Privacy Notice

Global Payments Technology México, S.A. de C.V.

Under the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (the “Law”) and its Regulations, this Privacy Notice is issued to provide information on how we will treat your personal data (or those of the person you represent) and the rights you (or the data holder) have:

A.RESPONSIBLE PARTY.

Global Payments Technology México, S.A. de C.V. (hereinafter, “GPTM”) is responsible for the processing, including the collection, use, storage, and transfer of your personal data, domiciled at Paseo de la Reforma No 296 Floor 18, Office A, Colonia Cuauhtémoc, Delegation Cuauhtémoc, Mexico.

B. INFORMATION COLLECTED AND WAYS IN WHICH IT MAY BE COLLECTED

GPTM may obtain your personal data using the following methods:

Personally: When you come to any of GPTM's offices and when our executives, sales representatives, or partners visit you at your address or facility, to provide information, request, or process for purchasing our products or services.
Directly: When you provide us with your personal data directly through electronic means, telephone, or mail, among others, for example, to request or contract our financial services, including a pre-evaluation and evaluation to participate in promotions, offers, raffles, programs, through our website, telephone, or any other technological means, also when you make a payment through one of our points-of-sale, or other electronic channels, such as websites.
Indirectly:From any other commercially available or legally permitted documentary or information source; and/or when provided by another person, such as a referral or referred person.

The categories of personal data that we may collect that will be subject to treatment by GPTM are:

Identification data, including your image, and contact data in your professional and personal capacities, such as a home address, mobile phone, and email.
Wealth and financial data, such as your income or property, payment transactions, debit or credit card information, bank account data, and credit information reports.
Tax data.
Academic data.
Employment and business data.
Migration Data.
Data relating to the devices used to access GPTM's electronic channels, including their geographical location, and non-sensitive biometric behavioral data.
Behavioral data on electronic channels, such as time of use, region, information, and sections viewed.

Sensitive data. We may also collect sensitive data, including biometric information, to identify and authenticate you electronically to provide you with our services.

You tacitly consent to the treatment of your personal data when having had this Privacy Notice before you expressed your disagreement as set out in this Privacy Notice, and expressly when you use electronic means to share your information with us, request services or transactions.

In cases where you transfer personal data of your personal references, beneficiaries, or other third parties to GPTM as necessary for the services provided to you by GPTM, you must inform those third parties of the transfer and the purpose of such transfer, as well as the content of this Privacy Notice.

C. PURPOSES TO WHICH THE PROCESSING OF PERSONAL DATA WILL BE SUBJECT.

GPTM will treat your personal data to perform the following activities that are necessary for the provision of its services (primary activities):

Provide you with the services you contract with GPTM and perform our obligations, including, in particular, the receipt and processing of payments through payment networks;
register and verify your identity;
issue and send receipts or other evidence of their transactions;
deliver POS units and provide customer support;
implement controls to strengthen the security of electronic transactions and to prevent and detect illegal activities in compliance with the rules;
manage, advise, contract, place, and operate our services and products;
review, evaluate and respond to clarifications and complaints;
notify of changes in contractual terms;
invoice issuance and collection processes;
improve security, our access channels, website, applications, and platforms; and
comply with the legal requirements of the relevant national and international authorities and obligations arising from the legal relationship between the subject of personal data and GPTM.

Secondary Purposes: GPTM may use your personal data for:

design, development, analysis, profiling, advertising (including personalized advertising based on the behavior of social media data matter), promotion, benefits, discounts, market research, surveys, notification of raffles, goods derived from the operations of our products, and access control; and
grant you access to third-party services.

In case you do not want your personal data to be processed for the purposes provided above, you can submit your Opposition request to the email arco@hgpay.com.mx

The processing of your personal data is also subject to automated decision-making procedures, without human intervention.

GPTM will retain your personal data for the term of the contractual relationship and for as long as required by applicable law.

D. DATA ON SOCIAL NETWORKS AND ELECTRONIC CHANNELS

When you register on our social networks, it is understood that the information you provide us is correct and your username is your responsibility. In this sense, GPTM is not responsible for identity theft by third parties on our social networks.

Social networks (such as Facebook®, Twitter®, WhatsApp®, Linkin®, etc.) constitute a platform for communication and interconnection between digital platforms of different users, being outside GPTM; therefore, they are not under the responsibility of GPTM. However, to maintain effective, dynamic, and immediate communication with our customers and users, these or other communication platforms may be used to comply with the purposes of this Privacy Notice.

In addition, GPTM informs you that applications, platforms, social networking websites, and other third parties outside GPTM may obtain your information through "cookies" or other tools, including when you select a GPTM link or banner hosted on such applications, platforms, and websites. In addition, third parties may obtain your information through the GPTM website, including security and service providers. Use of information collected by third parties will be subject to the applicable third party's Privacy Notice and will not be the responsibility of GPTM. If you have questions about third parties who may obtain information through our websites and access channels, please contact the GPTM ARCO Office through the channels listed in the Means of Exercising ARCO Rights section.

GPTM uses "cookies" that may be placed on your computer and grants access that will allow you to log into GPTM services according to your personal online experience storing your preferences on the computer to save you time, eliminating the requirement to repeatedly introduce the same information and only show personalized content and appropriate advertising in visits to the website. A cookie is a text file placed by a web page server on the computer's hard drive. HSBC also uses a web beacon, which is a tool used exclusively to quantify the number of customer visits.

Your computer settings can automatically accept cookies, but if you prefer, you can modify your computer settings to reject cookies. If you wish, GPTM will not be able to store your preferences on the website.

E. MEANS TO EXERCISE THE ARCO RIGHTS

To protect your personal data, privacy, and trust, we put at your disposal our ARCO Office (the “ARCO Office”), where you, at any time, may exercise your rights of access, rectification, cancellation, and opposition provided for in the Law.

You may contact the ARCO Office to submit requests by e- mail to arco@hgpay.com.mx, or in writing to the ARCO Office at the address located at Reforma 296 Floor 18 Colonia Juarez, City Hall Cuauhtémoc, Zip Code 06600.

In the request to exercise the rights of access, rectification, cancellation, and opposition that you can make, you will be required to provide the following information:

a) The name and address or other means to communicate the response to your request;

b) Your official identification or, where appropriate, documents proving that you represent the holder of the data;

c) The clear and exact description of the personal data concerning which one exercises any of the aforementioned rights, and

d) Any other element or document that facilitates the location of personal data.

In the event of legal or natural disability, such as or disabled people under the legal guardianship of a third party, they may exercise their rights of access, rectification, cancellation, and opposition in the terms described above, through the legal guardian, who shall previously identify and demonstrate the personality of the guardian.

GPTM shall communicate in writing to the Holder, legal representative, or guardian the response to your request through the means of contact provided therein, for this purpose, within a maximum period of twenty business days, as from the date of receipt of said request in the ARCO Office. The period may be extended once only for an equal period, provided that the circumstances of the case so warrant it.

GPTM will not always be able to respond favorably to your request or remove the information immediately, as it may be required by law to process such information. You should also note that, for certain purposes, the revocation of your consent to the processing of your personal data will mean that we cannot continue to provide the service you requested or the termination of your legal relationship with us.

GPTM may contact you, as the data holder, to confirm receipt of the response and, if applicable, to confirm your agreement with the response.

If you disagree with the response given by GPTM, GPTM may offer to conduct a second review, to modify or confirm the initial response to the request, which will be communicated to you, by the process used to grant the above response, the foregoing within the term of 15 working days from the communication of the response to the request for the exercise of rights of access, rectification, cancellation, and opposition.

F. TRANSFER OF PERSONAL DATA

GPTM may transfer and/or forward the personal data it deals with to:

GPTM affiliates and subsidiaries at a national or international level.
External service providers for compliance with GPTM's legal obligations.
Third parties involved in payment services, including the payment receiver, card issuers, brand holders, aggregators, acquirers, clearinghouses, settlement establishments, and specialized companies, for the operation of the payment system, including for the processing of transactions and crime prevention actions.
External providers of research services, data analysis, and sending of information focused on the needs of the Data Subjects, as well as on the provision of the services necessary or required by the Data Subjects.
Business partners with whom GPTM has entered into agreements or contracts focused on developing and marketing new financial products and/or services for the benefit of the Data Subject and by their needs and background and credit history research.
Entities that provide correspondent banking services.
Third parties arising from a restructuring of the company, including the merger, consolidation, sale, liquidation, or transfer of assets.
Cloud service providers, provided they are used for the purposes set forth in this Privacy Notice.
Companies that offer applications, platforms, or websites on which GPTM advertises, as necessary for that purpose or other purposes set forth in this Privacy Notice, as well as social networks that enable GPTM to prepare personalized marketing for the Data Subject.
Applicable and auxiliary authorities.
Other transmissions under the aforementioned Law and its Regulations.
Third-party acquirers, card issuers, or payment systems, including American Express and its subsidiaries, grant you access to their payment systems through the GPTM point of sale when you request such service.

The Third Parties, Managers, and any entity receiving personal data assume the same obligations and/or responsibilities of GPTM, following what is described in this Privacy Notice.

In the case of referrals, if the processing of personal data is different from the purposes described in this Privacy Notice, the recipient will become responsible for such processing.

When you request or use GPTM services, you agree to transfer your personal data on the terms described in this Privacy Notice.

G. AMENDMENTS TO THE PRIVACY NOTICE

GPTM reserves the right to update this privacy notice; any change or modification will be informed through any of the following means:

Notices at GPTM offices.
Notices on the GPTM Internet portal www.hgpay.com.mx and
Any other public or private means of communication provided for in the contracts covering transactions between the Data Subjects and GPTM.

You are encouraged to review the Privacy Notice, at least every six months, for any updates to the terms herein. In any event, this Privacy Notice is available to you, directly and personally on our customer service channels, including any electronic, optical, sound, visual, or other technology.¹.

¹ Last date of creation and/or modification: 28/07/2022