VIABO Comprehensive Privacy Notice

AGILE PAYMENTS, S.A.P.I. DE C.V., Mexican tax identification number (RFC) APA241113CE2, operating under the trade name VIABO, is the data controller for the processing described in this notice, under the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and other applicable provisions in Mexico.

Address for receipt of notices: Rio Missouri 500, Colonia del Valle Sector Norte. CP.66268 San Pedro Garza García, Nuevo León.

Personal data inquiries: pay@viabo.com

WhatsApp for support and communications: +52 81 4681 1481

Website: https://www.viabo.com

VIABO provides software, digital platforms, application programming interfaces (APIs), integrations and support. In the services covered by this notice, VIABO does not take deposits or hold, invest or manage users’ funds. Services involving the handling or movement of funds are provided by the relevant service providers under their contractual arrangements and applicable legal framework.

Processing or displaying information about accounts, balances, payments or instructions enables the technological connection with those providers and does not amount to VIABO holding funds in custody. This distinction does not remove VIABO’s data protection obligations or any liability imposed on it by law.

When we process data solely on behalf of a business client and under its documented instructions, we act as a data processor. In that case, the client determines the purposes and must make its own privacy notice available; VIABO retains its security and confidentiality obligations. This notice covers processing whose purposes VIABO determines on its own behalf.

We collect information through forms, platform registration and use, authorized integrations, email and WhatsApp. We may also receive information from the business client that enables your access or from the connected provider, where there is a legal basis for sharing it. Depending on the requested feature, we process the following categories and only the data needed:

Identification and contact details: name, email, telephone number, address, date of birth, nationality, Mexican tax identification number (RFC), Unique Population Registry Code (CURP) and government-issued identification, where required to enable the feature or verify identity.

Representation and documentation: position, authority to act as a representative, signature and personal data contained in powers of attorney, corporate documents and identification files required for the requested service.

Account and technical activity: user identifier, authentication data, roles, permissions, IP address, device and browser information, access logs, dates, activity, errors and security events.

Connected transaction information: account holders and beneficiaries, account and payment method identifiers, Mexican standardized bank account number (CLABE), institution, amounts, references, supporting documents, instructions, balances and transaction statuses. For integrations that require them, public wallet addresses and networks.

Support and billing: the contents of requests, messages and files submitted for support, and tax information needed to invoice technology services.

This notice does not authorize the collection of sensitive personal data or biometric data. If a feature requires such data, before collecting it we will explain which data is needed, its purpose and who will process it, and obtain express written consent where required. Do not send passwords, PINs, authentication codes, private keys or private e.firma electronic signature files by email or WhatsApp.

We use data exclusively to provide, maintain and protect the requested technology services and meet the obligations associated with them:

• Create and manage digital access, authenticate users and configure profiles and permissions.
• Configure and implement platforms, APIs and integrations; verify the identity and documentation needed to enable those features.
• Transmit instructions and exchange information with providers selected by the user; display statuses and generate reports, logs and data reconciliations.
• Handle requests and incidents, restore access and send operational, maintenance and security communications.
• Detect unauthorized access, technology-related fraud and failures; monitor performance and improve service stability. For general improvement analyses, we use information that has first been de-identified so that individuals cannot be identified.
• Manage the contracting and billing of technology services, document instructions and comply with legal obligations and requests from authorities applicable to VIABO.

We do not include secondary purposes such as advertising, sales prospecting or the sale of databases. This notice also does not authorize the use of your data to promote financial products or train artificial intelligence models for purposes unrelated to the requested service. Any new purpose will require prior information and any consent required by law.

We process your data with the appropriate consent or under an applicable legal exception. We will obtain express consent for financial or asset-related personal data, unless a statutory exception applies. Visiting the website or reading this notice does not replace the express authorizations that must be obtained for specific processing.

If you do not provide information essential to a feature, that feature may not be enabled; this does not authorize additional processing or affect rights you may exercise through other means.

Hosting, infrastructure, authentication, cybersecurity, support and communications providers that process data on behalf of VIABO may access what they need for their tasks, in Mexico or abroad, subject to instructions and obligations concerning confidentiality, security and limited processing. These disclosures to processors are distinct from transfers to third parties that determine their own purposes.

Domestic or international transfers to independent data controllers are limited to the following categories and purposes:

• Financial entities, payment institutions, issuers, payment processors and connected service providers: to receive the information needed to enable or provide the service you request, verify its requirements and communicate transaction results. The identity of the relevant provider will be disclosed in the applicable process or contract.
• Competent authorities: to respond to valid requests and comply with legal obligations, to the extent applicable.

Transfers needed to fulfill the legal relationship or comply with a legal obligation will take place without consent only where a statutory exception applies. Otherwise, before transferring data, we will identify the recipient, the data and the purpose, and request a specific decision to accept or decline. You may refuse these transfers; your authorization is not presumed merely because you browse the website.

We will communicate this notice and the applicable processing conditions to the recipient. Providers acting as independent data controllers must disclose their own processing activities and channels for exercising rights. VIABO retains the obligations applicable to the data it shares or processes.

We adopt administrative, technical and physical measures proportionate to the nature of the data and the associated risks to protect its confidentiality, integrity and availability, limit access and respond to incidents. Personnel and processors with access to information are subject to confidentiality obligations. If a breach significantly affects your economic or non-material rights, we will notify you without delay so that you can take action.

We retain data for as long as needed to provide the service and address incidents, legal obligations and liabilities arising from the relationship. Once those purposes end, we will securely delete or de-identify the data; where a retention obligation applies, the data will remain blocked with restricted access for the applicable period. We will not retain information indefinitely solely because you were once a client.

You may access your data, request its rectification or cancellation, and object to its processing in the circumstances provided by law. These are known as Access, Rectification, Cancellation and Opposition (ARCO) rights. You may also withdraw your consent and request limits on the use or disclosure of your information.

Submit your request to the personal data contact at pay@viabo.com or through WhatsApp at +52 81 4681 1481, stating that it concerns privacy. Include your name, a way to receive a response, the right or request you wish to exercise, and information that allows the data to be located. Except when requesting access, describe the data concerned. For rectification, specify the correction and provide supporting documentation.

You must verify your identity and, if acting through a representative, their identity and authority. We will indicate a secure way to submit that documentation; information unrelated to the request is not required. No specific request form is required.

We will respond to ARCO requests within a maximum of 20 business days of receipt and, if granted, implement them within 15 business days after the response. Each period may be extended once for an equal period where justified; we will inform you of the justification. If information is missing, the clarification procedure established by applicable regulations will apply.

The response will be sent through your designated channel. Access will be provided through electronic documents or an agreed secure means, after identity verification. Requests are handled free of charge, without prejudice to any reproduction or delivery costs permitted by law.

Requests to withdraw consent or limit processing will be handled through the same channels and under the same identity verification requirements and time limits described above. Withdrawal has no retroactive effect and does not prevent processing that must continue by law. If it affects a feature that requires the data, we will explain the consequences. You may request human review where automated processing significantly affects your rights, as provided by law.

If VIABO acts as a data processor, we will tell you who the data controller is and forward the request in accordance with the applicable instructions. If you believe your right to personal data protection has been infringed, you may contact the Mexican Secretariat for Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) through its official channels.

The website and platforms may use technical cookies, session identifiers and activity logs to authenticate access, maintain sessions, retain functional preferences and detect failures or threats. These mechanisms may collect IP addresses, identifiers, browser and device data, dates, times and activity within the service.

You can delete or block cookies through your browser’s privacy settings; disabling necessary cookies may affect functionality. This notice does not authorize advertising cookies or commercial tracking. If non-essential technologies are introduced, their data, purposes and acceptance or rejection controls will be disclosed before activation.

Email and WhatsApp are used to handle requests and communications related to the services. WhatsApp is a third-party service that applies its own terms to information it processes on its own behalf. For identification or transaction documentation, we will use the secure channels made available for each procedure.

Updates to this notice will be published in the Privacy Notice section of https://www.viabo.com, indicating the version date. Where a change requires new consent, we will request it before carrying out the new processing; publishing the change does not replace that authorization.