Privacy Policy

KIUVOPAY S. DE R.L. DE C.V. ("Kiuvopay"), with registered address at Calzada Legaria 549, Floor 4, Colonia 10 de Abril, Alcaldía Miguel Hidalgo, Mexico City, Mexico, Postal Code 11250, is responsible for the use and protection of your personal data. In accordance with the laws of the United Mexican States, we inform you of the following:

• When you act on behalf of a commercial entity, we refer to you as a Merchant.
• When you conduct commercial activities with a commercial entity but not directly with Kiuvopay, we refer to you as an End User.
• When you act as a service provider for Kiuvopay, we refer to you as a Supplier.

Consent

By accepting this Privacy Notice, you expressly consent to the use of your personal data solely for the purposes defined in this document.

The use of the data you provide includes its storage — meaning its preservation in a record or database maintained by Kiuvopay or by third parties — and its processing, which includes any automated or non-automated operation that enables the collection, storage, recording, organization, structuring, extraction, comparison, interconnection, dissociation, assignment, transfer, transmission, or deletion of personal data.

Declaration

By accepting this Privacy Notice, you declare that you are of legal age and that the data provided is truthful and accurate. If you wish to modify your information, please notify us as soon as possible following the procedure described below.

We do not intentionally collect personal data from individuals under 18 years of age through our website.

What Personal Data Do We Use, How Do We Obtain It, and For What Purposes?

1. Merchant

Kiuvopay, as the data controller, collects the following information through our website, email, or other provided channels:

• (a) General personal data: Full name, nationality, email address, valid identification document, tax identification number and/or equivalent, phone number, employment information, and other similar data.
• (b) No sensitive personal data is collected.

We will use this data for the following primary purposes, which are necessary for the services you request:

• I. Account creation on the Kiuvopay website;
• II. Onboarding process, including review and approval by the Compliance department in accordance with Kiuvopay's internal policies;
• III. Generation of the necessary documentation to formalize the commercial relationship;
• IV. Provision of contracted services;
• V. Updating personal data and legal documentation of your company;
• VI. Prevention of money laundering, fraud detection, and combating illicit activities against you or against Kiuvopay;
• VII. Legal reviews and due diligence;
• VIII. Communication to fulfill our service obligations;
• IX. Analysis to improve Kiuvopay's services;
• X. Marketing, advertising, or commercial prospecting regarding our services or those of third parties;
• XI. Service surveys to evaluate and improve the quality of our products and services; and
• XII. Compliance with Kiuvopay's legal obligations.

2. End User

Kiuvopay provides services to commercial entities that, directly or indirectly, provide us with personal data of end customers. When we act as data processors, we handle such data in accordance with our contract with those entities.

These entities are responsible for ensuring the privacy rights of their customers, including properly informing them about the collection and use of their data. If you are an End User, please refer to the privacy policy of the commercial entity with which you are dealing.

Personal data provided to us directly or indirectly (via API, email, or other methods) may include:

• (a) Identification data: Full name, email address, phone number, postal address, official identification document, and other similar data;
• (b) Transaction data: Date, amount, payment method, country of transaction, status, and other related data.
• (c) No sensitive personal data is collected.

We use this information to:

• I. Identity verification and authentication;
• II. Transaction processing;
• III. Prevention of money laundering, fraud detection, and combating illicit activities;
• IV. Handling complaints, claims, and suggestions; and
• V. Compliance with Kiuvopay's legal obligations.

We will not send you commercial communications without your prior consent.

3. Supplier

Kiuvopay collects the following data via email or other provided communication channels:

• (a) Identification and contact information: Full name, nationality, email address, official identification document, phone number, employment data, and other similar information.
• (b) No sensitive data is collected.

We use this information for the following primary purposes, which are necessary to formalize the contractual relationship:

• I. Identity verification and authentication;
• II. Onboarding process, including review and approval by the Compliance department in accordance with Kiuvopay's internal policies;
• III. Generation of documentation to establish the commercial relationship;
• IV. Payment processing;
• V. Legal reviews and due diligence; and
• VI. Compliance with Kiuvopay's legal obligations.

Legal Basis for Processing Personal Data

Kiuvopay relies on the following legal bases for the processing of personal data:

• (a) Contractual and pre-contractual commercial relationships: Processing is necessary to formalize commercial relationships and fulfill contractual obligations.
• (b) Legitimate commercial interests: As permitted by applicable legislation, data is processed to comply with Kiuvopay's legal obligations, including fraud prevention and service delivery.
• (c) Consent: When you provide your personal data as a representative of a commercial entity, your consent authorizes such processing.

Data Retention Period

Your personal data will be retained only for as long as strictly necessary to fulfill the intended purposes or as required by law.

Data Transfers

Kiuvopay may share your personal data with other entities within the Kiuvopay corporate group that operate under the same internal standards, procedures, and policies, in order to ensure the effective delivery of services.

We may also share your data with data processors such as service providers or business partners with whom we have a legal relationship. Kiuvopay ensures that these third parties comply with the same data protection standards that we uphold.

Kiuvopay does not transfer data to third parties except where required or permitted by law, such as for reasons of public interest, legal proceedings, or regulatory compliance purposes.

International Data Transfers

Your personal data may be stored outside your country of residence by our service providers or Kiuvopay group companies, for the purposes described in this Privacy Notice. Any international transfer will comply with applicable legal safeguards and Kiuvopay's internal security policies.

How Can You Exercise Your Privacy Rights?

As a representative, you have the right to know what personal data we hold about you, how we use it, and under what conditions (Right of Access). You also have the right to request corrections (Right of Rectification), deletion (Right of Erasure), and to object to certain processing activities (Right to Withdraw Consent). These rights are recognized under the Personal Data Protection Act (PDPA).

You may also withdraw your consent at any time. Please note that withdrawing consent for certain purposes may affect our ability to provide you with the requested services or result in the termination of your relationship with Kiuvopay.

To exercise your rights under the PDPA or to withdraw your consent, please write to us at operations@kiuvopay.com, attaching the following:

• I. Full name of the data subject;
• II. A copy of your official identity document (both sides);
• III. If acting through a legal representative, a simple power of attorney signed by the data subject, the representative, and two witnesses, along with copies of their respective identification documents;
• IV. A clear and precise description of the personal data and the right you wish to exercise.

Requests will be responded to within 20 business days from the date of receipt. If approved, your request will be fulfilled within the following 15 business days after our response.

If your request is incomplete or lacks necessary documentation, you will be notified within 5 business days to correct the deficiencies. You will then have 10 business days to submit the corrected information; otherwise, the request will be considered not filed.

Personal Data Security

Kiuvopay has implemented technical and organizational security measures to prevent the loss, theft, alteration, or unauthorized access to your personal data. These measures include access controls, minimization of personnel with access to the data, and cybersecurity tools such as firewalls and antivirus software.

How Will You Be Informed About Changes to This Privacy Notice?

This Privacy Notice may be modified due to new legal requirements, business needs, changes in our privacy practices, or other reasons. We will notify you of any changes or updates through an informational notice on our website, by email, or through other available technological means.