Legal

Privacy Notice

Last updated: July 20, 2026

1. Identity and address of the data controller

Pokit (“Pokit”, “we” or the “Controller”), with its address for the purposes of this notice in Mexico City, Mexico, and contact email hola@pokit.mx, is responsible for processing your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, the “LFPDPPP”), its Regulations and the Privacy Notice Guidelines.

This notice applies to the Pokit website, the admin dashboard, the application programming interface (API) and the digital passes generated through the platform (together, the “Service”).

2. Personal data we collect

We collect the following categories of personal data:

a) From account holders (businesses and their users)

• Identification and contact data: name, email address and password (stored in encrypted, irreversible form).
• Business data: trade name, line of business, locations (address and geographic coordinates) and logo.
• Usage and security data: IP address, session identifiers, audit records (a log of actions taken in the dashboard) and two-factor authentication settings.
• Billing data, when you subscribe to a paid plan: legal name, tax ID (RFC) and tax address.

b) From the businesses' end customers

• The name or alias provided when requesting a loyalty card.
• Pass serial number, points or stamps balance, history of earnings and redemptions, and sign-up date.
• Technical identifiers needed to deliver updates and push notifications to Apple Wallet and Google Wallet.

Pokit does not collect sensitive personal data (ethnic origin, health status, religious beliefs, sexual preferences, among others) and asks businesses not to enter such data in the platform's free-text fields.

3. Purposes of processing

Primary purposes (necessary for the Service)

• Creating and managing your account and verifying your identity, including two-factor authentication.
• Issuing, updating and revoking digital passes in Apple Wallet and Google Wallet.
• Recording points or stamps earned and redeemed, and sending the related push notifications.
• Showing messages based on geographic proximity (geofencing) when the business sets it up; location is processed locally on the end customer's device by its operating system, and Pokit neither receives nor stores end customers' real-time location.
• Operating the public API, including issuing and validating access keys.
• Keeping audit and security records, and preventing fraud and unauthorized use.
• Billing and collection for paid plans.
• Handling support requests and the exercise of ARCO rights.

Secondary purposes

• Sending account holders communications about product news.
• Preparing aggregated, anonymized statistics on platform usage.

You may refuse processing for secondary purposes at any time by writing to hola@pokit.mx, without this affecting the provision of the Service.

4. Data of the businesses' end customers

With respect to the personal data of end customers that each business collects through its loyalty cards, the business acts as the data controller and Pokit acts as the data processor, processing that data solely on behalf of and under the instructions of the business, in terms of article 3, section IX of the LFPDPPP and the applicable provisions of its Regulations.

• Pokit processes end customers' data only to operate the loyalty program of the corresponding business.
• Pokit does not sell, rent or use end customers' data for its own or third-party advertising.
• Each business is responsible for making its own privacy notice available to its end customers.
• End customers may request deletion of their card directly from the business or by writing to hola@pokit.mx; in the latter case, we will forward the request to the business responsible and help resolve it.

5. ARCO rights and how to exercise them

You have the right to Access your personal data, to Rectify it when it is inaccurate or incomplete, to Cancel it when you consider it is not required for any of the purposes stated, and to Object to its processing for specific purposes (“ARCO” rights), as well as to revoke the consent you have given and to limit the use or disclosure of your data.

To exercise these rights, send a request to hola@pokit.mx containing: (i) your full name and a means of sending you the response; (ii) documents proving your identity or legal representation; (iii) a clear and precise description of the data in respect of which you seek to exercise any of these rights; and (iv) anything else that helps locate the data.

We will respond within a maximum of 20 business days from receipt of the complete request and, if the request is granted, we will carry it out within the 15 business days following our response, in accordance with article 32 of the LFPDPPP.

If you believe your right to data protection has been violated, you may turn to the competent personal data protection authority in Mexico.

6. Data transfers

Pokit does not sell or assign your personal data. We only make the transfers and disclosures to processors that are strictly necessary to operate the Service:

• Apple Inc. and Google LLC: disclosure of the minimum technical data required to issue and update passes in Apple Wallet and Google Wallet and to deliver push notifications.
• Cloud infrastructure providers: encrypted hosting of the database and the Service, under contracts that impose confidentiality and security obligations.
• Competent authorities: when required by a duly grounded and reasoned order, in accordance with applicable law.

These transfers do not require your consent under article 37 of the LFPDPPP because they are necessary to fulfill the legal relationship between you and the Controller. Any other transfer will be made only with your prior consent.

7. Retention periods

• Account data: for as long as the account remains active and up to 12 months after it is canceled, unless a longer retention period is required by law (for example, for tax purposes).
• End customer data: for as long as the pass remains active; when the card is deleted or the business's account is canceled, it is erased or anonymized within a maximum of 90 days.
• Audit and security records: up to 24 months, for security and incident response purposes.

Once these periods have ended, the data will be blocked and then securely erased or anonymized.

8. Security measures

We implement administrative, technical and physical measures to protect your data, including: encryption of information in transit (TLS) and at rest, passwords stored with strong hashing algorithms, two-factor authentication, API keys with limited permissions, audit records and role-based access controls.

9. Changes to the privacy notice

We may amend this notice to reflect changes in the law or in the Service. Any amendment will be published on this same page, stating the date of the last update. Substantial changes will also be notified to account holders by email.

10. Contact

For any questions about this notice or the processing of your personal data: hola@pokit.mx.