, as well as the purposes for the processing of their personal data, the transfers made by PagoBoom, and that they freely consent to the processing of their personal data under the terms described in this Privacy Notice.

Likewise, it will be understood that by using the physical, electronic, digital and any other means made available to the Data Subject for contracting the products and/or services offered by PagoBoom, the Data Subject expressly consents to the processing of their personal data in accordance with the content of this Privacy Notice.

Primary purposes for the processing of personal data

PagoBoom requires the Data Subject's personal data for the following purposes:

  • •To conduct background checks, validate and confirm information provided by the customer for contracting any of the Services, and identify the Data Subject;
  • •To create their user profile in the App, verify and investigate the Data Subject's creditworthiness, and generate a credit score, credit model and user model;
  • •To administer, operate and follow up on the Services contracted by the Data Subject;
  • •To initiate and maintain correspondence with the Data Subject through Electronic Means, to facilitate loan processing from application, review, follow-up, payment, collection and other corrective measures;
  • •To carry out customer service activities for the Data Subject, including resolving complaints and attending to requests and queries;
  • •To maintain internal records, for internal or external audits;
  • •To execute, monitor, administer and analyze the App and develop, improve and update the features, functions, products and services in the App;
  • •To monitor or record telephone calls and interactions with the Data Subject for quality control, employee training, performance evaluation and identity verification;
  • •To carry out business intelligence, conduct market research, provide visibility into their activity on our Electronic Means, quality monitoring of our Electronic Means, and evaluation and improvement of our Electronic Means;
  • •To inform about Service updates, and to send communications through our Electronic Means related to contracted Services;
  • •To facilitate the identification, granting, operation, management, administration, collection, sale, disposition, transmission, assignment, transfer, negotiation, encumbrance and/or any other legal action of credit rights against the Data Subject and in favor of PagoBoom;
  • •To prevent and/or detect fraud or any other unlawful act provided for in Mexican laws;
  • •To use for resolving loan-related disputes, including, among others, serving as evidence of the existence of a lending relationship;
  • •To comply with legitimate business purposes and obligations established by applicable Mexican law and competent authorities; and
  • •Any other purpose necessary for the proper provision of the Services contracted by the Data Subject with PagoBoom.

Secondary purposes for the processing of personal data

  • •To send offers, promotions and advertising for new, related or complementary financial products and services offered by PagoBoom, PagoBoom's local affiliates and/or PagoBoom's partners through text message (SMS), phone call, email and/or any other digital, electronic, printed, audio or other format;
  • •To conduct market studies enabling PagoBoom to understand and determine the location, preferences and demographics of customers to develop special offers, products or marketing programs in relation to products and services; and
  • •Preparation and implementation of activities to measure the quality of the Services.

Validity and accuracy of information provided

Submission of truthful and accurate information

The Data Subject must submit their information, including personal data, and verify that it is truthful, accurate and not misleading, as well as keep it updated and inform us of changes as soon as possible. We reserve the right to request additional documentation to verify the information you have provided.

Voluntary submission of personal data

We can only collect your personal data if you voluntarily send us the information. If you choose not to send us your personal data or subsequently withdraw your consent for us to use your personal data at any time, we may not be able to offer you some or all of the services available.

Timely update of information

The Data Subject agrees to inform us immediately and, in any case, within 14 calendar days, in writing, if there is any change in the information provided at the time of the loan application.

Transfer of personal data

The transfer (including cross-border transfer) refers to communications of personal data made to companies other than PagoBoom or, alternatively, to subsidiaries, affiliates or parent companies under common control of PagoBoom. PagoBoom may eventually share the Data Subject's information with:

  • •Parent companies, subsidiaries, affiliates, or any other company operating under the same internal processes and policies;
  • •Credit Information Bureaus;
  • •Competent authorities, as provided in applicable legislation;
  • •National Electoral Institute for validation of identification data;
  • •Notaries Public;
  • •Business partners contracted for advertising and marketing of Services;
  • •Third parties contracted for collection management;
  • •Service providers providing Audit services;
  • •The Mexican Postal Service;
  • •Another company in the event of acquisition, merger or any other similar transaction;
  • •Domestic and foreign business partners with whom contracts have been entered into for the marketing of Services;
  • •Third parties including fund lenders, payment partners, post-loan partners, verification service providers, financial entities, for portfolio assignment or discount, endorsement or any other form of credit portfolio negotiation;
  • •Dispute resolution institutions such as courts and arbitration committees; and
  • •Any other of the cases established in Articles 10 and 37 of the LFPDPPP.

Means to exercise ARCO rights

The Data Subject or their legal representative may request Access, Rectification, Cancellation or Opposition to the processing of their personal data in the cases provided by the LFPDPPP at any time.

PagoBoom may deny the exercise of ARCO rights in the cases permitted by the LFPDPPP and its regulations.

The request must be submitted in writing and must contain and be accompanied by the following:

  • •The Data Subject's name and address or other means to communicate the response to their request;
  • •Documents proving the identity of the Data Subject or, where applicable, their legal representative;
  • •A clear and precise description of the personal data for which the exercise of ARCO rights is sought; and
  • •Any other element or document that facilitates locating the personal data.

Once the request has been submitted, PagoBoom will issue its determination within no more than 20 (twenty) business days from receipt. If the request is admissible, it will be implemented within 15 (fifteen) business days following the date on which PagoBoom communicates the response.

Mechanisms to revoke consent for the processing of personal data

The Data Subject may revoke the consent previously granted to PagoBoom by submitting a written request in free format with handwritten signature, which will not have retroactive effect. A valid official identification document must be attached. The revocation will only apply to those purposes that are not necessary for fulfilling obligations arising from financial products and services contracts, and whose data PagoBoom is not required to retain by law.

Use of cookies, web beacons and other technological mechanisms

The PagoBoom website uses cookies. Cookies are data files stored on your hard drive while browsing the website, and are used to exchange information about the portal status and the Data Subject's browser information. Through cookies, PagoBoom measures information about the Data Subject visiting the page, collecting geographic information, operating system, browser and medium used to access the page.

Security of data collected by PagoBoom

PagoBoom values the personal data collected, used, retained and stored through the App. PagoBoom has implemented technical, organizational and physical measures to protect your personal data. We also take reasonable measures to prevent unauthorized access, loss, misuse or alteration of your information by third parties. All collected data will be stored on our servers. This process is fully protected through HTTPS encryption.

Means to limit the use or disclosure of personal data

Data Subjects wishing to limit the use or disclosure of their personal data have at their disposal the request provided for the exercise of ARCO rights and the revocation of consent for personal data. Similarly, the Data Subject may refuse to have their personal data used for unnecessary purposes. Additionally, if you do not wish to receive any promotional information from us, you may contact us to unsubscribe from promotions at any time by sending us an email.

Improper processing of personal data

If the Data Subject considers that their right to the protection of personal data has been harmed by any act or omission by PagoBoom, or suspects any violation of the LFPDPPP, its Regulations and other applicable provisions, they may file a complaint or report with the National Institute of Transparency, Access to Information and Protection of Personal Data. For more information, we suggest visiting the official website www.inai.org.mx.

Changes to the privacy notice

Updates, modifications and/or changes to this Privacy Notice made in accordance with applicable law will be made available to customers through publication on the Website and in the App. It is recommended that Data Subjects who use the services and visitors to the App periodically review the Website or App to stay informed about information collection and use policies and practices.

Last Updated: September 1, 2025