Privacy Statement

Please contact us if you have any questions regarding this Privacy Statement or in general questions regarding your Personal Data. Your information will be used to provide the Services and in accordance with this Privacy Statement and the relevant PayPal User Agreement.

Operadora PayPal de Mexico, S. de R.L. de C.V. (“we,” “our,” “us,” “PayPal”) has written this Privacy Notice to explain how PayPal may collect, hold, process, share and transfer your Personal Data when you visit our sites or use your PayPal account and/or your Fastlane profile (collectively, the “Services”). This Privacy Notice applies to your Personal Data when you visit our Sites or use our Services, but does not apply to websites or online services that we do not own or control (including those of the Merchants). We encourage you to read this Privacy Statement and to use it to help you make informed decisions.

Certain capitalized terms that are not otherwise defined in the Statement are explained in Section 12 ("Definitions") at the end of this statement.

Please contact us if you have questions about privacy practices not addressed in this Privacy Statement.

Operadora PayPal de Mexico, S. de R.L. de C.V., with its main address at Avenida General Mariano Escobedo 476, 14th Floor, Colonia Nueva Anzures, Miguel Hidalgo, Mexico City, Mexico 11590, is the data controller for the Personal Data collected and processed in connection with Personal Data obtained when you visit our website, during the registration and application process, and throughout your continued use of the Services.

Some of the third parties that we share Personal Data with are independent data controllers. This means that we are not the ones that dictate how the data that we share will be processed.

Examples are authorities, credit bureaus, Merchants, acquirers, and financial institutions. When your data is shared with independent data controllers, their data policies will apply. We encourage you to read their privacy policies and know your privacy rights before interacting with them.

For most of our Services, we act as a “data controller”, however there are some products and features where PayPal may also act as a “data processor” when providing services to our Partners and Merchants. The “data controller” (each as defined under applicable data protection laws) is the entity that has the control over the purposes and means by which the data processing is performed. The “data processor” (each as defined under applicable data protection laws) is the entity that processes the Personal Information for the data controller, for the data controller’s specific purposes, and as otherwise permitted under applicable data protection laws.

Our Services may be accessed by individuals without a PayPal account. We will collect Personal Data from you even if you are a non-account holder when you use our Services, such as when you use our Services without a PayPal account, use Unbranded Payment Services (e.g. Advanced Credit and Debit Card Payments), or when you receive a payment through our Services from account holders (“Recipient”). If you use our Services without a PayPal account, we may link your transaction information with your PayPal account, if you have one at the time you use the Service without logging in, or if you create a PayPal account later. We use the term “User” to apply to account and non-account holders. If you are a non-account holder, your Personal Data will be used to provide the Services and in accordance with this Privacy Statement and the relevant PayPal User Agreement.

With a Fastlane profile, individuals can store their payment methods and other Personal Data with PayPal so that they can complete the checkout process faster, create a store or loyalty account, or facilitate other transactions at participating Partners and Merchants with payment card, contact information, shipping data or other data they save in their Fastlane profile as relevant to the specific interaction, participating Partner or Merchant, all without having to manually input payment method details and other Personal Data each time they check out (“Fastlane”).

When you create a Fastlane profile, PayPal will store your Personal Data, including your name, email, phone number, address information, billing information and payment method details, and other data that will be relevant to specific Partner or Merchant interactions, and pre-populate that information in the checkout flows or other interactive features of participating Partners and Merchants so that you can enjoy a faster Partner and Merchant experience by not having to manually input your payment or other information. We will also collect transaction and other Partner or Merchant data related to your purchases and other Partner and Merchant interactions when you use Fastlane. If you have a Fastlane profile, we may recognize you as a Fastlane user when you shop on the participating Partners and Merchants sites and we may prompt you to engage in participating Partner or Merchant interactions, such as register for a store or loyalty account using your Fastlane profile information. If you choose to interact with participating Partners or Merchants through Fastlane, you agree to let PayPal disclose your Fastlane profile information to the Participating Partners and Merchants and their service providers, and to facilitate your transaction and shopping experience on the participating Partners and Merchants sites.

When you shop on Partner and Merchant sites, the Partner and Merchant may disclose Personal Data with PayPal (including your email, card data, phone number, etc.) that we will use in accordance with this Privacy Statement and the relevant PayPal user agreement.

We collect the following categories of information about you to provide our Services, continually improve your user experience, manage and improve our business. The types of Personal Data we collect about you are described below.

Categories of Personal Data collected from or about you with your consent at the time of account creation, including from your interactions with us and use of the Services.

Registration and Contact Information: Depending on the Services you choose, we will collect your name, mailing address, email, telephone number, tax ID, Payment Information, profession, employment or business information, information necessary to create an account and use our Services.

Identification and Signature Information: Depending on the Services you choose, we will collect information to verify your name, address, email, phone number, government- issued identification and age as well as to create and issue your electronic signature.

Payment Information. Information such as amount you send or request, your payment instrument, card, or financial or funding account used in connection with the Services, including issuer name, card type, country code, payment account number, CVV, username, and IBAN information.

Information about your imported contacts. If you choose to import your contact lists, we will collect Information you enter or import about your contacts, such as name, address, phone number, images, email address or usernames associated with the contacts you import or enter manually.

Information in your Account Profile. Information you choose to enter such as your username, email, mobile number, profile picture, preferred language, or personal description. You can set your profile to “Private” at any time.

Information you provide when you contact us. Information you disclose when you respond to surveys, or contact our customer support teams, such as Services you have used, recorded conversations, chat conversations with us, email correspondence with us, account status, repayment history. This may include information about others if you choose to share it with us.

Device Information. Information that can be automatically collected from any device used to access the Site or Services. Such information may include, but is not limited to, your device type; your device’s network connections; your device’s name; your device IP address; information about your device’s web browser and internet connection you use to access the Site or Services; Geolocation Information; information about apps downloaded to your device.

Inferred data. We may derive inferences from your transactions and personal data when you use the Services. We do this, for example, to help keep your account secure and protect your use of the Services from fraud. We may draw inferences that reflect your behavior patterns and personal preferences, browsing and purchasing habits, and creditworthiness.

Information related to legal requirements. Consistent with applicable law, this may include information from external sanction lists such as name, date of birth, place of birth, occupation, and the reason why the person is on the list in question.

Third party sites and applications. Information from others from your use of third-party sites and applications, such as the Apple App Store or Google Play Store, social networking sites, Merchant sites and/or platforms such as name, your social network ID, Location Information, email, device ID, browser ID, and profile picture. Your use of third-party applications is subject to the privacy notice and terms of service for such applications.

Categories of patrimonial or financial information collected from or about you with your consent at the time of account and/or profile creation, including from your interactions with us and use of the Services:

Payment Information. Information such as amount you send or request, your payment instrument, card, or financial or funding account used in connection with the Services, including issuer name, card type, card number, date of issuance, expiration date, country code, payment account number, CVV, username, and IBAN information.

Information from Credit Reporting Agencies. Where permitted by law, we collect credit-related information such as outstanding and historical debt, repayment history, previous credit approvals, current employment relationship, and relationship with other financial institutions within the framework of your use of our Services.

Information from your connected third party accounts. If you choose to connect non-financial or financial account such as your personal email, social media, or bank or credit accounts, we will collect information consistent with the disclosed purpose for which it was linked. For example, if you choose to participate in Open Banking, we will collect account credentials, account balances, account transactions, and information about your financial standing from your linked accounts. You may change your mind about use of this feature and unlink your connected accounts at any time.

Transaction Information. Information about your order details and purchases, such as item description, quantity, price, currency, shipping address, online shopping cart information, seller and buyer information, and Payment Information. This includes information from your transactions where you use our Services without a PayPal account (e.g. Guest checkout).

If you don’t consent the processing of your patrimonial and financial information, we won’t be able to provide you with our Services and you shall refrain from using said Services.

Information in your Account Profile. Information you choose to enter such as your username, email, mobile number, profile picture, preferred language, or personal description. You can set your profile to “Private” at any time.

Categories of Personal Data automatically collected about you, including through your access to our website or mobile app, from cookies and similar tracking technologies, and your devices:

Technical Usage Data. Information about response time for web pages, download errors and date and time when you used the service, such as your IP address, statistics regarding how pages are loaded or viewed, the websites you visited before coming to the Sites and other usage and browsing information collected through Cookies (“Technical Usage Data”).

Information from your device. Information about your language settings, IP address, browser ID, device ID, cookie preferences, time zone, operating system, platform, screen resolution and similar information about your device settings, and data collected from cookies or other tracking technologies.

Location Information. Information from IP-based geolocation such as latitude and longitude data, and Global Positioning System (GPS) information when you give us permission through your device settings.

Inferred data. Inferences drawn to create a profile about you that may reflect behavior patterns and personal preferences, such as gender, income, browsing and purchasing habits, and creditworthiness.

We process your Personal Data based on one or more of the following legal grounds, as permitted by applicable data protection laws: (i) your explicit consent; (ii) the necessity of processing for the performance of a contract to which you are a party; (iii) compliance with legal obligations to which PayPal is subject; (iv) our legitimate interests or those of a third party, provided that such interests do not override your fundamental rights; and (v) any other legal basis as provided by applicable law.

Primary Purpose

This section describes the personal data we will process to fulfil the primary purposes indicated below.

• To provide our Services, to fulfil relevant agreements with you and to otherwise administer our business relationship with you.
• If you are using Fastlane, we will also use your Personal Data and payment method details to determine whether the payment you are making with a participating Partner or Merchant is authorized by you and likely to be successfully authorized by the payment method you choose to use when you make a purchase using details from your Fastlane profile.
• To administer your payment for products and the customer relationship.
• To assess your creditworthiness in connection with your application, confirm your identity and your contact information, and protect you and others from fraud.
• to confirm your identity, also through the use of electronic signature, and verify your personal and contact details.
• To prove that transactions have been executed.
• To establish, exercise or defend a legal claim or collection procedures.
• To comply with internal procedures.
• To assess which payment options and services to offer you, for example by carrying out internal and external credit assessments.
• For customer analysis, to administer our Services, and for internal operations, for example troubleshooting, data analysis, testing, research and statistical purposes.
• To communicate with you in relation to our Services.
• To ensure that content is presented in the most effective way for you and your device.
• To determine your eligibility for and to communicate with you about Services for which you may qualify or that may be of interest to you.
• To carry out risk analysis, fraud prevention and risk management.
• To improve our Services and for general business development purposes, for example improving risk models to minimize fraud, develop new products and features and explore new business opportunities.
• To keep your Account and financial information up to date.
• For marketing, product and customer analysis, including testing, for example to improve our product range and optimize our customer offerings.
• To comply with applicable laws, bookkeeping laws, regulatory capital adequacy requirements, and rules issued by our designated banks and relevant card networks. For example, when we process Personal Data for know-your-customer (“KYC”) requirements, to prevent, detect and investigate money laundering, terrorist financing and fraud. We also carry out sanction screening, report to tax authorities, police enforcement authorities, enforcement authorities, supervisory authorities.
• To facilitate your participation in competitions, offerings, and events.
• To conduct financial risk management obligations such as credit performance and quality, insurance risks and compliance with capital adequacy requirements under applicable law.
• To process information about your contacts to make it easy for you to find and connect them and improve payment accuracy. By providing us with information about your contacts you certify that you have permission to provide that information to PayPal for the purposes described in this Privacy Statement.
• To provide you with information, news, and marketing about our Services, including where we partner with others to offer similar services.
• To associate information about you to identify your use of Services without a PayPal account (e.g. Pay without a PayPal account) or Unbranded Payment Services and to associate such transactions with your account, if you have one or later establish an account.
• To remember your preferences for the next time you use the Services, such as which of your payment methods you prefer or whether you choose to receive digital receipts via email or text when you checkout.
• To certify your identity, also for signature purposes, and verify your personal and contact details.
• To prevent misuse of our Services as part of our efforts to keep our platform safe and secure.

Secondary purposes

We will share your Personal Data with third parties with your consent at the time of account creation.

This includes:

• With other PayPal Companies, in order to provide you with the Services and for our own legitimate interests in conducting our business. These interests are described further in Section 5 (What Personal Data is used and for which Purpose?).
• With authorities, to the extent we are under a legal obligation to do so, or we consider that it is advisable to make the disclosure. Such authorities include tax authorities, police authorities, enforcement authorities and supervisory authorities in relevant countries. We may also be required to provide competent authorities information about your use of our Services, for example revenue or tax authorities, which may include your name, address and information regarding card transactions processed by us on your behalf through our Services.
• With other financial institutions and card networks, for example to facilitate payment processing, to jointly offer a product or to add cards to your electronic wallet. For payment transactions with Fastlane, your Personal Data will be shared with the provider of the payment services for the participating Partner and Merchant to enable the processing of the payment transaction. The payment provider for the Partner and Merchant may be PayPal or a third-party payment provider. The legal basis for our disclosure is performance of our contract with you. These parties may also access your Personal Data for other legitimate purposes such as identification verification, fraud prevention and risk management. The legal basis for this processing is the provision of our services, and to protect the users from fraudulent and illegal conduct.
• With fraud prevention and identity verification agencies, for example to assist us in detecting activities suggestive of fraud. The legal basis for this processing is the provision of our Services, and to protect the users from fraudulent and illegal conduct.
• With debt collection agencies, for example to collect unpaid overdue debts through a third party such as a debt collection agency. We do this on the basis of our legitimate interest to conduct business and recover debts. Please be aware that these parties’ privacy notice applies to the processing of Personal Data that you share directly with them, and they may report your unpaid debts to credit reporting agencies which may affect your creditworthiness or ability to secure future credit.
• With other Users in accordance with your Account Settings. You may display or make certain information available to other Users, such as your profile photo, first and last name, username, or city in accordance with your Account Settings. The legal basis for this processing is your consent. Please note that you can change your profile settings at any time and at no cost to you.
• With financial institutions in connection with your participation in Open Banking, for example when you initiate an Account connection with another bank, card account, or aggregator. We do this to check if you have sufficient funds or confirm your ownership of the account. When you choose to link your Account the legal basis for accessing your account data is performance of our contractual obligations to you.
• With partners and merchants, their service providers and others involved in a transaction, for example when you use the Services to initiate online purchases, save your payment information with Fastlane, pay other Users, or return goods we may share information about you and your account or Fastlane profile with the other parties (or their service providers) involved in processing your transactions. The legal basis for this processing is the performance of our contractual obligations to you and for our legitimate interests. We may also disclose Personal Data to Partners and Merchants to enable their use of our Services to facilitate your transactions. For example, when you visit a participating Merchant site or app, the Merchant can check whether you are a user of PayPal services and present a recommended payment method to you to simplify your checkout process. Please note that Personal Data shared with partners and merchants (or their service providers) involved in a transaction is subject to the partners and merchants’ own privacy policy and procedures. We are not responsible for the actions, incidents activities, privacy and/or security practices of Partners and Merchants. If you choose to interact with participating Partners and Merchants through Fastlane, we will disclose your Fastlane profile information with the participating Partners and Merchants and their services providers, and facilitate your transaction, shopping experience or other interaction on participating Partners and Merchants sites.
• With third parties that are independent data controllers, for example when we share Personal Data to credit reference agencies, acquirers and other financial institutions, or security products to prevent bots from accessing our Services. Please be aware that these parties’ privacy notice applies to the processing of Personal Data that you share directly with them. For example, we use Google’s reCAPTCHA to prevent misuse of our Services, when you access our mobile application. Google’s Privacy Policy and Terms of Use apply to the processing of Personal Data you share with them.
• With buyers or in connection with business transfer, for example if we sell business or assets, we may share your Personal Data to a buyer of those business or assets. If PayPal or a significant portion of PayPal’s assets are acquired by a third party, Personal Data may also be shared.

We are not responsible for the actions, incidents activities, privacy and/or security practices of Partners and Merchants PayPal has a legitimate interest in being able to carry out these transactions.

In certain cases, your Personal Data may be transferred to, stored, and processed in countries outside of Mexico. When we transfer your Personal Data internationally, we implement appropriate safeguards to ensure an adequate level of protection in accordance with the requirements of the Mexican data privacy law and its regulations. These safeguards may include the use of standard contractual clauses, binding corporate rules, or other lawful mechanisms for data transfer. You may contact us for more information about the safeguards we apply to international data transfers.

We retain Personal Data for as long as needed or permitted in context of the purpose for which it was collected and consistent with applicable law.

The criteria used to determine our retention period is as follows:

• Personal Data used for the ongoing relationship between you and PayPal is stored for the duration of the relationship plus a period consistent with the applicable law.
• Personal Data in relation to a legal obligation to which we are subject is retained consistent with the applicable law, such as under applicable bankruptcy laws and AML obligations.
• We retain Personal Data for the least amount of time necessary where retention is advisable in light of litigation, investigations, audit and compliance practices, or to protect against legal claims.

When you interact with our Services, open email we send you, or visit a third-party website for which we provide Services, we and our partners use cookies and other tracking technologies such as pixel tags, web beacons, and widgets (collectively, “Cookies”) to recognise you as a User, customise your online experiences and online content, including to serve you interest-based advertising, perform analytics; mitigate risk and prevent potential fraud, and promote trust and safety across our Sites and Services. Certain aspects and features of our Services and Sites are only available through the use of Cookies, so if you decline certain Cookies, your use of the Sites and Services may be limited or not possible.

We use Cookies to collect your device information, internet activity information, and inferences as described above.

Cookies help us to do the following:

• Remember your information so you do not have to re-enter it.
• Track and understand how you use and interact with our online services and emails.
• Tailor our online services to your preferences.
• Measure how useful and effective our services and communications are to you. Otherwise manage and enhance our products and services.

Do Not Track (DNT) is an optional browser setting that allows you to express your preferences regarding tracking by advertisers and other third parties. At this time our Sites are not designed to respond to DNT signals or similar mechanisms from browsers.

Please review our Statement on Cookies and Tracking Technologies to learn more about our use of Cookies.

Under applicable data protection law, you have certain rights to control our collection and use of your Personal Data. Your rights include:

Access, rectification, deletion, objection, portability, and restriction of your information

• We recognize the importance of your ability to control use of your Personal Data and provide several ways for you to exercise your rights to access (right to know), rectification (correction or update), deletion (cancellation and erasure), objection (opposition), portability (transferring), and to restrict process in whole or in part (collectively your ARCO Rights).
• If you have an Account you can exercise your ARCO Rights by accessing “Data and Privacy” from Account Settings in the PayPal Website or mobile app, or you can file your request by calling our Customer Services line. We will verify your identity by (i) a security code via text message; (ii) a phone call to the phone number registered in the platform; or (iii) by requesting you to access to your Account.
• If you do not you have an Account (for example, where you use Payment without a PayPal account), you can exercise your ARCO rights for your Payment transactions through calling PayPal customer services line.
• Your duly authorized agent can submit a request on your behalf by contacting our Customer Services line. Please note that we may require additional information for verification.
• We will respond to your request within a term of twenty (20) business days of your last contact. The exercise of any one ARCO rights does not prevent you from exercising your other ARCO rights.

If you want to exercise any of your rights relating to your Personal Data in your Fastlane profile, contact us at the number provided in the Our Contact Information section or submit your request from your Fastlane profile management portal. In the event that you need to modify your personal data—such as your email address or phone number—you may do so by exercising your ARCO rights (Access, Rectification, Cancellation, and Opposition). However, due to operational or technical constraints inherent to certain services, it may be necessary to create a new account or user profile in order to implement such changes. In such cases, you will be duly informed, and any newly created account will remain subject to this privacy statement.

Your right to object to the Automated Decisions and profiling

If you are not approved under the Automated Decisions described below, you will not have access to our services, such as our payment methods. PayPal has several safety mechanisms to ensure the decisions are appropriate. These mechanisms include ongoing overviews of our decision models and random sampling in individual cases. If you have any concern about the outcome, you can contact us, and we will determine whether the procedure was performed appropriately.

You have the right to object to an Automated Decision with legal consequences or decisions which can otherwise significantly affect you (together with the relevant profiling) by contacting us. We will then review the decision, taking into account relevant additional circumstances.

Consent

• Generally, if we use your Personal Data with your consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Data conducted in reliance on a lawful processing ground other than consent.

How do you exercise your rights and how can you contact us or the data protection authority?

You may contact us if you have general questions about our Privacy Statement and practices or questions about your Account information or Personal Data.

We want to make sure your questions go to the right place:

• Click here to contact us about your PayPal account or transaction, or a card payment made to a merchant.

“Automated-decision making” is the process of making a decision by fully automated means without human involvement. In some cases these decisions could have a legal or similarly significant effect on you as an individual.

“Profiling” means analysis of an individual's personality, behaviour, interest and habits to make predictions or decisions about them.

Please contact us if you believe that we have mistakenly or unintentionally collected information from someone not allowed to use our Services.

We revise this Privacy Statement from time to time to reflect changes to our business, Services, or applicable laws. If the revised version requires notice in accordance with applicable law, we will provide you with 30 days prior notice by posting notice of the change on the "Policy Updates" or "Privacy Statement" page of our website, otherwise the revised Privacy Statement will be effective as of the published effective date.

• Account means a PayPal member account.
• Device Information means data that can be automatically collected from any device used to access the Site or Services. Such information may include, but is not limited to, your device type; your device’s network connections; your device’s name; your device IP address; information about your device’s web browser and internet connection you use to access the Site or Services; Geolocation Information; information about apps downloaded to your device.
• DSR Platform means the “Data Subject Rights Platform”, through which PayPal will receive and attend requests regarding Personal Data.
• Geolocation Information means information that identifies, with precise specificity, your location by using, for instance, longitude and latitude coordinates obtained through your GPS, or your device settings.
• Location Information means information that identifies, with reasonable specificity, your approximate location by using, for instance, longitude and latitude coordinates obtained through GPS or Wi-Fi or cell site triangulation.
• Partner means the merchant or business that our Users transact with for the purpose of obtaining goods or services.
• Pay without a PayPal account means guest checkout.
• PayPal Companies means companies that are owned and operated by PayPal, and process Personal Data in accordance with their terms of service and privacy policies.
• Personal Data means information that can be associated with an identified or directly or indirectly identifiable natural person.
• Processing means any method or way that we handle Personal Data or sets of Personal Data, whether by automated means, such as by collection, recording, categorization, structuring, storage, adaptation or alteration, retrieval, and consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of Personal Data.
• Services means any PayPal branded or Unbranded Payment Services, Pay without a PayPal account, credit products and services, content, features, technologies, or functions, and all related websites, applications and services offered to you by PayPal. Your use of the Services includes use of our Sites.
• Sites means the websites, mobile apps, official social media platforms, or other online properties through which PayPal offers the Services and which has posted or linked to this Privacy Statement.
• Unbranded Payment Services means you are interacting with and making payments to merchants using our card payment services that do not carry the PayPal brand.
• User is any person who uses the Services as a consumer for personal or household use. For the purposes of this Notice, “User” includes “you” and “your”.

You may contact us if you have general questions about our Privacy Statement and practices or questions about your Account information or Personal Data.

We want to make sure your questions go to the right place:

• Click here to contact us if you have additional questions about your personal data and to make reach out to our Data Protection Officer (DPO) Online.
• To contact us about your Fastlane profile: visit your Fastlane profile management portal.

You have provided your express consent at account creation for this Privacy Statement.