PRIVACY POLICY FOR USERS AND CUSTOMERS

RECARGA DE PRODUCTOS Y SERVICIOS, S. DE R.L. DE C.V., as a company that is responsible for and respectful of Personal Data, makes this Privacy Policy available to you in order to guarantee data subjects' right to informational self-determination.

1. DEFINITIONS

Capitalized terms used in this Privacy Policy have the meanings set out below, whether used in the singular or the plural.

Privacy Policy: This document.

Personal Data: Information concerning the Data Subject or an identifiable individual.

ARCO Rights: The rights of Access, Rectification, Cancellation, and Opposition.

Processor: A person who processes Personal Data on behalf of the Data Controller.

Primary Purposes: Purposes strictly necessary for the relationship between axexo and the Data Subject.

Secondary Purposes: Additional purposes that are not essential to the relationship.

Law: Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares).

Guidelines: The Privacy Notice Guidelines issued by Mexico's Ministry of Economy (Secretaría de Economía).

Platform: The application and/or website operated by axexo.

Regulations: The Regulations of the Federal Law on the Protection of Personal Data Held by Private Parties.

Data Controller or axexo: RECARGA DE PRODUCTOS Y SERVICIOS, S. DE R.L. DE C.V.

Data Subject: The individual to whom the Personal Data belongs.

Transfer: Disclosure of Personal Data to third parties.

Processing: The collection, use, storage, or disposal of Personal Data.

2. DATA CONTROLLER: IDENTITY AND ADDRESS

The Data Controller is RECARGA DE PRODUCTOS Y SERVICIOS, S. DE R.L. DE C.V., with its address at Av. Ejército Nacional Mexicano 418, Polanco V Sección, Miguel Hidalgo, C.P. 11560, Mexico City, Mexico.

3. PERSONAL DATA PROCESSED

axexo will process the following User data:

• Identification data
• Contact data
• Financial and asset data
• Sensitive personal data: facial biometrics

The Data Subject gives express consent to the Processing of this data, including sensitive data.

4. PURPOSES OF PROCESSING

4.1 Primary Purposes

• Identify the Data Subject.
• Verify identity in accordance with applicable regulations.
• Provide access to axexo services.
• Confirm the accuracy of data for applicable agreements.
• Maintain necessary communication with the Data Subject.
• Process payments for products and services.
• Keep the Data Subject's information up to date.
• Provide notice of updates, reports, or changes to the Privacy Policy or Terms and Conditions.
• Identify suspicious or fraudulent transactions.
• Respond to ARCO Rights requests.
• Comply with applicable legal obligations.

4.2 Secondary Purposes

• Sending promotional or advertising information.
• Conducting surveys and compiling statistics.
• Tailoring services and features based on the Data Subject's behavior.

5. LOCATION DATA COLLECTION AND USAGE

axexo may access, collect, and process location information from your device, including approximate location and, where permitted, precise geographic location (GPS coordinates).

We use location information to:

• Identify nearby participating merchants, retail locations, and available services.
• Enable location-based features and improve the relevance of services displayed within the application.
• Facilitate transactions and services that depend on the user's geographic location.
• Support fraud prevention, security monitoring, and compliance with applicable laws and regulations.
• Improve application functionality and the overall user experience.

Location information is accessed only when necessary to provide applicable services and in accordance with device permissions and applicable law.

Users may manage or revoke location permissions at any time through their device settings. Disabling location access may limit certain location-dependent features but will not prevent access to unrelated application functionality.

We may share location information with authorized service providers and business partners where necessary to deliver location-based services, subject to applicable privacy and data protection requirements.

Location data is retained only for as long as reasonably necessary to fulfill the purposes described above or to comply with applicable legal obligations.

6. HOW TO OPT OUT OF PROCESSING FOR SECONDARY PURPOSES

The Data Subject may opt out by sending an email to help@axexo.com with the subject line "Opt-Out of Processing for Secondary Purposes" and including:

• The purposes for which they wish to opt out of processing
• Identification data

7. TRANSFERS OF PERSONAL DATA

axexo may make the following transfers:

8. EXERCISING ARCO RIGHTS

The Data Subject may exercise their rights by sending an email to help@axexo.com with the subject line "Exercise of ARCO Rights".

The request must include:

• Full name and address
• A description of the data involved
• The ARCO Right to be exercised
• For Rectification: the changes requested and supporting documentation

Additional documentation required:

• A copy of a valid government-issued ID
• Documents showing that the information is held by axexo
• A power of attorney letter, if acting through a representative

axexo will send an acknowledgment of receipt and respond within a maximum of 20 business days, and may request additional information within the first 5 business days.

If the request is approved, the changes or access will be provided within a maximum of 15 business days thereafter.

9. REVOKING CONSENT

The Data Subject may revoke their consent by sending an email to help@axexo.com with the subject line "Revocation of Consent", including:

• Full name
• The date on which the revocation should take effect
• A copy of their ID

axexo will respond within 20 business days, provided that sufficient information has been received.

10. CONTACT FOR REQUESTS

Responsible department: axexo Personal Data Protection Department

Email: ayuda@axexo.com

11. MEANS TO LIMIT USE OR DISCLOSURE

axexo implements technical, physical, and administrative measures to protect Personal Data.

Data Subjects in Mexico may register with the REPEP (Public Registry to Avoid Advertising) to stop receiving advertising.

12. RETENTION PERIOD

Personal Data will be retained only for as long as necessary to fulfill its purposes and will then be blocked and deleted.

13. CHANGES TO THIS PRIVACY POLICY

axexo may modify this Privacy Policy. Changes will be communicated by posting on the Platform or by email to the Data Subject.

14. LAST UPDATED

October 24, 2026.