Privacy Notice

1. Who we are and what this notice covers

StarPago is a payment acceptance brand of AIDeeGroup. We help businesses in Latin America and Asia collect payments from their customers, send payouts to local bank accounts and wallets, and settle collected funds in USD or USDT. Our services are provided to businesses only. We do not open accounts for consumers.

In this notice, "StarPago", "we", "us" and "our" mean Star Pay Tecnología, S.A. de C.V., registered at Calle Lago Alberto 320, Int. 06B 601, Col. Granada, Alcaldía Miguel Hidalgo, C.P. 11520, Ciudad de México, México, together with any affiliate that provides the services to you in a particular market, as identified in your merchant agreement or onboarding confirmation. "You" means the person reading this notice, whether you visit our website, represent a merchant, or make or receive a payment through a merchant that uses StarPago.

This notice explains what personal data we collect, why we use it, who we share it with, how long we keep it, and the rights you have. It applies to our website, our sales and onboarding process, our merchant dashboard and API, and the payment services we provide. It does not cover the websites, apps or privacy practices of our merchants. If you buy from or are paid by a merchant, please also read that merchant's privacy notice.

2. Our role: controller or processor

Data protection laws distinguish between the party that decides why and how personal data is used (a "controller", also called a "responsible party", "data fiduciary" or "personal information controller" in some countries) and a party that handles data on someone else's instructions (a "processor", "operator" or "data processor"). Our role depends on the activity.

• We act as a controller for data about website visitors and sales enquiries; data about merchants, their representatives, directors and beneficial owners that we collect for onboarding (KYB), anti-money laundering checks and account management; and payment data that we use for our own legal obligations, such as fraud prevention, sanctions screening, record keeping and responding to authorities.
• We act as a processor on behalf of the merchant when we handle data about payers and payees only to carry out the merchant's payment instructions, for example to display a checkout, route a collection or deliver a payout. In that case the merchant is the controller, and you should direct most requests about your data to the merchant. We will help the merchant respond.

Where both roles apply to the same transaction, each of us is responsible for our own part. Our merchant agreement includes data protection terms that set out these responsibilities.

3. Personal data we collect

3.1 Website visitors and prospective merchants

• Information you submit through our contact form: your name, work email, company name, company website, industry, approximate daily number of transactions, and the markets and products you are interested in.
• Any other information you choose to share with us by email, chat or call.
• Technical data your browser sends when you load our pages, such as IP address, browser type, device type and the pages requested. See section 12 for how our website uses local storage and third-party resources.

3.2 Merchants, their representatives and beneficial owners

• Identity and contact details of directors, authorised signatories, account users and ultimate beneficial owners: name, date of birth, nationality, position, identification document details and copies, tax identification numbers, address, email and phone.
• Information about the business: registration documents, ownership structure, licences where applicable, websites and apps, business model, products, expected volumes, and bank or wallet details for settlement.
• Screening results: checks against sanctions lists, politically exposed person lists and adverse media, and the outcome of our risk assessment.
• Dashboard and API usage: user names, roles, login records, actions taken, IP addresses and security events.

3.3 Payers and payees (end users of our merchants)

• Payment details needed to complete a collection or payout: name, national identification or tax number where required by the payment method (for example CPF in Brazil or RUT in Chile), email or phone, bank account or wallet identifiers, and, for card payments, card data handled by our card processing partners.
• Transaction data: amount, currency, date, time, merchant, payment method, status, and reference numbers.
• Fraud and risk signals: device and network data, IP address, behavioural signals, and the results of name matching and other checks.
• Information from disputes, complaints and refund requests.

3.4 USDT settlement

Where a merchant chooses USDT settlement, we process the receiving wallet address, related transaction hashes and the results of on-chain address screening. Public blockchain data is visible to anyone and cannot be deleted by us.

4. Where we get personal data

• Directly from you, for example when you fill in our contact form, complete onboarding or contact support.
• From the merchant, when it sends us payment or payout instructions, or provides information about its representatives and beneficial owners.
• From payment partners, banks, card networks and local payment schemes involved in a transaction.
• From identity verification, company registry, sanctions screening, fraud prevention and blockchain analytics providers, and from public sources such as official registers.
• From other AIDeeGroup brands, where you have a relationship with them and the sharing is permitted by law.

5. How we use personal data and our legal bases

Depending on the country, the law may require us to identify a legal basis for each use. The table below summarises our main purposes. Where a country's law uses different terms, we rely on the closest equivalent basis that it recognises.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that took place before, and we may still process data on another legal basis where the law allows, for example to meet record-keeping obligations.

6. Who we share personal data with

We do not sell personal data. We share it only as described below, and only as much as is needed for the purpose.

• Merchants. We share payment and status information with the merchant involved in a transaction, so that it can fulfil orders, reconcile payments and handle customer service.
• Payment partners and banks. Local acquirers, banks, payment institutions, card networks, local payment schemes and wallet providers that are needed to complete collections, payouts and settlement in each market.
• Service providers. Providers of cloud hosting, identity verification, sanctions and adverse media screening, fraud prevention, blockchain analytics, customer support tools, communications and professional services such as auditors and lawyers. They act on our instructions and under contractual confidentiality and security obligations.
• AIDeeGroup brands. Other AIDeeGroup companies and brands, such as DeePayment, for shared operations, risk management and compliance, and, where you ask for it, to offer services that StarPago does not provide, such as business accounts and standalone currency exchange.
• Authorities. Regulators, financial intelligence units, tax authorities, courts and law enforcement agencies, where we are required by law or where disclosure is necessary to prevent fraud or protect rights.
• Business transfers. A buyer, investor or successor in connection with a merger, acquisition, reorganisation or sale of assets, subject to confidentiality and to this notice.

7. International transfers

We operate across several countries, and our partners and service providers may be located in a country other than yours. This means personal data may be transferred to, stored in, or accessed from other countries, including [Primary hosting locations].

When we transfer personal data internationally, we use the safeguards required by the applicable law. Depending on the country, these may include transfers to countries recognised as offering adequate protection; standard contractual clauses approved by the relevant authority (for example, the standard clauses adopted by Brazil's ANPD); other contractual commitments; your consent where the law requires it; or transfers necessary to perform a contract or a payment you requested. Some countries restrict or require approval for certain transfers, and we follow those rules. You can request more information about the safeguards we use by contacting us at [privacy@...].

8. How long we keep personal data

We keep personal data only for as long as we need it for the purposes above, including to meet legal, regulatory, tax, accounting and reporting requirements. As a payment service provider, we must keep many records for a fixed period after the end of the business relationship or the date of the transaction. Anti-money laundering laws in our markets typically require this period to be at least five years, and some require longer.

• Onboarding and KYB records: for the duration of the relationship and then for the period required by anti-money laundering law, currently [Retention period] after the relationship ends.
• Transaction records: for the period required by anti-money laundering, tax and payment regulations in the relevant market, currently [Retention period].
• Sales enquiries that do not lead to a relationship: up to [Retention period] after our last contact.
• Security logs: up to [Retention period], unless needed for an investigation.

Where data is subject to a dispute, investigation or legal hold, we keep it until the matter is resolved. When the retention period ends, we delete or anonymise the data.

9. How we protect personal data

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration and disclosure. These include encryption in transit, access controls based on job role, multi-person approval for sensitive changes such as settlement wallet updates, logging and monitoring, credential management for API keys, vendor due diligence, and staff confidentiality obligations. Card data is handled by partners that are required to meet the applicable card industry security standards.

No system is completely secure. If we become aware of a personal data breach that is likely to affect your rights, we will notify the relevant authorities and affected persons where the law requires, within the time the law sets.

10. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, ask us to delete it, object to or restrict certain uses, receive a copy in a portable format, withdraw consent, and ask for a review of decisions made solely by automated means. These rights have limits. For example, we may not be able to delete data that we must keep under anti-money laundering law, and where we act as a processor we will refer your request to the merchant.

The table below gives an overview of the main law and supervisory authority in each of our markets. It is a summary and does not replace the law itself.

How to exercise your rights

Send your request to [privacy@...] or write to us at Calle Lago Alberto 320, Int. 06B 601, Col. Granada, Alcaldía Miguel Hidalgo, C.P. 11520, Ciudad de México, México. Please tell us which market you are in and how you have interacted with StarPago, for example as a merchant contact or as a customer of a named merchant. We may need to verify your identity before we act on your request. We will respond within the time the applicable law requires, and we will not charge you unless the law allows a fee. If we act as a processor for the merchant, we will forward your request to the merchant and help it respond.

11. Automated decisions and fraud prevention

To keep payments safe, we use automated tools that score transactions and accounts for signs of fraud, money laundering or other misuse. These tools may check whether a payee's name matches the account holder, apply limits, compare activity with expected patterns, and screen names and wallet addresses against sanctions and risk lists. As a result, a transaction may be delayed, sent for manual review, or declined.

Significant decisions, such as declining onboarding or closing an account, involve human review. Where the law gives you the right to request human review of a decision made solely by automated means, to express your point of view, or to receive information about the criteria used, you can exercise it by contacting us. For security reasons, we may not disclose details that would help someone get around our controls.

12. Cookies and local storage

Our website does not currently use analytics or advertising cookies. It stores your language preference in your browser's local storage, loads fonts from Google Fonts, and requests reference exchange rates from a public rate service. For details and how to clear stored data, see our Cookie and Local Storage Notice.

13. Children

Our services are designed for businesses and are not directed to children. We do not knowingly collect personal data from children through our website. A merchant's end users may include minors only where the merchant's business and local law allow it, and in that case the merchant is responsible for obtaining any required parental or guardian consent. If you believe we hold a child's data in error, please contact us.

14. Contact and complaints

If you have questions or concerns about this notice or how we handle personal data, contact us:

• Email: [privacy@...]
• Data protection officer: [Data protection officer name and contact]
• Postal address: Star Pay Tecnología, S.A. de C.V., Calle Lago Alberto 320, Int. 06B 601, Col. Granada, Alcaldía Miguel Hidalgo, C.P. 11520, Ciudad de México, México
• Local representatives, where required by law: [Local representative details]

We will try to resolve your concern directly. You also have the right to lodge a complaint with the supervisory authority in your country, listed in section 10. In some countries, the law asks you to contact us first before going to the authority.

15. Changes to this notice

We may update this notice from time to time to reflect changes in our services, our partners or the law. We will post the updated version on this page with a new "last updated" date. If a change materially affects how we use your personal data, we will give merchants advance notice through the dashboard or by email, and, where the law requires, ask for consent again.