Terms of Service

Makatea is collections software used in any country. The customer is the one collecting and follows the collection rules of its country. Prices are in US dollars, plus the taxes each country requires. The agreement is governed by Mexican law. The Spanish version prevails.

These Terms of Service (the "Terms") govern access to and use of the Makatea software platform (the "Service" or the "Platform"), provided by SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V., a Mexican company with tax ID (RFC) SOB240719U87 and registered address at Avenida del Valle 162, Colonia Ciudad del Valle, C.P. 63157, Tepic, Nayarit, Mexico.

1. Provider details

The Service is provided by:

• Legal name: SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V.
• Tax ID (RFC): SOB240719U87 (Mexican company, incorporated on July 19, 2024).
• Registered address: Avenida del Valle 162, Colonia Ciudad del Valle, C.P. 63157, Tepic, Nayarit, Mexico.
• Commercial and legal contact: rodrigo@makatea.ai
• Phone: +52 81 2007 2062
• Country of incorporation and sole establishment: Mexico
• Scope: Makatea provides the Service from Mexico to customers in any country.

In these Terms, "Makatea", "we" or the "Provider" means the entity above. "Customer", "you" or "User" means the individual or legal entity that subscribes to or uses the Service.

By creating an account, accepting these Terms during sign-up or using the Service, you confirm that you have read, understood and agree to be bound by these Terms. Acceptance is recorded with a timestamp at sign-up.

2. Purpose and nature of the Service

2.1. Description

Makatea is software for running collections and customer communication, offered as Software as a Service (SaaS) on a subscription basis to businesses (B2B) in any country. Among other functions, the Service lets the Customer:

• Import and manage its portfolio of customers or debtors ("Members" or "third parties").
• Record payment orders, credits with payment schedules and payments linked to its own portfolio.
• Schedule and send communications to its portfolio through the Service's operating channels, WhatsApp and email. SMS is not an available channel of the Service.
• Record and classify inbound and outbound interactions with its portfolio, including automated classification of the interaction type using machine learning (AI).
• Reconcile payments and produce operating reports and metrics, including AI-assisted reports on aggregated data.

Automated processing and profiling. The Service performs automated processing that includes machine-learning classification of interactions and the calculation of channel preference and response rate indicators for Members, which is a form of profiling. The general logic analyzes the interaction history to infer the preferred contact channel and time and to classify the outcome of each interaction. Its consequence is to guide the priority and channel of the Customer's collection communications. Data subjects have the right to object to this automated processing and, where applicable, to request human review of decisions based solely on it. This processing is described in the Privacy Policy.

2.2. What Makatea does not do (essential limits of the Service)

The Customer expressly acknowledges that Makatea is a software tool and that, by the nature of the Service:

• Makatea does not hold, receive, retain or transfer funds of the Customer or its portfolio. Payment amounts are recorded as information provided by the Customer or by payment processors engaged by the Customer.
• Makatea does not grant credit and does not act as a financial entity, lender or credit intermediary.
• Makatea does not originate, determine or set interest rates, fees or amounts owed. The parameters (principal, periods, total, currencies, due dates, interest and fees) are the Customer's data, entered, imported or defined by the Customer. The Platform can generate payment schedules from those parameters and store the resulting total (principal plus interest or fees according to the Customer's parameters). Makatea does not originate or validate the accuracy or lawfulness of those parameters. The Customer is solely responsible for the accuracy and lawfulness of the data entered and for compliance with the credit, interest and usury rules that apply to it.
• Makatea is not the Customer's legal, tax, financial or compliance advisor.

2.3. Payment processing

When the Customer enables collection from its portfolio through the payment processors supported by the Service, processing takes place directly between the Customer, its end customer and the relevant payment processor, under the Customer's own accounts and credentials. Makatea does not process or store card data. Payment is hosted on the processor's infrastructure. Makatea only records transaction metadata for reconciliation.

3. Account and credentials

3.1. Sign-up

To use the Service, the Customer creates an account by providing, among other data, full name, email, phone, organization name and a password. The password is stored hashed and never in plain text.

3.2. Organizations and roles

The Service organizes access by "Organization". Each user has a role within its Organization that sets its permissions. Data isolation between Organizations is enforced at the database level.

3.3. Responsibility for credentials

The Customer is responsible for:

• Keeping its credentials confidential.
• All activity carried out under its account.
• Notifying Makatea immediately of any unauthorized use.

The Customer is responsible for the users it adds to its Organization and the roles it assigns to them.

4. Acceptable use and Customer obligations

4.1. Lawful basis to contact the portfolio (essential obligation)

The Customer represents, warrants and undertakes to have a valid and current lawful basis to process the personal data of its portfolio and to contact it through the enabled channels (WhatsApp, email or others). Depending on each applicable jurisdiction, this includes consent, contractual relationship, legal obligation, legitimate interest or another lawful basis that covers:

• Collecting and importing its portfolio data into the Platform.
• Sending collection, reminder or management communications to those people.
• Processing sensitive data, financial data or identity documents that the Customer decides to upload.

Express consent for sensitive and financial data. When the Customer uploads sensitive or financial data of its portfolio (for example, CURP, RFC, official ID, CLABE or other KYC and financial data), it must have obtained and must keep the data subject's express consent for that processing, as required by articles 7 and 8 of Mexico's LFPDPPP and by the explicit authorization required for sensitive data in Colombia (Law 1581 art. 9 and Decree 1377), Brazil, Ecuador and Peru, and other applicable laws. It must also inform the data subject that granting authorization for sensitive data is optional. The Customer undertakes to document that consent and to make it available to Makatea or the authority on request.

Proof of authorization. The Customer undertakes to keep and be able to prove the authorization or consent given by the data subjects of its portfolio and by the users it adds to its Organization (Law 1581 art. 9 and Decree 1377 of Colombia, and equivalents in other jurisdictions). Makatea records the timestamp of acceptance of these Terms by account users. This does not replace the Customer's obligation to obtain and keep proof of authorization for processing personal data.

For portfolio data, the Customer acts as Controller and Makatea acts as Processor, under the Data Processing Agreement (DPA) referred to in Section 6.

The Customer is solely responsible for:

• Handling the rights requests (access, rectification, erasure, objection, portability, withdrawal of consent and others) that its portfolio sends to it as data controller.
• Honoring contact opt-outs. The Customer acknowledges that the Platform records when a person in its portfolio asks not to be contacted (opt-out interaction classification and excluded channels in the Member's preferences) and undertakes to honor those opt-outs.

Collection rules in each country. The Customer is the one collecting and the one who decides when, how and whom to contact. The Customer therefore follows the collection rules of the country of each person it contacts. These include contact hours and frequency, identification of the creditor, respectful treatment and the ban on disclosing the debt to third parties. Makatea provides features to comply, such as a sending window per organization, the opt-out register, the creditor's name in every message and stopping reminders once a payment is recorded. The country guide is at https://makatea.ai/en/legal/collections. The guide is for information and does not replace reviewing the law that applies to each case.

4.2. Prohibited conduct

The full list of prohibited uses is published at https://makatea.ai/en/legal/prohibited-uses and forms part of these Terms. Among others, the Customer undertakes not to use the Service to:

• Send communications without a lawful basis, or that harass, defraud, mislead or breach applicable consumer protection, debt collection, telecommunications or data protection laws.
• Upload third-party data without a lawful basis.
• Breach the security of the Platform, reverse engineer it without authorization, access data of other Organizations or exceed the limits of its plan.
• Collect third-party debt portfolios, payday loans or peer-to-peer loans over WhatsApp. WhatsApp Business policies prohibit these businesses regardless of the Customer's licenses. The Customer can handle them by email.
• Any unlawful purpose or any purpose contrary to these Terms.

4.3. WhatsApp and Meta policies

Use of WhatsApp is subject to the WhatsApp Business Policies and other Meta policies, which the Customer undertakes to follow. In particular, the Customer:

• Messages on WhatsApp only people who gave it their number and agreed to receive messages from its business.
• Uses a WhatsApp number in its own name and is responsible for the content of each message.
• Does not use WhatsApp for the businesses Meta prohibits (Section 4.2).

Meta decides on its own whether to limit, suspend or block a number or an account. When that happens because of how the Customer used the channel, Makatea is not liable for the block or its effects, and the Customer holds Makatea harmless under Section 10.4. Makatea may pause a send that puts the line or the account at risk and informs the Customer.

4.4. Customer content

The Customer is solely responsible for the accuracy, lawfulness and content of the data and messages it uploads, defines or sends through the Platform, including amounts, payment schedules, templates and custom fields.

5. Plans, payment and trial

5.1. Plans and subscription

The Service is offered through subscription plans. The features, limits (for example, sending limits or number of Members) and prices of each plan are those in force at the time of purchase or renewal. The current plans are Essential (USD 119/month), Momentum (USD 219/month), Scale (USD 349/month) and Sovereign (custom). Billing can be monthly or annual (the annual option is about 10 months, with 2 months at no cost). The applicable plans, limits and prices are those published on makatea.ai at the time of purchase or renewal.

5.2. Trial period

The Service offers a free 14-day trial, with no card required. When the trial ends, continued access requires a paid plan. The current trial terms are those published on makatea.ai.

5.3. Billing, taxes and late payment

• Subscription payments are made in advance according to the plan's billing period, unless stated otherwise.
• Prices are in US dollars (USD) and exclude taxes. If the law of the Customer's country requires VAT, GST or another indirect tax, it is added to the charge. When the Customer is a business and the law of its country allows it, the Customer self-assesses the tax (reverse charge). The Customer provides its tax ID for this purpose.
• The subscription renews automatically at the end of each period (monthly or annual) for an equal period, unless cancelled. Cancellation takes effect at the end of the current paid period, and access continues until then.
• Subscription payments are processed by a payment processor through a checkout hosted by that processor. Makatea does not store card data.
• Refunds and late payment. If payment is not made, the Service may be suspended after a reasonable grace period and prior notice. Unless mandatory law provides otherwise, fees for periods already started are not refundable. The current refund and late-payment terms are those published on makatea.ai.

5.4. Price changes

Makatea may change prices and plans with reasonable notice. Changes apply from the next renewal period. Price changes are notified by email to the Customer or by notice in the Platform at least 30 days before they take effect. A Customer that does not accept the new price can cancel before renewal.

6. Personal data and privacy

6.1. Applicable documents

Personal data processing is governed by:

• Makatea's Privacy Policy, which forms part of these Terms and is published on the Makatea site.
• The Data Processing Agreement (DPA), available at https://makatea.ai/en/legal/dpa, which applies to the portfolio data the Customer uploads to the Platform and sets out Makatea's role as Processor. The DPA covers, at least, the Controller's instructions, authorized purposes, confidentiality, security measures, sub-processors, international transfer clauses, assistance with data subject rights, incident notification and return or deletion of data at the end. The DPA is accepted electronically when accepting these Terms of Service (click-wrap) and is incorporated by reference. It does not require a handwritten signature or a separate signing step. The Customer (Controller) accepts the DPA when signing up for or purchasing the Service.

Short notice at the point of collection. At the point of collection (for example, during sign-up) a short privacy notice is shown with a link to the full Privacy Policy, as required by article 16 of Mexico's LFPDPPP.

6.2. Roles

• Data of the Customer's account and its users (name, email, phone, organization, language, marketing consent, terms acceptance timestamp): Makatea acts as Controller.
• Data of the Customer's portfolio (Members, payment orders, credits, payments, documents, interactions and similar): Makatea acts as Processor and processes that data only on the Customer's instructions and under the DPA.

6.3. Categories of data processed

For information, the Service may process, among others, the following categories of the Customer's portfolio data: name, phone, email, national or tax identifiers (for example, CURP and RFC, when the Customer uploads them), address, balances and status, custom fields defined by the Customer, identity documents and proofs (KYC), payment references and bank reconciliation data (for example, source CLABE and payer aliases), and the full content of interactions (inbound and outbound messages and, where applicable, media files). Details are in the Privacy Policy.

6.4. Purposes of processing

Purposes are split between those necessary to provide the Service and those that require separate consent from the data subject.

Necessary purposes (data of the Customer's account and its users), for which Makatea is Controller:

• Providing, operating and maintaining the Service.
• Managing the account, authentication and access control by Organization and role.
• Billing and collecting the subscription.
• Customer service and support.
• Generating operating reports and metrics, including AI reports on aggregated data.
• Complying with legal obligations and authority requests.

Purposes that require consent (separable and opt-in):

• Sending marketing or promotional communications to the users of the Customer's account. Marketing consent is optional, separable and revocable (the Service records a marketing consent field per user), and refusing it does not affect the Service.

Purposes for portfolio data (Makatea as Processor): Makatea processes portfolio data only on the Customer's instructions and under the DPA, so that the Customer can run its own collections and communication. The lawful basis and purposes of that processing are the Customer's responsibility.

New purposes (art. 11 LFPDPPP). Any processing of the data for which Makatea is Controller (data of the Customer's account and its users) for a purpose other than those stated here and in the full privacy notice, for example product analytics or other new purposes, requires collecting the data subject's consent again under article 11 of Mexico's LFPDPPP and the equivalent rules of other jurisdictions. The purposes listed in this Section 6.4 match those of the full privacy notice.

6.5. Security measures

Makatea applies technical and administrative measures that include:

• Encryption in transit (HTTPS/TLS) for communications with the Platform.
• Encryption at rest at the cloud providers that host the data (AES-256) and at payment processors (PCI-DSS environments).
• Isolation by Organization at the database level. Each Organization accesses only its own data.
• Private storage of identity and KYC documents and media files, with access control by Organization.
• Restricted storage of integration credentials (for example, keys of payment processors or messaging), which are not accessible to users of the Organization.
• An audit log of relevant actions (create, update, delete, sign-in, import, send, payment) that captures, among others, user, IP address, user agent and timestamp, plus a payments ledger. The application only appends events to this log and offers no operations to edit or delete them. It is kept while the account is active plus 24 months and then deleted or anonymized (see Section 6.6).
• Staff confidentiality. Authorized Makatea staff are bound by confidentiality agreements and access data only as needed to operate and support the Service.

The main database is hosted in the United States.

6.6. Retention and deletion

Retention periods and criteria.

• User account data: while the account is active. After closure, records with tax or accounting effect are kept for at least 5 years (article 30 of Mexico's Federal Tax Code).
• Data processed on the basis of consent (marketing): until consent is withdrawn.
• Portfolio: during the relationship with the customer organization plus the applicable statute of limitations. Records with tax or accounting effect are kept for at least 5 years (article 30 of Mexico's Federal Tax Code).
• KYC (official ID, CURP, RFC, CLABE): 5 years after the relationship ends (anti-money-laundering obligations), unless the controller has a longer legal obligation.
• Audit log: while the account is active plus 24 months (compliance evidence), after which it is deleted or anonymized.
• Interactions and messages: while the account is active plus 12 months, or as configured by the organization.
• Payment metadata: 5 years (tax or accounting effect, article 30 of Mexico's Federal Tax Code).

When the account is cancelled, personal data is deleted or anonymized, except data that must be kept by a legal retention obligation for the periods above.

6.7. Access, portability, deletion and anonymization

At the request of the data subject or the Customer through the single privacy channel (Section 6.9), Makatea offers:

• Effective deletion or anonymization of personal data, except where there is a legal obligation to keep it. In that case the data is blocked and kept only for that purpose.
• Export of a data subject's data in a structured, commonly used and machine-readable format (access and portability), under the applicable laws.

These rights are handled by request through the single privacy channel.

6.8. Sub-processors and international transfers

To provide the Service, Makatea relies on providers that may act as sub-processors and that, in some cases, involve international data transfers:

Each of these providers processes data under its own terms and data processing agreements or standard contractual clauses, which apply when using its service and are incorporated by reference into these Terms and the DPA.

The list of sub-processors by function and country is published at https://makatea.ai/en/legal/subprocessors. The identity of each sub-processor, its location and the transfer mechanism are made available to the Customer on request through the contact channel in Section 1. Makatea informs the Customer reasonably in advance of any new or replaced sub-processor, so that it can object under the DPA.

WhatsApp messaging runs on Makatea's own infrastructure hosted in the United States and is not an independent third-party sub-processor. Communications to that infrastructure also involve an international transfer. Web push notifications to operators are delivered through the user's own operating system or browser providers, with the destination set by the user's browser or operating system.

International transfers. Transfers to the United States are made under the standard contractual clauses incorporated in each provider's terms, as required in each jurisdiction (Mexico arts. 35-36; Colombia Law 1581 and Decree 1377 art. 25; Brazil art. 33 LGPD and ANPD Res. 19/2024; Ecuador LOPDP and its Transfer Rules; Peru Law 29733 and S.D. 016-2024-JUS; European Union and United Kingdom, the European Commission's standard contractual clauses and the UK addendum). These transfers are disclosed to the data subject. The full and current list of sub-processors, their location and the transfer mechanism are detailed in the Privacy Policy and the DPA.

6.9. Exercise of rights and supervisory authority

• For portfolio data, data subjects must send their rights requests to the Customer (Controller). Makatea, as Processor, reasonably assists the Customer under the DPA.
• For data of the Customer's account and its users, data subjects can exercise their rights (access, rectification, erasure, objection (including objection to automated processing and profiling), portability and withdrawal of consent) with Makatea free of charge.

Single privacy channel (all jurisdictions). The single contact to exercise rights, for privacy and data protection matters and as Data Protection Officer, Delegate or Encarregado is:

José Rodrigo Barrios Villa, rodrigo@makatea.ai

This is the single channel for all jurisdictions and for exercising any right.

Response times by jurisdiction (for data for which Makatea is Controller):

• Mexico: 20 business days to respond and 15 additional business days to carry out the decision.
• Colombia: inquiries, 10 business days (extendable by 5). Claims, 15 business days (extendable by 8).
• Ecuador: 15 days.
• Peru: the periods set in the Regulation (S.D. 016-2024-JUS).
• European Union and United Kingdom: one month, extendable by two months for complex requests.

Supervisory authority. The data subject may file a complaint with the supervisory authority of its jurisdiction, for example the Secretaría Anticorrupción y Buen Gobierno (Mexico), the SIC (Colombia), the ANPD (Brazil), the SPDP (Ecuador), the APDP of MINJUSDH (Peru), the AEPD (Spain) or the ICO (United Kingdom). Contact details of each authority are in the Privacy Policy.

Ways to limit use or disclosure and to communicate changes (Mexico, art. 15-IV and VI). The data subject can limit the use or disclosure of its data by managing its marketing consent (opt-in and opt-out) and by joining contact exclusion lists. Any change to the privacy notice is communicated by email or by publication in the Platform, with the update date.

6.10. Data Protection Officer, Delegate or Encarregado

The privacy and data protection contact, single for all jurisdictions, is José Rodrigo Barrios Villa, rodrigo@makatea.ai:

• Mexico (art. 29 LFPDPPP): personal data officer or department.
• Colombia (Decree 1377 art. 13): channel for petitions, inquiries and claims (PQR).
• Brazil · Encarregado (DPO), art. 41 LGPD; ANPD Res. 18/2024.
• Ecuador · Data Protection Delegate (DPO), art. 47 LOPDP.
• Peru · Personal Data Officer.

Makatea is incorporated only in Mexico. Where the law of another country applies because the Service is offered to people in its territory, rights are handled through this single channel and the corresponding obligations are met. Local registrations or appointments (for example, RNBD in Colombia, RNPDP in Peru or DPO registration with the SPDP in Ecuador) are assessed and completed as Makatea has effective operations in each country. When operations in the European Union or the United Kingdom require it, Makatea appoints the representative provided for in article 27 of the GDPR or its UK equivalent.

6.11. Security incident notification

Notifying security incidents (personal data breaches) to supervisory authorities and to affected Customers or data subjects is mandatory in Brazil (art. 48 LGPD), Mexico (duty to report breaches, art. 19), Colombia (art. 17 lit. n), Ecuador, Peru, the European Union and the United Kingdom.

Mexican standard (art. 19 LFPDPPP). Article 19 requires the Controller to inform the affected data subject immediately of breaches that significantly affect their economic or moral rights. Therefore: (a) for account data, where Makatea is Controller, Makatea notifies the affected data subject immediately under article 19; (b) for portfolio data, where Makatea is Processor, Makatea notifies the Customer (Controller) within the period set in the DPA, so that the Customer meets the duty of article 19 toward its data subjects.

Makatea meets the notification periods that apply in each jurisdiction, including the 48-hour period to notify the APDP of MINJUSDH in Peru and notice within a reasonable period to the ANPD in Brazil. Makatea's period to notify the Customer is set in the DPA, so that the Customer can meet its own periods toward data subjects and authorities.

7. Availability and support

7.1. Availability

Makatea runs the Service to be available continuously. The Service may be temporarily suspended for maintenance, updates, force majeure or failures of providers the Service depends on (hosting, messaging, payments, email). Quantitative availability commitments (SLA) are agreed in writing, typically in the Sovereign plan. Other plans follow the terms published on makatea.ai.

7.2. Support

Support is provided through rodrigo@makatea.ai. The scope and response times of support are those of the subscribed plan, as published on makatea.ai.

7.3. Third-party dependence

The Customer acknowledges that some features depend on third-party services (for example, WhatsApp messaging, payment processors or the email provider) and that interruptions or changes in those services may affect the Platform without liability for Makatea.

8. Intellectual property and license

8.1. Ownership

The Service, software, code, design, trademarks and documentation are owned by Makatea or its licensors. These Terms do not transfer to the Customer any ownership right in the Platform.

8.2. License

Makatea grants the Customer a limited, non-exclusive, non-transferable and revocable license to use the Service during the subscription, under these Terms.

8.3. Customer data

The data the Customer uploads or generates in the Platform (including its portfolio data) is and remains the Customer's property or under its responsibility. The Customer grants Makatea a limited license to process that data for the sole purpose of providing the Service, under the DPA.

9. Confidentiality

Each party undertakes to keep confidential the non-public information of the other party it accesses through the Service, and to use it only for the purposes of these Terms, unless disclosure is legally required.

10. Limitation of liability and indemnity

10.1. "As is"

To the extent permitted by applicable law, the Service is provided "as is" and "as available", without implied warranties of merchantability or fitness for a particular purpose.

10.2. Exclusion

Makatea is not liable for:

• The Customer's failure to have a lawful basis to process and contact its portfolio, or the communications the Customer decides to send.
• The accuracy of the amounts, balances, interest, schedules or figures entered by the Customer. Makatea does not originate or determine them (see Section 2.2).
• Claims by the Customer's portfolio or third parties arising from the Customer's collection or communication activity.
• Indirect, incidental, special or punitive damages, or lost profits.

10.3. Cap

To the extent permitted by applicable law, Makatea's total aggregate liability arising from or related to the Service is limited to the amounts actually paid by the Customer for the subscription during the 12 months before the event that gives rise to liability.

10.4. Indemnity

The Customer undertakes to hold Makatea harmless from claims, penalties and damages arising from (i) breach of its obligation to have a lawful basis to process and contact its portfolio, (ii) the content and lawfulness of the data and communications it manages in the Platform, and (iii) use of the Service in breach of these Terms or applicable law.

11. Data protection by jurisdiction

These Terms and the Privacy Policy are designed to work under the data protection rules that apply according to the location of the Customer and of the data subjects in its portfolio. The Customer acknowledges the following frameworks and supervisory authorities.

11.1. Mexico

Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette on March 20, 2025 (in force since March 21, 2025, repealing the 2010 law). Authority: Secretaría Anticorrupción y Buen Gobierno. The ARCO rights are recognized (access, rectification, cancellation with blocking and objection, including objection to profiling), together with withdrawal of consent, free exercise and response periods of 20 business days (plus 15 to carry it out). Processing sensitive and financial data requires express consent (arts. 7 and 8). Transfers are governed by arts. 35-36. A personal data officer or department is appointed (art. 29). The privacy notice is offered in short form (at the point of collection) and full form (art. 16), and includes ways to limit use or disclosure and to communicate changes (art. 15-IV and VI).

11.2. Colombia

Statutory Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Single Decree 1074 of 2015), plus Law 527 of 1999 for the validity of these Terms as a data message. Authority: Superintendencia de Industria y Comercio (SIC). The rights to know, update, rectify, delete and revoke authorization are recognized, along with free access and the periods for inquiries (10 business days, extendable by 5) and claims (15 business days, extendable by 8). Authorization must be prior, informed and provable (keeping proof, art. 9). For sensitive data, authorization is explicit and the data subject is told it is not required to give it. The Processing Policy states its effective date and the term of processing of the databases (Decree 1377 art. 13). International transfers to countries without an adequate level are covered by a legal exception, an SIC declaration of conformity or a transmission contract with the processor abroad (art. 25 Decree 1377).

Financial habeas data, Law 1266 of 2008 (additional regime). The Customer is advised that, if it uses the Platform to report, manage or handle financial, credit, commercial or service information, in particular negative information on late payment or default, about debtors in Colombia, it may be subject to the special regime of Law 1266 of 2008 in addition to Law 1581 of 2012 and Decree 1377 of 2013. Under that regime, the Customer may be a source or operator of information, with its own duties such as prior notice to the data subject before reporting negative data (with the required advance notice), accuracy, quality and updating of the reported information, timely rectification of incorrect information and the rules on permanence and expiry of negative data. The Customer acknowledges and accepts that these obligations fall exclusively on it as source or operator and not on Makatea, which only provides the software and acts as Processor under the DPA, without reporting to or operating financial databases on its own account. Compliance with Law 1266 of 2008, including any report to credit bureaus, is the Customer's sole responsibility.

11.3. Brazil

General Personal Data Protection Law (LGPD, Law No. 13,709/2018) and ANPD Resolutions No. 18/2024 (Encarregado) and No. 19/2024 (international transfer). Authority: ANPD. The rights of article 18 are recognized (confirmation, access, correction, anonymization, blocking or deletion, portability, deletion of data processed on consent, information about sharing, withdrawal of consent and review of automated decisions, art. 20). In B2B, the main legal bases are performance of contract and legitimate interest. The purpose limitation principle is in art. 6-I LGPD. The content of the notice and easy access to information about the processing, including the form and duration of processing (art. 9-II), are governed by article 9. International transfers are based on article 33 through the contractual clauses incorporated in each provider's terms. Appointed Encarregado (DPO): José Rodrigo Barrios Villa, public channel rodrigo@makatea.ai (art. 41 LGPD; ANPD Res. 18/2024; see Section 6.10). Documents for Brazil are offered in Portuguese.

11.4. Ecuador

Organic Law on Personal Data Protection (LOPDP), its Regulation (Decree 904 of 2023), the Delegate Regulation (Resolution SPDP-SPD-2025-0028-R) and the Transfer Rules (Resolution SPDP-SPD-2026-0004-R). Authority: Superintendencia de Protección de Datos Personales (SPDP). The rights to information, access, rectification and updating, deletion, objection, portability, limitation or suspension and not to be subject to automated decisions (art. 22) are recognized. The notice states the specific purpose and retention periods. The right to deletion is handled by request through the single channel, with effective deletion or anonymization (see Sections 6.6 and 6.7). International transfers are covered by the contractual clauses incorporated in each provider's terms (Res. SPDP-SPD-2026-0004-R). Data protection contact for Ecuador: rodrigo@makatea.ai (art. 47 LOPDP; see Section 6.10).

11.5. Peru

Law No. 29733 and its Regulation (S.D. 016-2024-JUS, in force since March 30, 2025). Authority: National Authority for Personal Data Protection (APDP) of MINJUSDH. The rights to information, access, rectification, cancellation or deletion, objection, objective processing (profiling) and portability are recognized. The notice states retention periods or criteria. International transfers are covered by the contractual clauses incorporated in each provider's terms. The law applies extraterritorially. Incidents are notified to the APDP within 48 hours.

11.6. European Union and Spain

Regulation (EU) 2016/679 (GDPR). Authority in Spain: Agencia Española de Protección de Datos (AEPD). The rights of access, rectification, erasure, restriction, portability and objection are recognized, as is the right not to be subject to decisions based solely on automated processing (arts. 15 to 22). For the portfolio, the Customer is Controller and Makatea is Processor under article 28, on the terms of the DPA and its European Union and United Kingdom annex. Transfers to the United States are covered by the standard contractual clauses approved by the European Commission.

11.7. United Kingdom

UK GDPR and Data Protection Act 2018. Authority: Information Commissioner's Office (ICO). The same rights and roles of Section 11.6 apply. Transfers are covered by the UK addendum to the standard contractual clauses.

11.8. United States

The state privacy laws that apply depend on the data subject's state of residence and the Customer's size. The Customer, as Controller, determines which ones apply to it. Makatea does not sell or share personal data for advertising purposes.

11.9. India

Digital Personal Data Protection Act, 2023, as it comes into force in phases. The Customer acts as Data Fiduciary for its portfolio and Makatea as Data Processor.

11.10. Other countries

In Chile, Argentina, Nigeria, South Africa, Kenya and the other countries where the Customer uses the Service, local data protection laws apply. Makatea handles rights through the single channel in Section 6.9 and assists the Customer under the DPA.

11.11. Privacy notice by jurisdiction

The privacy notice made available to each data subject includes, depending on the applicable jurisdiction, the minimum content required by each law: identity and address of the Controller; categories of data and specific purposes (separating those that require consent); lawful basis; rights and free ways to exercise them with their periods; any automated processing or profiling, its logic and consequences; international transfers and their safeguards; retention periods or criteria and the deletion or blocking procedure; DPO, Encarregado or data officer contact; and the competent supervisory authority and how to reach it. For Brazil, the notice is offered in Portuguese.

12. Term and termination

12.1. Term

These Terms apply from acceptance and while the Customer has an active account or a current subscription.

12.2. Termination by the Customer

The Customer may cancel its subscription under the terms of its plan. Cancellation takes effect at the end of the current paid period, and access continues until then. After that, the subscription does not renew. The applicable refund policy is the one in Section 5.3 and the current terms published on makatea.ai.

12.3. Termination by Makatea

Makatea may suspend or terminate the Service in case of (i) breach of these Terms, (ii) non-payment, (iii) unlawful use or use that puts third parties or the Platform at risk, or (iv) a legal requirement.

12.4. Effects of termination

When the relationship ends, the Customer's access to the Service stops. Return, export or deletion of the Customer's data follows the DPA and the retention policy (Section 6.6). On request through the single channel, Makatea provides export in a structured format and effective deletion or anonymization of the data where applicable (see Sections 6.6 and 6.7). The Customer has a reasonable window (for example, 30 days) to export its data after termination, before deletion or anonymization, unless a longer legal retention period applies.

13. Changes to the Terms

Makatea may change these Terms. Changes are communicated by email to the Customer or by notice in the Platform, with the update date. Continued use of the Service after the changes take effect means acceptance. Material changes are communicated at least 30 days in advance, as required by applicable law.

14. Governing law and dispute resolution

14.1. Governing law

These Terms are governed by the laws of the United Mexican States. This is without prejudice to the mandatory data protection rules of each applicable jurisdiction (Section 11) and to public policy provisions that protect the Customer in its country.

14.2. Dispute resolution

For any dispute, the parties submit to the jurisdiction of the competent courts of Tepic, Nayarit, Mexico, waiving any other venue that may correspond to them by reason of their present or future domicile, except for public policy provisions that protect the Customer in its country. The parties will try to resolve any dispute in good faith before going to court.

15. General provisions

• Entire agreement: These Terms, together with the Privacy Policy and the DPA, are the entire agreement between the parties regarding the Service.
• Severability: If any clause is held invalid, the others remain in force.
• No waiver: Not exercising a right does not mean waiving it.
• Assignment: The Customer may not assign these Terms without Makatea's prior consent.
• Language: These Terms are published in Spanish, English and Portuguese. If versions differ, the Spanish version prevails.
• Notices: Notices to the Customer are sent to the contact details registered in its account. Notices to Makatea go to rodrigo@makatea.ai or to the address Avenida del Valle 162, Colonia Ciudad del Valle, C.P. 63157, Tepic, Nayarit, Mexico (phone +52 81 2007 2062).