PITZ Personal Data Processing Policy (Privacy Policy)

Last updated: June 9, 2025

I. INTRODUCTION

PITZ AUTOMOTIVE TECHNOLOGIES, S.A.P.I. DE C.V. (hereinafter, "PITZ"), with registered office in Mexico City, is a Mexican company that develops and operates a digital platform composed of a mobile application and a website, designed to offer SaaS (Software as a Service) functionalities under a subscription and marketplace model, facilitating the connection between users referred to as "Customers" and "Sellers".

In order to comply with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties ("LFPDPPP"), its Regulations, the Guidelines on the Privacy Notice and other applicable regulations, PITZ adopts this Personal Data Processing Policy (hereinafter, the "Policy") to guarantee the privacy, security, confidentiality and informational self-determination of the data subjects whose data is collected.

II. DEFINITIONS

  • Customer: Individual or legal entity that purchases subscription plans or other services offered by PITZ.
  • Seller: Individual or legal entity that offers products or services through the PITZ platform.
  • Personal Data: Any information relating to an identified or identifiable individual.
  • Sensitive Data: Information that concerns the most intimate sphere of the data subject, or whose improper use could give rise to discrimination or pose a serious risk to the data subject.
  • Data Processor: Individual or legal entity that alone or jointly with others processes data on behalf of the data controller.
  • Data Controller: PITZ, which decides how personal data is processed.
  • Processing: The collection, use, disclosure, storage, access, transfer or disposal of personal data.
  • Artificial Intelligence (AI) Tools: Technologies used by PITZ that enable the automation, prediction, classification and personalization of data and services, based on advanced analysis of the information collected.

III. GOVERNING PRINCIPLES

PITZ is committed to ensuring that the processing of personal data is governed by the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality and accountability, in accordance with the legal framework in force in Mexico.

IV. PERSONAL DATA SUBJECT TO PROCESSING

PITZ may collect, among others, the following types of personal data:

  • Identification and contact data (name, email, phone number, address, CURP, RFC).
  • Employment and billing data (in the case of Sellers).
  • Financial or asset data (exclusively for payment processing, in accordance with the law and through authorized providers).
  • Browsing and platform usage data (cookies, IP address, online identifiers).
  • Geolocation data, only when necessary to provide a specific service.
  • User interactions on the platform (transaction history, preferences and behaviors).
  • Information inferred or generated through AI algorithms and advanced analytics tools, such as segmentations, usage patterns, predictive models or personalized recommendations.

V. PURPOSES OF PROCESSING

The purposes of data processing are classified as:

Primary purposes (mandatory):

  1. Create, administer and manage Customer and Seller accounts.
  2. Verify users' identities.
  3. Provide and operate the services contracted through the platform.
  4. Process payments through the payment gateway contracted by PITZ (currently operated by Mercado Pago).
  5. Comply with applicable legal and regulatory obligations.
  6. Handle requests, incidents, complaints or inquiries.
  7. Use AI tools and advanced analytics to personalize the user experience, optimize operations, detect fraud or irregular use and prevent risks, as well as continuously improve service quality.
  8. Issue electronic tax receipts.

Secondary purposes (optional and subject to consent):

  1. Send promotions, advertising or personalized recommendations.
  2. Conduct satisfaction surveys, statistical analyses or market research.
  3. Invite to events, loyalty programs or additional benefits.

The data subject may object to processing for secondary purposes at any time as indicated in the Privacy Notice.

VI. DATA SUBJECT CONSENT

The data subject's consent will be obtained prior, express and informed, either through electronic means (digital acceptance), in writing or through interactions on the platform, except in cases of exception provided for in the LFPDPPP.

VII. USE OF COOKIES AND TRACKING TECHNOLOGIES

The PITZ Platform uses first- and third-party cookies, session and persistent cookies, for the following purposes:

  • Facilitate user navigation and authentication.
  • Collect performance and navigation metrics.
  • Personalize content and the user experience.
  • Display ads based on user behavior.

The User may disable cookies from their browser, which could affect the proper functioning of some features. For more information, consult our Cookie Policy.

VIII. TRANSFERS AND DISCLOSURES

PITZ may:

  • Transfer data to national or foreign authorities when required by law.
  • Disclose data to processors for the fulfillment of purposes (hosting providers, analytics, payment processors such as Mercado Pago, cloud services, AI tools, etc.).

In all cases, the necessary agreements will be executed to ensure the security and confidentiality of the data.

IX. DATA SUBJECT RIGHTS (ARCO)

The data subject may exercise their rights of Access, Rectification, Cancellation and Opposition (ARCO), as well as revoke their consent, by submitting a request to the email address: legal@pitz.com.mx, including:

  • Full name and contact method to receive the response.
  • Copy of official identification.
  • Clear description of the data regarding which the right is to be exercised.
  • Any other element that facilitates their location.

The timeframe to respond will be 20 business days, extendable by another 10 days when legally appropriate. If the request is granted, it will be carried out within 15 business days following the date of communication of the response.

X. DATA SECURITY

PITZ adopts administrative, technical and physical security measures in accordance with national and international standards to protect personal data against loss, alteration, unauthorized access, misuse or disclosure.

XI. CHANGES TO THE POLICY

Any modification to this Policy will be published on the website www.pitz.com.mx/privacidad at least 5 business days in advance. If a new consent is required, PITZ will collect it in accordance with applicable regulations.

XII. EFFECTIVE DATE

This Policy comes into effect on June 9, 2025 and will remain in force while necessary to fulfill the described purposes or while there is a contractual, legal or service relationship with the data subjects, or in accordance with the data retention periods established in Mexican regulations.

PITZ Personal Data Processing Policy (Privacy Policy) | Pitz