In compliance with the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter the "Law"), its Regulations, and the Privacy Notice Guidelines published in the Official Gazette of the Federation on January 17, 2013, Productos y Servicios Tepoztli, S.A. de C.V. and its application AmigoCredi make this Privacy Notice available to you under the following terms:

I. DATA CONTROLLER

Productos y Servicios Tepoztli, S.A. de C.V. (hereinafter "Productos"), with its registered office at Calle Roberto Gayol 1260, Benito Juárez, Mexico City, C.P. 03100, is responsible for the processing of your personal data, including collection, use, storage, transfer, and disposal.

II. DATA COLLECTED

We collect necessary data to fulfill our corporate purpose and policies through:

• Identification data: Full name, address, phone numbers, RFC (Tax ID), CURP (Unique Population Registry Code), FIEL (e-signature), biometric data, geolocation.
• Personal data: Employment information, income, education level.
• Banking data: Financial institution, CLABE (bank account number), card/account number.

• SMS data:

  Information Access and Collection Scope: AmigoCredi only accesses financial - related SMS messages stored on your device, with the involved fields including date, phone number, and SMS content. Non-financial information is not within the scope of collection. In terms of the collection scope of SMS messages, only those from the past six months are included.

  SMS Filtering Principles: SMS messages are obtained through keyword filtering rules, and the keywords include but are not limited to "presta", "cred", "liqudia", "banco", "adeudo", etc.

  Information Usage: The obtained information is solely used for data analysis of the risk control model and evaluating the user's loan application qualifications to determine whether the user meets the service access conditions.

  Information Transmission and Storage: After being encrypted, the data will be uploaded to a dedicated server (https://api.amigocredi.mx).

  Information Confidentiality: Without the user's explicit permission, the content of SMS messages and related data will never be shared with any third parties. SMS access will only be conducted after obtaining the user's authorization.

  Information Deletion Mechanism: If a user needs to delete personal information, they can send an application email to [email protected], and the relevant information will be deleted within 3 to 5 working days.

• Device data: Model, RAM, unique identifiers (AAID, serial number).
• Location: For risk assessment in loan applications.
• Camera and storage: Only for loan-related images and identification documents. Manually selected photos are stored encrypted for 1 year.
• App Activity Data: Package name, application name, time of first installation, and time of update.
• Emergency contacts: Only manually selected contacts, stored encrypted for 1 year.
• Device permissions: Location, camera, and user data.

We do not collect sensitive data (ethnic origin, health, religious beliefs, sexual orientation). All data is protected with strict security measures.

III. PURPOSES OF PROCESSING

Data will be used for:

• Identity verification and risk analysis.
• Compliance with legal and regulatory obligations.
• Keeping records updated.
• Formalizing contracts and business relationships.
• Biometric and biographical validation.

IV. OPT-OUT MECHANISMS

If you disagree with this notice, you have 5 business days to express your refusal by emailing [email protected] (subject: "Refusal for Processing of Personal Data"). Note: Refusal will prevent establishing a legal relationship with Productos.

V. DATA TRANSFERS

Your data may be shared with:

• Credit bureaus (TransUnion, Círculo de Crédito).
• Financial and judicial authorities (legal compliance).
• Subsidiaries or affiliates.

All third parties guarantee confidentiality under this notice.

VI. ARCO RIGHTS (Access, Rectification, Cancellation, Opposition)

Usted puede ejercer estos derechos mediante:

You may exercise these rights by:

• Written request at RIO SAN JOAQUIN 463, Mexico City (hours: 9:00–15:00).
• Phone: (55) 8526-6878.
• Response time: 20 business days (extendable to 40 in justified cases).

Request requirements:

1. Full name, address, and email.

2. Identification documents.

3. Clear description of data to modify.

Exceptions: Productos may deny cancellation if data is required for contractual or legal obligations.

VII. MODIFICATIONS

Any changes will be notified via:

• Office notices.
• Productos’ website.
• Email to the last registered address.

VIII. WITHDRAWAL OF CONSENT

Follow the procedure in Section VI. *For assistance at our Specialized Unit (UNE), schedule an appointment at (55) 8526-6878*.

IX. COMPLAINTS

If you believe your rights have been violated, contact INAI: Insurgentes Sur 3211, Col. Insurgentes Cuicuilco, Mexico City Tel. (55) 5004-2400 | https://home.inai.org.mx

X. CONTACT

Questions about this notice? Contact us:

• Customer service:+ 52 55 8526 5083
• Email: [email protected] (response in 2–3 business days)
• WhatsApp: +52 56 5989 6766
• Hours: Mon–Fri 8:00–17:00, Sat 8:00–16:00