Privacy notice



I. Identity and Address of the Controller


In compliance with the provisions of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (the “LFPDPPP”), its Regulations, and other applicable provisions, and with the aim of guaranteeing the privacy and the right to informational self-determination of the personal data subjects (the “Data Subject”), Banco Plata, S.A., Institución de Banca Múltiple, with an address for purposes of this Privacy Notice at Mariano Escobedo 476, Piso 1, Colonia Anzures, Alcaldía Miguel Hidalgo, Ciudad de México, Postal Code 11590, states that it is the Controller responsible for the processing of the personal data it collects, at all times observing the principles of lawfulness, consent, information, data quality, purpose limitation, loyalty, proportionality, and accountability established in the LFPDPPP, and adopting the security measures necessary for their adequate protection.


When the Controller engages with legal entities, this Privacy Notice shall apply solely with respect to the personal data of the individuals linked to such legal entity (for example: legal representatives, attorneys-in-fact, shareholders, controlling beneficiaries, authorized users, signatories, employees, and/or contacts).


Under this Privacy Notice, the Data Subject may verify, add to, or supplement the personal data collected directly from the Data Subject, as well as any personal data of third parties provided by the Data Subject, such as beneficiaries or Cardholders, legal representatives, or beneficial owners, as applicable depending on the service or product requested or contracted by the Data Subject, as well as persons referred to the Bank as potential customers.


It shall be the Data Subject's responsibility to inform and obtain the consent of the persons referred to above regarding the information the Data Subject will provide to the Bank about them and the purposes of such disclosure. Such disclosure presupposes that the Data Subject holds sufficient legal authority or authorization to provide such data, as well as to accept the terms and conditions of this Privacy Notice on behalf of those persons; accordingly, the Bank shall bear no liability toward such third parties in the event the Data Subject has provided their personal data without their consent. Notwithstanding the foregoing, the Bank will make this Privacy Notice available to such persons upon its first contact with them, and they will at all times have the rights described in the Bank's Privacy Notice.


In the event that the Data Subject has not obtained the third parties' express consent to provide their personal data to the Bank, or has not informed them of the purposes of the processing, the Data Subject shall become directly liable and undertakes to hold the Bank harmless from and against any claim and/or legal complaint brought by such third-party data subjects.



II. Purposes of the Processing of Personal Data


The Personal Data collected by the Controller will be processed in accordance with the following purposes:


Primary Purposes: These are purposes that give rise to, and are necessary for, the existence, maintenance, and performance of the legal relationship between the Data Subject and the Controller. They include, without limitation, the following:


  1. Identity verification: Corroborating the Data Subject's identity and the accuracy of the information and documentation provided, as well as that of related third parties (beneficiaries, guarantors, or joint obligors, as applicable);

  2. Credit analysis and evaluation: Conducting analyses to determine payment capacity and viability, transactional profile, risk level, or any other relevant factor under applicable provisions;

  3. Provision of financial services: Granting, operating, and administering the financial products and services contracted with the Data Subject;

  4. Regulatory compliance: Complying with obligations arising from financial, tax, anti-money laundering, civil protection, health, and safety legislation, including the obligation to report information to competent authorities;

  5. Management of files and information: Compiling, maintaining, and updating files and databases of the Data Subject and related third parties, in order to comply with legal and regulatory provisions;

  6. Prevention of unlawful acts: Detecting acts or omissions that could favor or facilitate the commission of crimes, and cooperating with authorities in their prevention or investigation;

  7. Notifications and follow-up: Contacting the Data Subject to follow up on requests, address complaints or clarifications, and notify changes to products, services, or processes;

  8. Biometric processing: Verifying the Data Subject's biometric data, including fingerprints, face, and voice, as applicable, through technological mechanisms that support the contracting and use of financial products or services; and

  9. Internal analysis: Generating metrics, indicators, and statistics to improve service quality, design new products, and evaluate the performance of internal processes.


Secondary Purposes: These are not essential to the legal relationship between the Data Subject and the Controller, but allow the Controller to provide the Data Subject with better service and experience. They include:


  1. Marketing and advertising: Sending promotional information, news, surveys, and recommendations of products or services of the Controller or of third parties with whom it has a business relationship;

  2. Commercial prospecting: Preparing customer profiles, market segmentation, and analysis of consumption habits for the design or offering of personalized products;

  3. Invitations and events: Inviting the Data Subject to events, conferences, workshops, or other activities organized by the Controller or its strategic partners;

  4. Rewards and promotions: Managing the delivery of rewards, incentives, benefits, or prizes arising from campaigns, sweepstakes, or promotions offered by the Controller;

  5. Surveys and satisfaction studies: Obtaining feedback from the Data Subject regarding the products, services, and experiences provided by the Controller; and

  6. Unfinished processes: Contacting the Data Subject to resume or complete previously initiated contracting processes.


The Data Subject may object to the processing of their Personal Data for the secondary purposes, without this affecting access to the products or services requested or contracted. To do so, the Data Subject may request the exercise of their ARCO Rights in accordance with the procedure described in Section 6 of this Privacy Notice.



III. Personal Data Collected


The Controller collects and processes the Data Subject's Personal Data directly, except in the case of beneficiaries or Cardholders, legal representatives, or beneficial owners, whose Personal Data is provided by the Bank's customers through electronic, physical, telephone, or digital means, including mobile applications, or through third parties acting as agents, promoters, commission agents, or business partners. In all cases, this Privacy Notice is made available to the Data Subject prior to the processing of their data, or, failing that, upon the first contact with the Data Subject when their Personal Data is provided by the Bank's customers in the case of beneficiaries, Users or Cardholders, legal representatives, beneficial owners, or other third parties.


The Personal Data the Controller may collect, depending on the nature of the legal relationship and the purposes described in this Privacy Notice, are grouped into the following categories:


Personal Data:

  1. Identification Data: full name, nationality, country of birth, gender, place and date of birth, CURP (Unique Population Registry Code), RFC (Federal Taxpayer Registry number), tax identification number, voter ID card (INE), handwritten or electronic signature, among others;

  2. Contact Data: address, telephone number, email address, social media, personal references;

  3. Employment Data: occupation, profession, employer's name, length of employment, business activity or line of business; and

  4. Academic and Professional Data: education level, academic institutions, certificates, and degrees.


Sensitive Personal Data:

  1. Financial or Asset Data: income, proof of income, credit history, account number, CLABE (standardized bank account number), bank references, financial statements, card number, CVV, expiration dates, as well as tax data such as CIEC and e.firma (SAT electronic signature), among others;

  2. Geolocation Data: exact or approximate real-time geographic location of any electronic Device through which the Data Subject interacts with the products and services offered, including without limitation electronic banking services, obtained from the geographic latitude and longitude coordinates through the Global Positioning System (GPS), or based on pairing with the internet protocol (IP) address, subject to each Device's configuration;

  3. Immigration Data: immigration status, country of origin, immigration documents;

  4. Biometric Data: fingerprints, facial or hand geometry, images of the person, iris and retina patterns, or voice recognition, used to validate the Data Subject's identity and document their consent;

  5. Health Data: only in cases where the Data Subject requests financial or insurance products or services that require it; and

  6. Data on Vulnerable Status: data freely and voluntarily disclosed by the Data Subject regarding their belonging, by way of example and not limitation, to the group of older adults, persons with disabilities, or persons belonging to an ethnic group, indigenous people, or community.


The Controller will obtain the Data Subject's express, written consent — whether through a handwritten signature, electronic signature, or any other authentication method provided for under applicable regulations — for the processing of Financial, Asset-Related, and Special Category Personal Data.


Likewise, if the Data Subject provides the Controller with Personal Data of third parties (for example: authorized users, joint account holders, spouses, beneficiaries, references, guarantors, sureties, bondsmen, guardians, or others), the Data Subject declares, under penalty of perjury, that they have informed such persons of the existence of the processing of their data and the content of this Privacy Notice.


In the case of minors or persons under guardianship or with different abilities, consent must be given by whoever exercises parental authority, guardianship, or legal representation, upon accepting this Privacy Notice.



IV. Retention of Personal Data


The personal data provided by the Data Subject will be retained in databases under appropriate operational, technical, and physical security measures, for a period of up to 10 (ten) years, counted from the termination of the legal relationship with the Controller or from the last contact with the Data Subject, in accordance with the Ley de Instituciones de Crédito, the LFPDPPP, its Regulations, and other applicable provisions and regulations, depending on the type of information retained and the regulatory obligations regarding the prevention of transactions with illegally-sourced funds, and tax, accounting, and contractual matters. Once that period has elapsed, and provided there is no legal obligation or authority requirement justifying its retention, the data will be deleted or anonymized in accordance with the Controller's internal procedures.



V. Limits on the Use or Disclosure of Personal Data


The Data Subject may, at any time, limit the use or disclosure of their Personal Data for purposes other than those necessary for the legal relationship with the Controller, particularly regarding marketing, advertising, or commercial prospecting purposes, through the following mechanisms:


  1. Registration with the Public Users Registry: The Data Subject may register with the Public Users Registry established by the Comisión Nacional para la Protección y Defensa de los Usuarios de Servicios Financieros (CONDUSEF), in order to limit the use of their personal information for advertising purposes. Such registration can be completed on the official website: https://webapps.condusef.gob.mx/reus/app/registro.jsp;

  2. Configuring Communication Preferences in Electronic Banking: The Data Subject may express their decision to authorize or deny the processing of their Personal Data for marketing, advertising, or commercial prospecting purposes through the mechanisms enabled in the Controller's Electronic Banking services, including its mobile application; and

  3. Telephone Support: If assistance is needed to exercise these options, the Data Subject may call the Controller's customer service line at +52 55 9990 8880, available 24 hours a day, 365 days a year.


Additionally, the Data Subject is informed that certain pages of the Controller's website may use tracking technologies such as cookies and web beacons to improve the browsing experience. However, the information collected through such technologies is disassociated and does not allow direct identification of the Data Subject.


Finally, the Data Subject may at any time file a complaint or report with the Secretaría Anticorrupción y Buen Gobierno if they believe any of their personal data protection rights have been violated. For more information, visit: https://www.gob.mx/buengobierno



VI. Means to Exercise ARCO Rights


The Data Subject may, at any time, exercise their rights of Access, Rectification, Cancellation, and Objection (the “ARCO Rights”) with respect to the personal data held by the Controller, in accordance with the LFPDPPP and its Regulations.


  1. Access: To learn what personal data we process about the Data Subject, as well as the origin and purposes of the processing;

  2. Rectification: To request correction of their personal data when it is inaccurate, incomplete, or outdated;

  3. Cancellation: To request deletion of their personal data from our databases, following blocking, when they believe the data is not being processed in accordance with the applicable legal principles and duties; and

  4. Objection: To object to the processing of their data for specific purposes, except where otherwise provided by law.


Exercising any one of the ARCO Rights is not a prerequisite for, nor does it prevent, the exercise of another right:


  1. Format and submission: The Data Subject may request the exercise of ARCO Rights by email to [email protected].

  2. The request to exercise ARCO Rights must be submitted together with the following information and documentation, scanned in legible format where applicable:

    1. Full name of the Data Subject.

    2. Mobile phone number the Data Subject uses to access the Controller's Electronic Banking services.

    3. Document proving the Data Subject's identity:

      1. Valid official identification of the Data Subject (INE voter ID, passport, or professional license/ID card).

      2. In the case of legal representation: notarial power of attorney or a letter of authorization signed before two witnesses, together with official identification of the Data Subject and the legal representative.

      3. In the case of minors, persons under guardianship, incapacitated persons, or deceased persons: legal documentation proving the corresponding representation and legal relationship.

    4. A clear and precise description of the personal data for which the Data Subject seeks to exercise one of the ARCO Rights, except in the case of the right of access.

    5. A description of the ARCO Right the Data Subject intends to exercise, or of what the Data Subject is requesting.

    6. Any other element or document that helps locate the personal data (e.g., documentation supporting a request for rectification of personal data).

  3. Response times: The Controller will resolve the request within a maximum of 20 business days from its receipt, unless additional information is required, in which case the period will be suspended until the Data Subject responds. If the request is granted, the requested changes will take effect within the 15 business days following the date on which the Controller communicates its determination to the Data Subject. These periods may be extended once, for up to 10 additional business days, provided the circumstances justify it and the Data Subject is notified.


If the Controller issues a negative or insufficient response, the Data Subject may approach the Secretaría Anticorrupción y Buen Gobierno to request a review in accordance with the applicable legal procedure. The Controller will cooperate with such authority by providing any documentation required for that purpose.



VII. Transfer of Data


The Controller undertakes to ensure compliance with the personal data protection principles set forth in the LFPDPPP and its Regulations, and to adopt the measures necessary to ensure the confidentiality, integrity, and availability of such data. Likewise, it will require any third party to whom such data is transferred to fully comply with this Privacy Notice and applicable legal provisions.


The Data Subject accepts and authorizes the Controller to carry out domestic and international transfers of their personal data without requiring their consent in the following cases:


  1. Transfers to holding companies, subsidiaries, or affiliates of the Controller, or to companies within the same corporate group operating under the same internal processes and policies;

  2. Transfers necessary for the maintenance or performance of the legal relationship between the Controller and the Data Subject;

  3. Transfers required by a competent authority in the exercise of its legal functions, as well as those necessary for the administration of justice or the safeguarding of the public interest;

  4. Transfers to credit reporting agencies (credit bureaus), in accordance with applicable financial legislation; and

  5. Transfers necessary to comply with contractual or regulatory obligations applicable to financial-sector institutions.


Additionally, the Controller may transfer personal data to:


  1. Companies within the same financial group or business partners with whom it maintains contracts to offer financial products and services, promotions, loyalty programs, rewards, assistance services, or complementary benefits, for the Data Subject's benefit;

  2. Public or private entities, domestic or foreign, involved in payroll dispersion processes, courier/messaging services, identity validation (such as the National Electoral Institute or the National Population Registry), portfolio sales, or authentication of personal data;

  3. Notaries public (fedatarios públicos), for purposes of formalizing credit transactions or agreements entered into with the Data Subject;

  4. Domestic or foreign financial institutions for processes related to the portability or transfer of financial products and services; and

  5. Investors, whether individuals or legal entities, in the context of portfolio sales or assignment of rights.


For certain products or services, the Controller may require the Data Subject's express authorization to access information contained on their mobile device, such as:


  1. Geographic location, to comply with regulatory provisions; and

  2. Photos and videos, for identity validation or documentation related to contracted products.


Such permissions will be used solely in accordance with the purposes previously authorized by the Data Subject. In all cases, third-party recipients will be notified of the content of this Privacy Notice and will be required to respect its terms and limitations.


If the Data Subject wishes to object to any of the additional purposes set forth in this section, they may exercise their right in accordance with the procedure established in the corresponding section of this Privacy Notice.



VIII. Consent


By accepting this Privacy Notice through our application, website, telephone service centers, authorized promoters, or any other legitimate means, the Data Subject grants their express, free, informed, and unequivocal consent to the processing of their Personal Data in accordance with the purposes described in this document, including those necessary for the contracting, maintenance, and improvement of the financial products and services we offer, as well as for secondary marketing, advertising, and commercial prospecting purposes.


Based on the foregoing, the Data Subject authorizes the Controller to carry out, among others, the following actions:


  1. Validation and verification of personal data, including comparison against publicly available sources or records held by third parties with whom the Controller has entered into collaboration agreements;

  2. Documentary authentication, comparing the data and identifications provided by the Data Subject against the issuer's records to confirm their validity and currency;

  3. Recording the Data Subject's voice, image, or, as applicable, both, through the technological mechanisms used by the Controller to perform identity validation of its customers;

  4. Biometric verification, cross-checking the biometric data provided by the Data Subject against the records of the National Electoral Institute, the Ministry of Foreign Affairs, or other competent authorities, including fingerprints and facial images; and

  5. Creation and safeguarding of biometric databases, in accordance with applicable regulations and subject to obtaining the consents required by law.


The Personal Data may be collected directly from the Data Subject by the Bank through: (i) personal, telephone, or digital contact; (ii) electronic forms; (iii) mobile applications; or (iv) authorized third parties, provided the Data Subject has had prior access to this Privacy Notice.


A Data Subject who is a Bank customer may configure their mobile device's permissions to restrict the Controller's access to certain data. However, if access to information such as geolocation is restricted, essential functionalities may be limited for security and regulatory compliance reasons.


The Controller will require express consent for the processing of asset-related, financial, and special category data. If the Data Subject provides data of third parties (authorized users, beneficiaries, sureties, references, etc.), the Data Subject must inform them of this Privacy Notice and obtain their prior consent, where applicable.


In accordance with the LFPDPPP and its Regulations, the Controller may process the Data Subject's Personal Data without their consent in the following cases:


  1. When provided for by law;

  2. When the data comes from publicly available sources;

  3. When the data is subjected to disassociation/anonymization processes;

  4. When the processing is necessary to fulfill contractual obligations;

  5. In emergency situations that could potentially harm the Data Subject or third parties;

  6. When indispensable for medical or health care services, in accordance with the Ley General de Salud; and

  7. By order of a competent authority.




IX. Use of Cookies and Other Technologies


The Controller informs the Data Subject that, in order to provide a better browsing experience, improve security, personalize content, analyze usage patterns, and comply with applicable regulatory obligations, cookies, web beacons, and other tracking technologies are used both on its website and in its mobile application.


These technologies automatically collect information such as: browser type, operating system, IP address, access times, pages visited, most-viewed sections, and user behavior within the Controller's digital services. They may also be used to identify preferences, offer personalized content, and generate statistical, demographic, or segmentation data.


Cookies used:


  1. Cookies: Data files stored on the Data Subject's device that allow status information to be exchanged with the browser, and which may include session identifiers, authentication data, preferences, and other site-usage data;

  2. Web Beacons: Visible or hidden images embedded in web pages or emails that allow monitoring of the Data Subject's behavior, including IP address, browser, operating system, and access date/time;

  3. Necessary Cookies: Essential for the proper functioning of the site and application, including security, session management, and language settings;

  4. Analytics Cookies: Allow analysis of user behavior to improve the content and services offered;

  5. Marketing Cookies: Used to display personalized content and advertising based on the Data Subject's interests, avoiding unnecessary repetition and optimizing commercial communication; and

  6. Session and Persistent Cookies: Session cookies are deleted when the browser is closed; persistent cookies remain until they fulfill their purpose or are manually deleted.


The Data Subject may at any time disable or configure the use of cookies and other technologies through their browser or device settings, except for those strictly necessary for the operation of the website or application. Continued use of the Controller's digital services constitutes consent to the use of these technologies in accordance with this Privacy Notice.



X. Amendment of this Privacy Notice


This Privacy Notice may be amended, updated, or adjusted at any time, in compliance with new legal requirements, changes to the products or services we offer, the implementation of new privacy practices, adjustments to our business model, or any other cause applicable to financial institutions under current regulations. Any material amendment to the content of this Privacy Notice will be duly communicated to the Data Subject through the following means: (i) publication on our website www.bancoplata.mx, (ii) within our mobile application, or (iii) through any other communication method the Institution considers appropriate, including without limitation email or physical notice to the Data Subject's last address on record.


The Data Subject understands and agrees that, by not expressly objecting to amendments to this Privacy Notice within the legally established time periods, they will be deemed to tacitly consent to the processing of their personal data under the new terms. For any questions, clarifications, or inquiries regarding the procedure and means for exercising ARCO Rights, the Data Subject may contact our Personal Data Protection Unit by email at:

[email protected]


Date of Last Update: October 2026