Privacy Notice

The company that owns the PagoBoom application (hereinafter, "PagoBoom", "we", "our"), in accordance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter, the "LFPDPPP") and other applicable laws, is responsible for the use and protection of your personal data (as defined below). In this regard, it expressly informs you of the following:

PagoBoom will collect from you (hereinafter the "Data Owner" or "you") the following personal data (hereinafter the "data" or the "personal data") in your capacity as one of our customers:

• •Contact data: cell phone number, email, personal address, emergency contact references (including name and phone number).
• •Identification data: full name, date and place of birth, nationality, Unique Population Registry Code (CURP), image capture (facial photograph), official identification, marital status.
• •Tax data: Federal Taxpayer Registry (RFC) and other related tax data (income and expenses through access to your Tax Administration Service account).
• •Location and geolocation data: approximate location of your mobile device, time zone.
• •Work and educational data: occupation, level of education.
• •Data from your cell phone or mobile device: hardware information, International Mobile Equipment Identity (IMEI), IP address, MAC address, device network environment, Wi-Fi connection, device status, international mobile subscriber identity, device memory information, and the Advertising Identifier (AD_ID).
• •Device usage data: list of running applications along with details (metadata including application name, package name, installation and update time, version name and code).
• •Property and financial data: income or data or documents of your employment, bank accounts, purpose or use to be given to the loan, type of business.
• •Data you provide in your loan application.
• •Transactional data of the operations you carry out with us or through us, as well as of the operations you carry out with money transmitters, electronic payment fund institutions, credit institutions and other financial institutions.

PagoBoom does not directly request racial or ethnic origin, health, philosophical or religious beliefs, union membership, political opinions or sexual preferences data. However, we collect information related to your text messages and images that incidentally may contain sensitive personal data. We collect the following sensitive data:

• •Biometric data: facial recognition elements, such as the Data Owner's facial photo and captures of identity documents, in order to corroborate their identity and validate it for security and fraud prevention purposes.
• •Data of persons with different abilities: collected for the purpose of providing ease and speed in the contracting and/or service process.

Personal data will be obtained and updated through:

• •When you download the PagoBoom application (hereinafter, the "App") and/or request a loan from us;
• •Your other interactions with us, including personal data that you voluntarily share with our customer service department or with our employees and agents;
• •Your cell phone or mobile device when you grant access and permissions as described below;
• •Credit bureaus or agencies to prevent fraud;
• •Cookies, web beacons and other remote means of automatic data collection;
• •Money transmitters, electronic payment fund institutions, crowdfunding financing institutions, credit institutions and other financial institutions and electronic commerce, with your consent, when necessary; and/or
• •Third parties and other public sources, with your consent, when necessary.

Primary Purposes

The primary purposes (hereinafter, the "Primary Purposes") that give rise to and are necessary for the maintenance and fulfillment of the legal relationship between PagoBoom and you are the following:

• •Verify your identity, prevent fraud and comply with our "know your customer" obligations under the applicable anti-money laundering laws;
• •Create your credit profile and assign you a credit rating to determine whether you are eligible to use PagoBoom's products and services;
• •Carry out the identification and knowledge through the collection of personal data, as well as the integration of your file that will be kept in PagoBoom's technological infrastructure and information systems and in other archives;
• •Incorporate personal data into legal instruments, comply with the contracts you enter into with PagoBoom, including, but not limited to, certain user contracts of our application and platforms and the loan or credit contracts between the Data Owner and PagoBoom, and administer and manage said contracts;
• •Originate, manage, service, maintain and enforce the Data Owner's debts;
• •Provide you with services and manage your account with PagoBoom and give you customer support;
• •Send you transaction information or transaction notifications, payment reminders and announcements through automated telephone services or pre-recorded messages, text messages or email;
• •Assign or transfer to a third party, by any means, the rights and/or obligations arising from the aforementioned contracts;
• •Use personal data in any type of act or judicial or extrajudicial collection proceeding;
• •Comply with all applicable laws, regulations and general provisions;
• •Investigate changes in your transactional profile;
• •Fraud prevention;
• •Obtain personal data to improve PagoBoom's credit models, its data models and other services;
• •Analyze customer behavior and maintain the quality of our services;
• •Use the information to resolve disputes related to loans, serving as evidence of the existence of the loan relationship before dispute resolution institutions.

Secondary Purposes

The secondary purposes (hereinafter, the "Secondary Purposes") that are not necessary for the maintenance and fulfillment of the legal relationship between PagoBoom and you, are the following:

• •Sending news, invitations to events of PagoBoom, its subsidiaries and affiliates;
• •Conducting surveys and market studies to improve our service;
• •Use of images and testimonials that you voluntarily provide us for advertising purposes; and
• •The marketing, advertising and/or promotion of the products and/or services offered by PagoBoom to the Data Owner, by any material and/or electronic means. With your consent to this Privacy Notice you grant your express consent so that we may contact you for the purpose of offering you financial services.

Your consent is necessary for the secondary purposes. If you do not agree with the use of your contact data for said secondary purposes, send us an email to customer_care@pagoboom.mx. We will wait five business days before using your personal data for secondary purposes.

Depending on your Android or iOS operating system and the version of the application installed on your device, the PagoBoom application may access the following device permissions. Always keep your PagoBoom application updated so that you can use the most recent and secure features.

Personal data will be transferred nationally and internationally, to the persons or entities located in the following types, categories or sectors, for the following purposes:

• •A. PagoBoom and its group: to other holding companies, subsidiaries or affiliates, or to a parent company or to any company of the same PagoBoom group, that operate under the same internal processes and policies, for the purpose of making use of shared services within the PagoBoom group and also to: i. Carry out the identification and knowledge through the collection of the Data Owner's personal data, as well as the integration of the personal data into PagoBoom's technological infrastructure; ii. Incorporate the Data Owner's personal data into legal instruments and comply with the Data Owner's obligations; iii. Assign or transfer to a third party the rights and/or obligations arising from the contracts; iv. Use personal data in judicial or extrajudicial collection proceedings; v. Comply with all applicable laws and regulations; vi. Prospect and assess personal data to create a credit rating; vii. Obtain information to improve our credit model; viii. Investigate changes in your transactional profile; ix. Fraud prevention; x. Originate, manage and enforce the Data Owner's debt.
• •B. Competent authorities: to competent national and foreign authorities, for the purpose of complying with any applicable law, regulation or legal provision, as well as for the purpose of preventing harm.
• •C. Portfolio acquirers or financiers: to third parties that acquire PagoBoom's credit portfolio or that grant financing to PagoBoom for the purpose of enabling PagoBoom to obtain financing or resources.
• •D. Investors and acquirers: to third parties interested in granting financing or acquiring the shares or assets of PagoBoom or of its shareholders or affiliates in Mexico or around the world or in merging with PagoBoom.
• •E. Business partners: with our business partners, for commercial prospecting purposes and related services offered by PagoBoom and to give you access to the services of third parties within the PagoBoom application.

Likewise, and in accordance with current laws, PagoBoom must transfer from time to time, credit information of the Data Owner to the Credit Information Companies or Credit Bureaus, and in this sense, by accepting this Privacy Notice and consenting to the execution of the User Contract, you confirm that we may transmit your information to said Credit Information Companies or Credit Bureaus, including information about the breach of the executed contracts.

We also share your personal data with third-party service providers related to disbursements, the transfer of funds, payment services, information security providers, insurers, collection firms, accounting and legal advisors, software providers for data analysis, transfers and storage services and other service providers that process your personal data on behalf of PagoBoom.

I expressly authorize PagoBoom to carry out investigations of:

• •my credit behavior;
• •information relating to account movements on government services (social security, taxes, housing savings, among others).

I state that I know the nature and scope of the information that will be requested, of the use that will be given to it and that periodic consultations of my credit history may be carried out. I consent that this authorization has a validity of 3 years counted from today, and where applicable while the legal relationship is maintained. I accept that this document remains under the property of PagoBoom for purposes of control and compliance with article 28 of the Law to Regulate Credit Information Companies (LRSIC).

Please consider that it will not be necessary to have your consent to carry out: (i) the transfer indicated in sections A and B of the previous section, as it falls within the case established in section IV of article 37 of the LFPDPPP and (ii) those transfers that fall within the cases established in Article 37 of the LFPDPPP. We also do not require your consent to share your Personal Data with processors such as the service providers mentioned above.

To carry out the transfers in sections C, D and E of the previous section, we do require your consent. You grant your consent for these transfers by accepting this Privacy Notice.

You, by yourself or through your duly accredited legal representative, may exercise your rights of access, rectification, cancellation or opposition to the processing of your personal data (the "ARCO Rights"). To do so, you may request an ARCO Rights exercise form by sending an email to the address customer_care@pagoboom.mx, to the attention of the Personal Data Protection Department/Customer Service Team, or to the PagoBoom address indicated in this Notice with the name and contact data of the Data Owner.

The form must be accompanied by the following:

• •Your valid official identification (National Electoral Institute Credential, Passport, National Military Service Card or Professional License).
• •In cases where the exercise of the ARCO Rights is carried out through your legal representative, the official identification of the representative must be accompanied, as well as the corresponding notarized power of attorney that accredits the legal representation conferred by the Data Owner.
• •When you wish to exercise the right of rectification, the documentation that accredits the requested change according to the personal data to be rectified must be exhibited.

PagoBoom will respond to said form after 20 business days counted from the date on which it was received. This period may be extended for up to 20 additional business days, when the case warrants it, with prior notice to you. PagoBoom will communicate the resolution adopted through the options chosen by you in the ARCO Rights exercise form. If the request is deemed appropriate, it will become effective within the following 15 business days.

In the event that you wish to revoke your consent or refuse the processing of your personal data for the Secondary Purposes, subsequent to the signing and acceptance of this Notice, you must send an email to the address indicated in the previous section to the Personal Data Protection Department/Customer Service Team, customer_care@pagoboom.mx, following the procedure for the Refusal of Processing and Revocation of Consent described in this Notice.

In accordance with the above, the Personal Data Protection Department/Customer Service Team is responsible for handling all requests to exercise the ARCO rights.

PagoBoom has created an exclusion list for persons who do not wish to receive advertising from PagoBoom. If you receive advertising from PagoBoom and do not wish to continue receiving it, you may send an email with your full name to customer_care@pagoboom.mx, requesting your removal from the distribution list on the basis of which the sending of information or advertising is carried out.

You may also register in the Public Registry of Users of the National Commission for the Protection and Defense of Users of Financial Services (CONDUSEF). For more information, visit the official CONDUSEF page.

We make some decisions in relation to our products and services in an automated manner without the intervention of a natural person in the assessment.

I. Loan granting decisions. When you request a loan, we will use an automated process to decide whether we lend money and/or for decision-making regarding your eligibility for our products or services. Our credit review and granting processes use artificial intelligence to process your personal data and assess your creditworthiness. The processing of your personal data is automated without human intervention or assessment. The use of said automated processes to verify your creditworthiness means that we can automatically decide that you are not eligible for a loan or for a particular term or conditions. Our underwriting and credit granting models are tested regularly to ensure that they are fair, accurate and unbiased.

II. Fraud detection. PagoBoom also uses automated processes to detect, combat and prevent fraud. Our fraud detection models automatically decide whether a person may represent a risk of fraud or money laundering. If our fraud detection models, when processing a transaction or approving a credit, detect risk, it is possible that the person's access will be refused.

III. Your rights. If you request a credit and are rejected based on an automated decision, you have the right to access your information and rectify it by contacting us as established in the ARCO Rights section.

This Notice is published for your consultation, on the PagoBoom website and App. Likewise, the modifications that are made at any time to this Notice will be published at said address.

By clicking the "ACCEPT" button below, the Data Owner grants their express consent under the terms of this Notice and therefore, consents that their Personal Data be processed by PagoBoom in accordance with the provisions of this Notice, intended for the purposes indicated herein and transferred to the third parties established herein.