PRIVACY POLICY AND DATA PROTECTION TILOPAY®

TILO PAY SOLUCIONES COMERCIALES LTDA, operating under the trade name TILOPAY®, a Costa Rican company registered in the Mercantile Section of the Public Registry under legal identification number 3102833000, domiciled in San José, San Rafael de Escazú, Plaza Roble Corporate Center, Los Balcones Building, Floor four, and the intellectual owner of the TILOPAY® payment gateway is a company committed to the security of its users’ data.

By entering as a user of the services or products provided by TILOPAY® through its website, you accept all the established terms and conditions that will be indicated.

When we ask you to fill in the fields of personal information with which you can be identified, we do so by ensuring that it will only be used in accordance with the terms of this document and in accordance with the provisions of the Law on the protection of the person against the treatment of your personal data (Law No. 8968) and its Regulations (Executive Decree No. 37554-JP).

I. Information that is stored. TILOPAY® may collect, for its exclusive use, personal information of a public or private nature, which corresponds to the following:

a. Public personal data: corresponds to the content in public databases of general access, as provided by special laws and in accordance with the purpose for which these data were collected, for example: Name, identity card number, sex and marital status .

b. Private personal data is separated into two types: restricted access and sensitive data. Those with restricted access are those that, even forming part of public access records, do not have unrestricted access because they are of interest only to their owner or to the Public Administration, for example, educational level, employment status, data contact, among others. Sensitive data corresponds to information related to the intimate domain of the person, such as those that reveal ethnic origin, socioeconomic status and health.

II. Sources of information: TILOPAY® obtains personal data from one or more of the following sources:

a. Information on applications, surveys and other forms

b. Information on completed transactions on the TILOPAY® payment platform

c. Information about transactions with our affiliated USERS

d. Information about transactions with non-affiliated third parties

e. Information from a client reporting agency

f. Information provided when signing the Affiliation contract on the TILOPAY® website

g. Information provided when authorizing TILOPAY® to store information about your registered payment methods (for example, payment card number, CVC code and expiration date). The payment method information we collect will depend on the payment method you choose to use from the list of available payment methods offered to you at checkout. We may also receive your name, email, billing or shipping address and, in some cases, your transaction history to authenticate you.

h. When you submit your identification for verification purposes.

i. When you respond to surveys or emails from TILOPAY®

j. Information from the e-commerce pages of the businesses/persons that process with Tilopay

III. Use of stored information. TILOPAY® will give an adequate treatment to the personal data provided by the final clients in compliance with the applicable regulation. The USER must have authorization from the end customer so that TILOPAY® can store personal data for the following purposes: process payments, validate transactions, in order to mitigate the risk of identity theft of cardholders , send them promotional and advertising information about TILOPAY, send discount coupons, join loyalty programs, create payer consumption profiles, among other promotional and advertising materials that may be of interest to the end customer

IV. TILOPAY® commitments to protect Personal Data. TILOPAY® states that at all times it will comply with the following personal data protection measures, as established by local legislation:

a. Notify the USER in a timely and appropriate manner of the use of their data by TILOPAY®

b. Collect personal data only for specific and legitimate purposes. The information will be relevant, adequate and not excessive for the purposes for which it is collected;

c. Treat the personal data of users in a manner consistent with the purposes for which it was originally collected or for which the USER subsequently granted their consent;

d. Take commercially reasonable steps to ensure that personal data and information is reliable, accurate and complete for its intended use and, where appropriate, up to date;

e. Do not use restricted personal data to send commercial communications directly without giving you the opportunity to “say no”; (OPT OUT) and

f. Take the appropriate measures, by contract or in any other way, to guarantee adequate protection of personal data that is disclosed to third parties, including communications with banks and credit card companies.

V. Security. TILOPAY® is a company committed to fulfilling the commitment to keep your information safe, for which it will use advanced and constantly updated systems to ensure the user that there is no unauthorized access.

VI. Third Party Links. This website may contain links to other sites that may be of interest to you. Once the USER clicks on these links and leaves our page, we no longer have control over the site to which he is redirected and therefore we are not responsible for the terms or privacy, or the protection of your data on those other sites. of third parties. These sites are subject to their own privacy policies, so it is recommended that you consult them to confirm that you agree with them.

VII. Responsible Conduct. The user guarantees that the personal data provided to TILOPAY® is true and is responsible for informing the latter of any changes to them.

TILOPAY® will not sell, transfer or distribute the personal information that is collected without your consent, except in the cases of exception stipulated in Law No. 8968 and its regulations.

VIII. Rights of access, rectification, opposition and cancellation of users. The user may exercise their rights of access, rectification, opposition and cancellation to the processing of their personal data.

You can exercise these rights by contacting the email [email protected]

IX. Modification of this data protection policy. TILOPAY® reserves the right to modify this policy to adapt it to future legislative or jurisprudential changes, as well as to industry practices, informing users in advance of the changes that occur in it, simply by updating them on the site.

Authorized in San José, Costa Rica, November 2021.