PRIVACY NOTICE

CLIP AI, S.A. DE C.V.,

INSTITUCIÓN DE FONDOS DE PAGO ELECTRÓNICO

*English version for reference only. Spanish version of this Privacy Notice shall prevail.

Clip AI, S.A. de C.V., Institución de Fondos de Pago Electrónico  (“Clip”) with registered address at Av. de los Insurgentes Sur 1457 Piso 23, Insurgentes Mixcoac, Benito Juárez, C.P. 03920 Mexico City, Mexico, is responsible for collecting your Personal Data during the use of Clip's services, as well as guaranteeing your right as a Data Subject to informational self-determination.

We know that it is important for you to know what Personal Data we use and how we use it. This Privacy Notice describes how Clip, being responsible for the use, handling, and confidentiality of the Personal Data provided by our Customers, employees, and third parties or suppliers (any of them, the “Data Subject”), collects, maintains, uses, stores, and discloses your information. 

In the case of our Customers, in accordance with Article 58 of the Law Regulating Financial Technology Institutions, as well as other related provisions, Financial Technology Institutions (“ITF”), such as Clip, must observe measures to adequately understand their Customers, taking into account their background, specific conditions, economic or professional activity, and the geographical areas in which they operate.

We have made this Privacy Notice available to you both on our website https://www.clip.mx/privacidad#ai and in our mobile applications. We also invite you to email us at privacidad@clipcuenta.mx if you have any questions or concerns regarding the use and processing of your Personal Data. Our goal is to provide exceptional service.

‍Data Controller Details

The data controller responsible for processing Personal Data is the legal entity known as CLIP AI, S.A. DE C.V., INSTITUCIÓN DE FONDOS DE PAGO ELECTRÓNICO (Clip), with registered address at Av. de los Insurgentes Sur 1457 Piso 23, Insurgentes Mixcoac, Benito Juárez, C.P. 03920 Mexico City, Mexico, an entity that undertakes to comply with the provisions of this Privacy Notice, as well as the provisions contained in the Federal Law on Protection of Personal Data Held by Private Parties (the “Law”), its Regulations, and applicable provisions. 

‍What personal data do we collect?

Clip obtains your information when you visit our website or any of our mobile applications when you create an account. We also obtain information from your email, completed forms, phone calls, audio recordings, images or videos, IP address, and standard online income information, such as your browser type and the web pages you have visited within our website. We may also obtain certain geolocation information. If you do not agree to our collection of such information, you will not be able to use our services, as without such information, our service cannot function properly.

‍What data do we collect from our customers when they open an account with Clip? 

In accordance with Clip's Know Your Customer (KYC) policy, as well as the general provisions applicable to Clip's activities and operations as an Electronic Payment Fund Institution, we collect data from our customers, including data relating to access and/or use derived from the normal development of Clip's services. The personal data collected is as follows:

‍Personal Data:

• Identification Information: Your name, CURP, address, email address, and date of birth.
• Authentication Information: Email address, password, and other validation data we use to verify that you are the person making the transactions.
• Account Information: Your mobile phone number and device number, voter registration number, or official identification number.
• Smartphone Information: We may also obtain information about you: (a) through your mobile device, machine, or mobile device identification number, geolocation, time zone, language preference, web browser type, and IP address, and (b) from third parties for the purposes of transaction processing, identity verification, fraud detection and prevention, and other similar purposes. For fraud prevention purposes, we may also link your machine (device) identification number to the machines (devices) of other Customers who use the same card(s) as you.
• Financial Information: Your bank account number, routing number, and debit card numbers associated with your Clip account. Clip will not share your financial information with third-party social media platforms.
• Contact Information: All information you provide to us so that we can call and/or write to you.
• Third-party contact information: The contact details of the people with whom you interact or engage through Clip's services, whether they are your users (hereinafter referred to as Customer Users) and/or third parties.

‍Sensitive Personal Data of Customers:

• Geolocation: remember that, by law, we must record the geolocation of all transactions carried out by our Customers.
• Biometrics: in order to verify your identity, we may request, collect, and/or process biometric data (such as facial recognition).

At Clip, we may require you to provide us with additional personal data or obtain information indirectly through publicly available sources and other available sources in order to verify your identity, home address, or other identifying information in compliance with legal provisions. 

When you use our services, we will be collecting information about your bank account transactions, and we may collect information about your computer or other access devices for fraud prevention and similar purposes. If you provide us with any personal data relating to another person, in accordance with this privacy notice, we will understand that you have obtained the prior consent of that person to do so.

In accordance with the provisions of Article 8 of the Law, the Owner expressly consents to Clip processing their Personal Data, including financial and asset-related data, as well as sensitive data.

‍What if I am an employee or have applied to work at Clip?

Please note that if you are an employee, or even if you contact us to apply for one of our positions, we may collect any of the following:

‍Personal Data:

• Identification data
• Authentication data
• Contact data
• Academic data
• Employment data
• Financial and asset data

‍Sensitive Personal Data:

We do not currently collect and/or store this data, but if this changes, we will let you know!

‍What if I am a Clip supplier?

Please note that we may collect any of the following from our suppliers:

‍Personal Data:

• Identification data
• Authentication data
• Contact details
• Financial and asset data
• Legal data

‍Sensitive Personal Data:

• We do not currently collect and/or store this type of data, but if this changes, we will let you know!

In accordance with the provisions of Article 8 of the Law, the Owner expressly consents to Clip processing their Personal Data, including financial and asset data, as well as sensitive data.

‍Use of Cookies

When you visit our website https://www.clip.mx/soluciones/clip-cuenta, both we and companies we hire to monitor or maintain our website may place small data files called “cookies” on your computer.

For example, we will send a “session cookie” to your computer each time you log into your Clip account. This type of cookie will help us recognize if you are visiting multiple pages on our site during the same session, so we will not have to ask you for your password on each page.

As a Customer, you are completely free to reject our cookies if your browser allows you to do so, but this may interfere with the use of our website or mobile applications.

‍How do we protect and store your Personal Data?

Clip is committed to entering into legal agreements, adopting privacy, Personal Data protection, and information security policies required within its organization, as well as implementing technological, physical, and administrative security measures to comply with the provisions of this Privacy Notice.

We store and process your personal data through third-party servers located in secure data centers in the United States of America. This information is protected by physical, electronic, and procedural security measures that comply with applicable federal and state regulations. We also use computer protections such as firewalls and data encryption. 

Clip stores the Data Subject's personal information in databases with limited access located in facilities controlled by security mechanisms. We have strict physical access controls to our office and files, and we authorize access to Personal Data only to employees who need it to fulfill their responsibilities. Clip is committed to ensuring that the information provided by the Data Subject is considered and treated as confidential.

We make every effort to ensure the security of our systems. Despite our efforts, we cannot guarantee that your personal data will not be accessed, disclosed, altered, or destroyed due to a failure of our administrative or technical security measures. Therefore, we suggest that you take the necessary precautions to protect your personal data and do not share your Clip password with anyone.

‍How do we use your Personal Data?

Our main goal in collecting your personal data is to offer you a personalized experience that is secure, efficient, and enjoyable. 

All data collected and stored is done so for a specific purpose, regardless of whether you are a Customer, employee, or Supplier.

‍Primary Purposes for Customers:

• To authenticate your identity as the Account Holder in accordance with the legal provisions applicable to Clip and identification policies (KYC).
• To register and create the Account Holder's account in the Clip application.
• To validate the Account Holder's information.
• To manage and validate the upgrade of the Customer Account.
• To manage and validate transactions made by the Customer, including online payments and payments made with the Clip card.
• To send the Account Holder a summary of daily movements, transaction information, payments, and account statements.
• Generate links so that the Cardholder can carry out transactions via WhatsApp, other instant messaging services, or social networks.
• Allow the Cardholder to register additional cards to the Clip card within the mobile application.
• Provide support and assistance to the Cardholder, as well as make changes to their information, if requested.
• Enable the Cardholder to search for and select the individuals or legal entities with whom they wish to conduct transactions through Clip's services, including: 
  
  • Enabling features that allow them to locate other Clip users or Clip Customer Users by searching by name, mobile phone number, email, or alias; and 
  • Show other Clip users certain basic profile information (such as your full name or business name, alias, date of registration on the platform, and the fact that your phone number or email address is associated with a Clip account), in order to confirm that they are interacting with the correct person and reduce the risk of payments being sent to the wrong recipients.

‍Secondary Purposes for Customers:

• To improve service quality, as well as to perform tests or analyses of solutions aimed at studying Customer behavior.
• To contact the Data Owner for the purpose of notifying them of updates to the website and mobile application, reports on the Processing and status of their Personal Data, as well as changes to this Privacy Notice or the published Terms and Conditions.
• Sending advertising information and/or using Customer information for marketing, advertising, or any other similar purposes to offer products and services to the Customer, which may be done through various means such as email, push notifications, instant messaging, among others.
• Offering financial products or services from other entities that are related to those offered to the Customer.
• Performing behavioral analysis of different Customers of the mobile application for statistical and marketing purposes.
• Developing, updating, and monitoring risk profiles and models, using proprietary information and, where appropriate, contact information and third-party information associated with your operations, in order to evaluate transactional behavior, relationship patterns, and other indicators relevant to the security of the platform.
• Detect, prevent, and mitigate potential fraud, identity theft, and other illegal conduct, including analyzing networks of devices, accounts, and contacts related to suspicious transactions, as well as implementing additional authentication, validation, and monitoring controls.

‍Primary Purposes for Employees:

• To authenticate the identity of the Data Subject and open a file in their name for the purposes of storing, identifying, consulting, and analyzing information, as well as complying with applicable legal provisions and possible requirements from competent authorities or regulatory bodies. 
• Carry out and coordinate the necessary procedures and formalities for registration, deregistration, modifications, and disabilities with the public institutions that Clip is required to comply with by law.
• Structure and plan all measures or actions that enable the implementation of projects and activities within Clip.
• Assign the Data Subject the necessary work tools and resources for the performance of their work activities.
• Coordinate the payment of salaries and benefits corresponding to the Holder. 
• Evaluate the performance and development of the Holder in the performance of their duties. 
• Make available to the Holder the necessary documentation to be part of the Clip team of collaborators for their proper consultation, understanding, and signature. 
• Generate and update organizational charts.
• Allow access to any of Clip's facilities.

‍Secondary Purposes for Employees:

• Contacting the Data Subject for the purpose of notifying them about the Processing and status of their Personal Data, as well as changes to this Privacy Notice. 
• Sending Clip information, such as newsletters, as well as invitations to courses or seminars. 
• Sending Clip promotional and advertising information, as well as information about its services or products (Opt-In).  
• Using personal data for statistical purposes. 
• Taking photographs and videos for Clip promotional and advertising purposes.

‍Primary Purposes for Employee Prospects:

• Authenticate the identity of the Data Subject and open a prospect file. 
• Conduct an assessment of the Data Subject's profile to verify and validate that it matches the characteristics and specifications required for the vacancy.  
• Conduct an investigation to verify the information provided by the Data Subject. 
• Coordinate schedules in order to schedule and conduct an interview to verify the Data Subject's suitability for the vacant position.  
• Contact the Data Subject by any means in order to follow up on the hiring process. 
• Prepare a report to determine the viability of a candidate. 
• If the Candidate does not continue with the recruitment process, they may be referred to a different vacancy, or their information may be stored in Clip's databases in order to contact them for future vacancies.

‍Secondary Purposes for Employee Prospects:

• Contacting the Data Subject for the purpose of notifying them about the Processing and status of their Personal Data, as well as changes to this Privacy Notice. 
• Sending Clip information, such as newsletters, as well as invitations to courses or seminars. 
• Sending Clip promotional and advertising information, as well as information about its services or products (Opt-In).  
• Using personal data for statistical purposes.

‍Primary Purposes for Suppliers:

• Authenticate the identity of the Holder.
• Register the Holder in Clip's systems.
• Carry out the contracting of products or services. 
• Prepare contracts and documents related to the commercial relationship between Clip and the Holder.
• Payment of consideration and compliance with tax obligations. 
• Send vouchers, transaction information, payments, and invoices to the Holder. 
• Prepare and publish on the website the list of Suppliers, including the operations and their characteristics that can be carried out with them, as well as the information collected in terms of Article 52 of the Provisions applicable to electronic payment fund institutions referred to in Articles 48, second paragraph; 54, first paragraph, and 56, first and second paragraphs, of the Law Regulating Financial Technology Institutions.

‍Secondary Purposes for Providers:

• Contacting the Owner for the purpose of notifying them of updates to the website and mobile application, reports on the Processing and status of their Personal Data, as well as changes to this Privacy Notice.
• Sending offers for Clip products and services (Opt-In).

‍Consent of the Owner 

For the purposes of the provisions of the Law and other applicable legislation on the protection of Personal Data, the Owner declares:

1. That this Privacy Notice has been made known to them by Clip.
2. That they have read, understood, and agreed to the terms set forth herein.
3. That they give their consent to the processing of their personal data.
4. That they give their consent to Clip to collect their personal data by any means of contact, whether digital or physical. 
5. That they give their consent to Clip to process their personal data in accordance with the provisions of this Privacy Notice.

‍

The Owner is the person who provides the data and, in accordance with the Law, the fact that the Owner uploads their information to our platform of their own free will is considered as express consent for the use or processing of their personal, financial, or property data.

Do you disagree with our privacy policy?

You may revoke or limit your consent at any time so that we stop using your personal data in accordance with this Privacy Notice, even after closing your Clip account.

This right of revocation may be exercised by sending a letter that complies with the minimum information and attachments described by the Law and its Regulations (name and address, copy of a document proving your identity, clear and precise description of the personal data on which you wish to exercise this right, and description of your request) to the email address privacidad@clipcuenta.mxTo revoke your consent, see “What are your ARCO rights?” described in this Privacy Notice. The processing of your personal data is essential in order to provide you with Clip's services; therefore, revoking your consent could mean that you will not be able to use Clip's services and you will have to close your Customer account with us, following the instructions in the Clip application or on the website https://www.clip.mx/soluciones/clip-cuenta. In this case, if you do not close your account within a reasonable period of time, don't worry, we will do it for you.

How do we share your personal data in your transaction with Clip?

As a Customer, in order to process your payments on Clip, we have to share some of your personal data with the third party or business you are transacting with. Your contact information, registration date, number of payments you have received, and other transaction information may be provided to other Clip Customers with whom you have exchanged payments.

We work with businesses so that you can pay them through the Clip platform. This way, when you pay a business, they can share information about you with us, such as your Clip profile picture and your name.

Your debit card number or bank account number is required to perform the services that Clip offers you and for which you have accepted the Terms and Conditions. In any case, we will never disclose your debit card number or bank account number to any person or business, unless we have your explicit permission or are required to do so in accordance with applicable law or a court order.

How do we share your personal data with other third parties?

Clip does not share your personal data with third parties for promotional or marketing purposes. We may share your personal data with:

• Subsidiary, affiliate, and/or parent companies;
• Third parties who work with us to provide you with the services we offer or who provide fraud detection or similar services on our behalf; or
• Third parties with your consent or instruction to do so.

Finally, at Clip we believe in good faith that the disclosure of personal data is necessary to prevent physical harm, financial loss, to be able to report any suspected illegal activity, or to investigate violations of the Terms and Conditions, so in certain cases, such as a court order or similar legal proceedings, we may disclose such information to the competent authorities.

Below, we share how we may share your data and the considerations for doing so:

‍

How can you access and change your Personal Information stored by Clip?

You can update your Personal Information at any time by accessing your account and clicking on the “settings” and “profile” tab through one of our mobile applications or by contacting us directly at privacidad@clipcuenta.mx.

‍

Additional Information Requirements

Use of the device's contact book

Access to your device's contact book is optional. If you decide to enable this feature within the Clip application and grant the corresponding permission on your device, Clip will be able to access the contact details stored in your contact book (e.g., first name, last name, alias, mobile phone number, and email address). 

Enabling or disabling this feature does not affect your subscription or the essential use of Clip's services, but it may affect the level of analysis and protection available against certain types of fraud. 

You can revoke Clip's permission to access your contact list at any time, either through the privacy settings within the application or from your device settings. The revocation will take effect in the future and will not affect the lawfulness of the processing carried out previously based on your consent. 

By providing us with personal data of your users (Customer Users) and/or third parties (e.g., contacts, beneficiaries, references, additional users, etc.), you acknowledge that you have informed them about the processing of their data by Clip and that you have obtained their lawful consent prior to sharing such information, in accordance with Clip's Privacy Notice. You agree to hold Clip harmless from any claims that such third parties may make arising from the use of their data in accordance with this Notice.‍

What are your ARCO Rights?

Clip recognizes the possibility for Data Subjects to exercise their ARCO Rights over their Personal Data through the means made available to them in accordance with this Privacy Notice. ARCO Rights consist of the following: 

• Right of Access: The Data Subject has the right, at any time, to know what personal data we have obtained, what we use it for (purposes), and the conditions of use.
• Right of Rectification: The Data Subject has the right to request the correction of their personal information if it is outdated, inaccurate, or incomplete.
• Right of Cancellation: The Data Subject has the right to request that we remove their information from our records or databases when they consider that it is not being used in accordance with the principles, duties, and obligations set forth in the Law. 
• Right of Opposition: The Owner has the right to oppose the use of their personal data for specific purposes.‍

How to exercise your ARCO rights?

You can exercise any of your ARCO rights by sending a written request by email to privacidad@clipcuenta.mx, indicating “Exercise of ARCO Rights” in the subject line. Clip's Personal Data Protection Officer will process the requests in question and can be contacted by the Data Subjects at any time. ‍

Responsible party: Clip's Personal Data Protection Officer. 

Email: privacidad@clipcuenta.mx 

To exercise ARCO rights, the Data Subject must provide the following information:

• Full name, address, and email address.
• Specify the product or service for which the ARCO right is being exercised.
• Clear and precise description of the Personal Data with respect to which they intend to exercise any of the ARCO Rights, in addition to any document that allows them to be located.
• Mention of the ARCO Right they wish to exercise and the reason for doing so.
• The arguments supporting your position.
• If a data rectification is requested, the modifications to be made must be indicated and documentation must be provided to support the reason for the requested changes.‍

The request must also be accompanied by the following documents:

• A copy of the official identification (INE or passport) of the Owner or their representative.
• Document and/or information proving that the personal information is in the possession of Clip.
• If the Owner does not submit the request in person, the person submitting it must prove their representation. This can be done by means of a public deed or power of attorney signed before two witnesses, together with the official identification documents of the Owner and representative.‍

Once the Owner's request has been received, Clip will send an acknowledgment of receipt by email. Subsequently, it will respond to the Owner's request by email within a period not exceeding 20 (twenty) business days from the date of receipt. This period will only be applicable if Clip has sufficient information to respond to the request, in accordance with the provisions of the following paragraph.‍

The Owner must take into consideration that, in order to have sufficient information to respond to their request, Clip may request additional information within 5 (five) business days of receiving the request. Upon Clip's request, the Owner will have a period of 10 (ten) business days to comply with this request. In this case, the period of 20 (twenty) business days mentioned in the previous paragraph will begin on the day following the day on which the Owner complied with Clip's request.‍

If the request is declared admissible and the Owner has proven their identity and ownership of the ARCO Right they sought to exercise, Access to Personal Data, the requested changes, Cancellation, or the response to the Opposition will be made within a maximum period of 15 (fifteen) business days from the date on which the request was answered.‍

In the case of requests for Access to Personal Data, Clip will proceed to deliver it after verifying the identity of the applicant or representative, as appropriate. Such delivery will be free of charge in digital form to the email address from which the request was sent.‍

If the subject of the request is Opposition, the processing of Personal Data will cease on the business day immediately following the date on which the affirmative response is communicated to the Owner.‍

Alternative mechanisms for the protection of ARCO Rights

Clip provides alternative mechanisms to the exercise of ARCO Rights so that Owners can limit the use and disclosure of their Personal Data. In this regard, it informs the Owner that, in order to avoid receiving advertising, they can register in the Public Registry of Users (REUS) of the National Commission for the Protection and Defense of Financial Services Users (CONDUSEF), at the link https://webapps.condusef.gob.mx/reus/app/registro.jsp. 

‍

If the Owner wishes to know more about what is discussed in this section, they may send an email to privacidad@clipcuenta.mx with the subject line “Limitation of Use or Disclosure,” expressing their questions, comments, and suggestions regarding the subject matter herein. ‍

How long will my data be kept?

In compliance with the principle of quality, all of the Data Subject's Personal Data will be kept for the time necessary to fulfill the purposes for which it was collected and, once that purpose has been fulfilled, for a period of ten years. In accordance with the above, before deleting the Personal Data, Clip will block and encrypt it on our servers.‍

Links to Other Sites

Our website may contain links to other sites. Clip does not control the collection of your information on those sites. We recommend that you read the privacy policies of each website that collects your personally identifiable information outside the Clip platform.‍

Changes to Our Privacy Policies

At Clip, we are always looking to improve, so any of our services may undergo changes. Therefore, we reserve the right to update and/or modify our Privacy Notice at any time. In the event of any changes to this Privacy Notice, we will publish such changes on our website https://www.clip.mx/privacidad#ai and will also modify the “last update” section in our mobile application. It is the responsibility of the Owner to periodically review our Privacy Notice. The published notice will be the most recent and applicable to Clip Customers, Employees, and Suppliers. 

‍

Contact us!

We would love to hear from you. If you have any questions or suggestions regarding the privacy policies mentioned above, please do not hesitate to contact us via the chat located in the Clip application or by email at privacidad@clipcuenta.mx.

‍

Last update: February 6, 2026