MOBIPLAY

PRIVACY POLICY

Rideshare Digital Advertising Platform

Effective Date: [DATE]

FULL PRIVACY NOTICE

Note: This English version is provided for convenience. In case of any conflict between the Spanish and English versions, the Spanish version shall prevail, as it constitutes the legally binding document under Mexican law.

2.1 Identity and Contact Information of the Data Controller

2.2 Scope and Who This Notice Applies To

This Privacy Notice applies to the following categories of data subjects:

a) Advertisers

Companies or individuals who create an account on the platform, deposit funds, and configure digital advertising campaigns. By accepting these terms, the advertiser expressly consents to the processing of their data for the purposes described herein.

b) Driver-Partners

Individuals who install and host digital screens in their vehicles and participate as operators in the advertising network. Their relationship with [COMPANY NAME] is that of an independent contractor; however, their personal data is processed to manage the service, process payments, and fulfill legal obligations.

c) Passengers

[COMPANY NAME] does not passively collect passenger data. The only information that may be processed is that generated when a passenger voluntarily chooses to scan a QR code displayed on an advertisement (e.g., IP address).

Any person — including employees and third-party service providers — who has access to personal data in the course of their duties is directly subject to the obligations of the LFPDPPP, regardless of whether they determine the purposes of the processing.

2.3 Personal Data Collected

a) Advertisers

b) Driver-Partners

c) Passengers

Note: [COMPANY NAME] does not passively collect any data from passengers. Any data that may be generated occurs solely as a result of the passenger's voluntary action in scanning the QR code.

2.4 Purposes of Processing

a) Advertisers — Primary Purposes (no additional consent required)

•        Creating, managing, and maintaining accounts on the platform.

•        Processing payments, managing account balance, and issuing tax invoices (CFDI) through facturapi.

•        Configuring, launching, monitoring, and optimizing advertising campaigns.

•        Compliance with tax obligations before SAT (Article 30-B of the Federal Fiscal Code — see note at end of this section).

•        Prevention and detection of fraud, money laundering, and other illicit conduct.

•        Transactional communications (confirmations, account alerts, receipts).

•        Compliance with COFEPRIS or other applicable regulatory authority requirements.

a) Advertisers — Secondary Purposes (require express opt-in consent)

•        Sending marketing communications, promotions, and product updates.

•        Participation in product improvement programs and satisfaction surveys.

•        Sharing aggregated and anonymized campaign performance data with business partners.

b) Driver-Partners — Primary Purposes

•        Identity, background, and eligibility verification (KYC/KYB via Sumsub).

•        Device installation, maintenance, and technical support management.

•        Payment processing and settlements; issuance of CFDI where applicable.

•        GPS device location monitoring for impression reporting and advertiser contract fulfillment.

•        Tax compliance obligations before SAT.

•        Operational and support communications.

•        Compliance with transport and advertising regulatory requirements.

b) Driver-Partners — Secondary Purposes

•        Marketing communications and incentive programs.

•        Participation in service improvement studies.

c) Passengers — Purposes

•        Facilitating user interaction with the scanned advertisement (redirect to advertiser URL).

•        Generating campaign performance metrics for the advertiser (in aggregated or anonymized form where possible).

•        Prevention of fraud and platform abuse.

Mandatory legal notice: Tax and billing data may be accessed by the Servicio de Administracion Tributaria (SAT) pursuant to Article 30-B of the Federal Fiscal Code (Codigo Fiscal de la Federacion). This access constitutes a non-waivable legal obligation and does not require additional consent from the data subject.

2.5 Consent Framework

Consent collection mechanisms

•        Advertisers: Acceptance checkbox for terms and privacy policy at registration; separate checkbox for marketing; active confirmation when depositing funds via Stripe.

•        Driver-Partners: Digital onboarding process with a separate driver agreement; Acknowledgement of privacy policy, separate checkbox for marketing, Sumsub verification flow with integrated consent.

•        Passengers: Privacy disclosure visible on the advertisement where a QR code is displayed; voluntary interaction constitutes consent for minimum technical processing.

2.6 Data Transfers and Third-Party Processors

All persons, employees, contractors, and service providers who access personal data must sign confidentiality agreements. These obligations are irrevocable and survive termination of the employment or service relationship.

International data transfers comply with the requirements of Chapter V of the LFPDPPP, including the execution of standard contractual clauses or the verification of an adequate level of protection in the recipient country where applicable.

2.7 Data Retention and Deletion Policy

2.8 ARCO Rights (Access, Rectification, Cancellation, Objection)

You have the right to know what personal data we hold about you (Access), to request its correction (Rectification), to request its removal from our records (Cancellation), and to object to the processing of your data for specific purposes (Objection).

Process for exercising ARCO rights:

1.      Submit your request by email to: privacidad@[DOMAIN].com

2.      Your request must include: (a) full name; (b) copy of a valid official ID; (c) a clear and detailed description of the right you wish to exercise and the data involved; (d) postal address or email address to receive the response; and (e) any document that facilitates locating your data.

3.      Acknowledgment: [COMPANY NAME] will acknowledge receipt of your request within 5 (five) business days of receiving it.

4.      Substantive response: A response to your request will be issued within 20 (twenty) business days of receipt, in accordance with Article 32 of the LFPDPPP. This period may be extended in duly justified exceptional cases.

5.      Internal responsibility: ARCO requests are received by the Privacy Officer, reviewed by the Legal department, and approved with the participation of the Finance department when they involve the cancellation of billing records.

Exceptions to the right of cancellation:

•        Data subject to mandatory legal retention (SAT tax records — CFF Art. 30).

•        Data linked to ongoing judicial, administrative proceedings, or fraud investigations.

•        Data whose preservation is necessary to comply with a legal obligation or to defend [COMPANY NAME]'s legal rights.

Escalation:

If you are not satisfied with the response received, you have the right to file a complaint directly with the Secretaria Antiburocrática y de Buen Gobierno (SABG), the competent authority for data protection in Mexico.

2.9 Data Breach Notification and Incident Response Plan

INCIDENT RESPONSE PLAN — PERSONAL DATA

Operational reference document | Version effective as of: [DATE]

Phase 1 — Detection and Triage (0–24 hours)

•        Responsible for detection: Engineering/IT team or any employee who identifies a potential incident.

•        Immediate escalation: Notify the Privacy Officer and Engineering Lead/CTO within a maximum of 2 hours of detection.

•        Initial containment steps: isolate affected systems, preserve evidence, revoke compromised credentials, notify the Executive Sponsor.

Phase 2 — Assessment and Scope (24–72 hours)

•        Determine the type of data affected (sensitive, financial, technical), the number of data subjects involved, and the exposure period.

•        Assess whether the incident triggers the notification duty to SABG (criterion: personal data compromised with real risk to data subjects).

•        Document all findings in the internal Incident Log.

Phase 3 — Regulatory Notification

•        SABG must be notified within 72 hours of confirming a breach involving personal data.

•        The SABG report must include: nature and type of the breach; categories and approximate volume of data affected; containment and remediation measures taken; Privacy Officer contact details.

Phase 4 — Data Subject Notification

•        Affected data subjects must be informed promptly and without undue delay, in clear and plain language.

•        Channels: registered email address and/or in-platform notification.

•        The notice must describe: what happened, what data was affected, what steps are being taken, and how to contact the Privacy Officer.

Roles and Responsibilities

Phase 5 — Post-Incident

•        Root cause analysis within 30 days of incident closure.

•        Update of affected policies, technical controls, and procedures.

•        Follow-up report to SABG if required or if new relevant findings were identified.

Record-Keeping

All incidents — regardless of whether they triggered the notification duty — must be logged in the Internal Incident Register and retained for a minimum period of 5 (five) years, in accordance with the LFPDPPP and SABG regulations.

2.10 Confidentiality Obligations

All access to personal data — whether by full-time employees, project-based workers, independent contractors, or third-party service providers — is conditioned upon the signing of a confidentiality agreement with [COMPANY NAME].

These obligations are irrevocable and survive termination of the employment, service, or contractual relationship, regardless of the reason for termination.

Breach of these obligations may result in: (i) internal disciplinary measures, up to and including contract termination; (ii) civil action for damages; and (iii) administrative sanctions under the LFPDPPP, imposed by the SABG.

2.11 Changes to This Privacy Policy

[COMPANY NAME] may modify this Privacy Notice as necessary to reflect changes in its data processing practices, applicable law, or the services offered.

Material changes — those involving a significant modification to processing purposes, categories of data collected, or data subject rights — will be communicated via: (i) email to the registered address; and/or (ii) a prominent notice on the platform, at least 15 days before they take effect.

Continued use of the platform following notification of non-material changes constitutes tacit acceptance of those changes.

Previous versions of this Privacy Notice will be made available upon request addressed to privacidad@[DOMAIN].com.

2.12 Contact and ARCO Rights Requests

If you do not receive a response within the indicated timeframes, or if you consider that your request was not addressed satisfactorily, you have the right to file a complaint directly with the SABG, which acts as the data protection supervisory authority in Mexico.

[COMPANY NAME] — Privacy Policy

Effective as of: [DATE]

privacidad@[DOMAIN].com | [DOMAIN].com/privacidad