Welcome to CLARA!

A. Purposes for the Use of Personal Data

We will use the personal data we collect from you for the following purposes, which are necessary for the service you request:

1. Necessary Purposes

1. Carrying out all activities related to access to the services offered by Clara, including: analyzing creditworthiness; checking credit history; evaluating financial information; validating identity and authenticity; determining commercial terms such as credit line amounts and applicable interest rates; generating and executing contracts and other legal documents; setting up payment mechanisms; direct debits and generation of account statements; monitoring credit behavior and use of the credit line; and reporting relevant or unusual transactions.
2. Carrying out all activities related to the operation of credit cards (the “Cards”), including: processing applications and the administration, issuance, delivery and activation of the Cards; collection activities, including sending communications via email, phone calls, instant messaging services, text messages and other physical and/or electronic means of communication; clarifying, investigating and billing charges related to the Cards; conducting periodic investigations and monitoring of your credit behavior; conducting home visits for data validation, delivery of the Cards and/or management of applications; creating consumption profiles, spending averages and enrollments; client referral programs; points accrual; and redemptions and administration of loyalty programs, both our own and those of third parties.
3. Generating authentication data in order to, on the one hand, create an access profile for electronic systems to provide you with personalized service and, on the other, verify your identity when you use electronic and/or automated equipment or systems for the provision of our services; and, if you are at our facilities, to maintain access control and maintain programs to ensure the safety and protection of clients, employees, visitors and suppliers through electronic, optical or any other technological devices and means;
4. Generating authentication data to verify your identity when you log in through third-party services, for example when using Google Sign-In (SSO), and to provide a personalized experience based on your preferences and interactions with our services;
5. Verifying your identity in accordance with the Company’s internal procedures, including requesting credit information from you in order to cross-check and/or validate such information, or even demographic information, such as your address, with the credit information company of our choice;
6. For identity verification purposes, and in compliance with fraud prevention provisions and regulatory obligations, the data contained in your Voter ID Card (Credencial para Votar) and the photograph captured (selfie) may be verified and compared, respectively, with the National Electoral Institute (INE) through the Voter ID Card Data Verification Service (SVDCPV);
7. Preparing statistical and financial reports for your company or the company you work with;
8. Creating and implementing the analytical and statistical processes necessary for the provision of the services;
9. Contacting you about any matter related to the services or to this Privacy Notice;
10. Complying with obligations arising from any legal relationship established between the Company and you as a result of the provision of the services;
11. The origination, operation, management, processing and administration of the products and/or services contracted with the Company, the Company being authorized to: (i) verify/validate the personal data provided, including its truthfulness, directly with government authorities and/or against public entity databases; and (ii) in the event of any discrepancy, make the rectifications or corrections necessary to keep your information up to date and correct;
12. For internal or external audit purposes, as well as to comply with obligations to cooperate with and/or respond to information requests from competent government authorities, when necessary to safeguard the public interest or the procurement or administration of justice, and/or under current applicable law;
13. To compile files and databases and process them, whether directly by the Company or through third parties or providers necessary for the Company to provide the services within its corporate purpose, and to report such information to administrative and judicial authorities when required by current legal provisions;
14. To share information with competent authorities and comply with applicable financial and anti-money laundering provisions; and to implement measures to identify and mitigate potential fraudulent or unauthorized activities;
15. To compile files and databases and process them.

2. Secondary Purposes

Additionally, we will use your personal information for the following secondary purposes, which are not necessary for the requested service but allow and help us provide you with better service:

1. Conducting inquiries, surveys, investigations and reviews in connection with your complaints or claims;
2. Evaluating the quality of the services through surveys;
3. The Company’s sending of all kinds of notices, notifications, communications, service surveys and additional information related to the contracted products and services, and monitoring through phone calls, emails, text messages and/or any other means of contact, regarding any activity directly or indirectly related to the products and/or services offered by the Company;
4. Monitoring and recording user sessions within the technology platform(s) used by the Company to provide the services, in order to measure the quality of the services, research the use of the technology developed by the Company, and understand the client’s transactional habits;
5. Marketing or advertising;
6. Commercial prospecting;
7. Generating analyses, statistical models, predictive models, business intelligence tools, transactional profiles, metrics, indicators, benchmarking, reports, market research, sector analyses, consumption trends and other analytical products derived from the information processed by Clara;
8. Using the information to develop, train, validate, improve and commercialize algorithms, analytical models, automation tools, artificial intelligence systems, technology products and financial solutions developed by Clara or by third parties with whom Clara maintains commercial relationships;
9. Generating aggregated, anonymized, de-identified or statistical information that does not reasonably allow data subjects to be identified, in order to create commercial products, reports, indicators, market research, comparative analyses and financial or business intelligence solutions;
10. Sharing, licensing, commercializing, transferring or making available to third parties aggregated, anonymized, statistical or de-identified information derived from the use of Clara’s services, for commercial, analytical, statistical, technological, financial, advertising, research, product development or business intelligence purposes;
11. Carrying out segmentation, commercial profiling, financial behavior analysis, risk analysis, pattern detection, recommendation generation and identification of market trends.

Your refusal to allow the use of your personal data for these secondary purposes cannot be a reason for us to deny you the services and products you request or contract with us.

B. Types of Personal Data We Collect

Individuals

1. Identification Data

1. Name
2. Number and details of valid official identification
3. Address
4. Business and/or personal email
5. Phone number

Legal Entities

1. Identification Data

1. Corporate or business name, in the case of a legal entity
2. Full name, in the case of an individual
3. Federal Taxpayer Registry number (RFC)
4. Strengthened Confidential Electronic Identification Key (Contraseña, SAT password)
5. Tax and business address
6. Notarized powers of attorney
7. Articles of incorporation

2. Legal Representative Identification Data

1. Name
2. Date of birth
3. Valid official identification number
4. Phone
5. Business and/or personal email
6. Unique Population Registry Code (CURP) and RFC
7. Copy of valid official identification
8. Occupation
9. Profile photo (for example, from Google and other sites)

3. Contact Data

1. Email
2. Phone

4. Financial Data

1. Information provided by credit information institutions
2. Bank account statements provided by the applicant
3. Financial statements
4. Account numbers at financial institutions

5. Data of Partners, Shareholders and Ultimate Beneficial Owners

1. Shareholding structure and ultimate beneficial owner data
2. Full name
3. Valid official identification number
4. Date of birth
5. Nationality
6. CURP
7. RFC
8. Copy of valid official identification
9. Tax address
10. Email
11. Phone
12. Percentage of shareholding in the legal entity
13. Source of the funds invested

Individuals with Business Activity

1. Identification Data

1. Name
2. Valid official identification number
3. Date of birth
4. Place of birth
5. CURP
6. RFC
7. Line of business or economic activity registered with the SAT
8. Tax and business address
9. Business and/or personal email
10. Phone number

2. Financial Data

1. Information provided by credit information institutions
2. Bank account statements provided by the applicant
3. Financial statements
4. Account numbers at financial institutions

Additionally, for individuals, legal entities and individuals with business activity alike, the following may be collected:

1. Biometric Data (see Section I)

1. Measurable physical, physiological or behavioral properties or personality traits attributable to a single person, such as fingerprints or facial photographs

2. Usage, Inferred and Derived Data

1. We may collect information about your interactions with our services, including the pages you visit and the actions you take
2. We infer and derive data elements by analyzing our relationship and transactional information
3. We collect geolocation data from the device from which you access our services, in order to comply with current regulatory provisions

C. Exercising Your ARCO Rights (Access, Rectification, Cancellation or Opposition)

You have the right to know what personal data we hold about you, what we use it for and the conditions of its use (Access). You also have the right to request the correction of your personal information if it is outdated, inaccurate or incomplete (Rectification); to have it deleted from our records or databases when you consider that it is not being used properly (Cancellation); and to object to the use of your personal data for specific purposes (Opposition). These rights are known as ARCO rights.

To exercise any of the ARCO rights, you must submit the corresponding request through the following channel: arco@clara.team

The contact details of the person or department in charge of personal data, responsible for processing ARCO rights requests, are as follows:

Email: arco@clara.team

You may revoke any consent you have given us for the processing of your personal data. However, please bear in mind that we may not be able to fulfill your request or stop using your data immediately in every case, since we may be required by a legal obligation to continue processing your personal data. You should also consider that, for certain purposes, revoking your consent will mean that we can no longer provide the service you requested, or the end of your relationship with us.

To revoke your consent, you must submit your request through the following channel: arco@clara.team

For individuals and individuals with business activity: if you do not wish to receive advertising, promotions or information about financial products and services from Clara, you may exercise your right to limit the use of your personal information through the Public Registry of Users (REUS) administered by the National Commission for the Protection and Defense of Financial Services Users (CONDUSEF).

D. Limiting the Use or Disclosure of Your Personal Information

So that you can limit the use and disclosure of your personal information, we offer you the following means:

1. Contacting the Company by email at: arco@clara.team

The person submitting the request to limit the use or disclosure of personal information must have sufficient legal standing; therefore, before processing the request, Clara may ask them to prove their legal standing.

You can also manage your account settings and privacy preferences through your account settings.

E. Transfer of Personal Data

A data transfer is any communication of personal data to a person other than Clara. We may share your personal data with third parties in the following circumstances:

1. Service providers: we may share your information with external service providers that help us provide and improve our services;
2. Legal compliance: we may disclose your information to comply with legal obligations or respond to legal requests;
3. Clara’s holding companies, subsidiaries or affiliates, to fulfill the purposes described above;
4. Domestic and international third parties with whom Clara enters into commercial transactions, including purchase and sale, exchange, installment sales with interest, financing, and assignment of rights necessary for Clara’s operations, ensuring proper safeguarding for the purposes and measures established in this notice;
5. Clara may share with domestic or international third parties statistical, anonymized, aggregated or de-identified information, as well as insights, indicators, trends, analytical models and other products derived from data processing, for commercial, technological, financial, analytical, statistical, research, business intelligence or product development purposes;
6. Clara may transfer information to commercial allies, technology providers, strategic partners, financial institutions, analytics entities, technology platforms and third parties involved in the development, commercialization or operation of analytical products, predictive models, artificial intelligence tools or financial and business intelligence solutions.

Some specific cases are:

Sistema de Transferencias y Pagos STP, S.A. de C.V. (STP)

In order to offer you an Intermediation Service consisting of the presentation or proposal for entering into Deposit Agreements with STP, Clara transfers the following data to STP:

1. Corporate or business name, in the case of a legal entity
2. Name, in the case of an individual
3. Federal Taxpayer Registry number (RFC)
4. Unique Population Registry Code (CURP)
5. Nationality
6. Address
7. Occupation
8. Articles of incorporation
9. Notarized powers of attorney
10. Official identification of the legal representative
11. Official identification of the beneficial owner
12. Electronic signature (e.firma) number
13. Tax status certificate (Constancia de Situación Fiscal)
14. Email
15. Phone

Banca Afirme S.A., Institución de Banca Múltiple, Afirme Grupo Financiero (Afirme)

In order to offer you an Intermediation Service consisting of the presentation or proposal for entering into credit agreements with Afirme, Clara transfers the following data to Afirme:

1. Corporate or business name, in the case of a legal entity
2. Name, in the case of an individual
3. Federal Taxpayer Registry number (RFC)
4. Unique Population Registry Code (CURP)
5. Nationality
6. Address
7. Occupation
8. Articles of incorporation
9. Notarized powers of attorney
10. Official identification of the legal representative
11. Compliance with tax obligations
12. Tax status certificate (Constancia de Situación Fiscal)
13. Transactional information
14. Email

F. Data Acquired Through Third Parties

Clara may combine information obtained directly from the data subject with information obtained from third parties, public sources, information providers, commercial allies, technology platforms and legally publicly accessible sources, in order to enrich analytical models, generate insights, develop products and improve its services. Data collected through third parties will be processed by Clara in accordance with this Privacy Notice.

Tax Administration Service (SAT)

Clara uses your RFC and Contraseña (SAT password) to link Clara’s Technology Platform to the SAT; in this way, Clara accesses and verifies your tax information.

The data collected through the SAT is as follows:

1. Digital Tax Receipts (CFDI) issued
2. Digital Tax Receipts (CFDI) paid
3. Tax refunds
4. Tax status
5. Compliance with tax obligations
6. Tax withholdings

Buró de Crédito (Credit Bureau)

Clara collects information through Buró de Crédito in order to determine your credit behavior and ability to pay. For this purpose, you must give Clara your express authorization so that, through its authorized officers, Clara may carry out investigations into your credit behavior with the Credit Information Companies it deems appropriate, in accordance with Article 28 of the Law to Regulate Credit Information Companies (Ley para Regular a las Sociedades de Información Crediticia).

The data collected through Buró de Crédito is as follows:

1. Financial data consisting of the information provided by credit information institutions.

Plaid Inc.

Clara uses the services of Plaid Inc. (“Plaid”) to process your financial data. Through Plaid, Clara links to your bank account in order to verify it and confirm your bank account balance so as to approve and maintain a credit limit.

The data collected through Plaid is as follows:

1. Financial data consisting of the name of the financial institution, the account name and number, and the account balance.

Sift Science, Inc.

For the proper protection and use of the Technology Platform, Clara uses the services of Sift Science, Inc. (“Sift”), allowing Sift to connect to the Technology Platform.

The data collected through Sift is as follows:

1. Name
2. Phone
3. Email
4. Address

G. Changes to the Privacy Notice and Security

This privacy notice may be modified, changed or updated as a result of new legal requirements; our own needs regarding the products or services we offer; our privacy practices; changes in our business model; or other causes.

We undertake to keep you informed of any changes to this privacy notice through: https://www.clara.com/avisodeprivacidad

We take reasonable measures to protect your information against unauthorized access or disclosure, following our PCI security policies.

H. Cookie Policy and Other Technologies

What is a cookie? Cookies are data stored on the user’s device while connected to the internet, when browsing or accessing certain web pages, that allow the web server to remember certain user data, uniquely identify the visitor’s browser, or store information or settings in the browser.

What cookies and other technologies does Clara use? Clara uses first-party cookies (those created by Clara through its developers and engineers) and third-party cookies (those created by third parties unrelated to Clara). Specifically, Clara uses the following cookies:

1. Performance cookies: these allow Clara to monitor the performance of its website and platform by viewing and counting the number, date and time of visits
2. Preference cookies: these allow Clara to recognize your preferences, taking into account your visit to our website and to other websites
3. Analytics cookies: Clara uses first-party and third-party cookies to perform analysis related to the operation and use of our platform
4. Mobile device identifiers: tags that make it possible to identify mobile devices
5. Pixel tags: used by Clara to learn about your interests and interaction with our platform and third-party platforms in order to personalize and individualize the user experience
6. Other cookies and types of technology: we use other types of cookies and technology to improve your overall experience on our platform, and for this purpose we collect information that allows us to learn your preferences and options in order to improve the platform
7. Recording: Clara may record customer support phone calls, record screens while the Technology Platform is being used and, in general, use recording technology that allows Clara to improve the service and the Client’s experience, as well as the quality of the services offered. Recordings will be used solely for the purposes established in this Notice

For what purposes does Clara use cookies and other technologies?

1. To recognize you when you log in to Clara’s platform or website
2. To recognize and keep track of your preferences
3. To collect information that allows us to provide you with a personalized and unique experience, based on your interests and preferences
4. To collect information that allows us to recognize and fix errors or failures in the Technology Platform
5. To collect information that allows us to support you if you have any problem with the Technology Platform
6. To analyze how you interact with and how long you use our platform in order to improve the experience
7. To track and thereby improve the use of our platform
8. To make Clara’s content more relevant to the Client’s preferences
9. To learn which of the services offered by Clara are used most
10. To remember users’ actions within the platform
11. To monitor the status of the servers Clara uses to make the website and platform available to you
12. To improve the speed and accessibility of our website and platform
13. To improve security
14. To personalize the services the Client uses
15. To improve the services

What information is stored in cookies?

1. Browser and operating system used to access our platform
2. Link used to access our platform
3. IP address and servers
4. Date and time of access to our site, as well as how long you use our platform
5. Links visited
6. Information related to your preferences and how to improve the Clara experience, by learning about and adapting our service to your needs.

Who is responsible for the use and management of cookies? CF Tech S.A. de C.V. SOFOM ENR., better known as CLARA, with its address at Av. Sonora 46, 4th Floor, Col. Roma Norte, Alc. Cuauhtémoc, C.P. 06700, Mexico City, Mexico.

How do I disable cookies?

1. You may disable cookies at any time by following the process established by your browser (Google Chrome, Firefox or any other)
2. You may modify and cancel the use of one, some or all cookies in the corresponding section of our website
3. Please bear in mind that disabling cookies does not restrict your access to the website or platform, but it may affect the functionality and experience that Clara offers you

I. Biometric Data Use Policy

By activating the feature for accessing and authenticating to our Services through biometric means, you accept the following terms regarding the use of your biometric data:

1. Clara does not store, copy or keep the biometric data you use to access and authenticate when logging in to our digital platforms.
2. The biometric data used as a means to access and authenticate within our digital platforms is created and stored within your personal mobile device, as provided in the privacy policies published by the developer and distributor of that operating system.
3. Biometric data will be used solely to identify you when accessing the digital platforms and to authorize transactions within them.
4. You may cancel access and authentication through biometric means via the access, rectification, cancellation or opposition procedure set out in Section “C” of our Privacy Notice (https://www.clara.com/avisodeprivacidad).

J. Use of Aggregated and Anonymized Information

Clara may generate anonymized, aggregated, statistical or de-identified information from the data processed under this Privacy Notice.

Such information may be used by Clara for commercial, analytical, statistical, technological, research, product development, algorithmic model and artificial intelligence training, benchmarking and market insight generation purposes.

Anonymized or aggregated information will not be considered personal data when it does not reasonably allow an identified or identifiable individual to be identified under applicable law.

If you have any questions or concerns about this Privacy Policy, contact us at arco@clara.team

If you believe that your right to the protection of personal data has been violated by the improper processing of your information, or if you wish to file a complaint for a possible violation of the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), you may go to the competent authority.