Skip to content
ES EN

Privacy Notice

COMPREHENSIVE PRIVACY NOTICE

I. IDENTITY AND ADDRESS OF THE CONTROLLER

BTM Pay, S.A. de C.V., a company with a valid registration as a Money Transmitter, hereinafter “BTM”, with its address at Bosque de los Ciruelos número 140, interior 401, Colonia Bosques de las Lomas, Alcaldía Miguel Hidalgo, C.P. 11700, Ciudad de México., in compliance with Articles 15, 16 and other relevant provisions of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (hereinafter, the “Law”), provides you with this Privacy Notice because “BTM” is the Controller of the use and protection of the Personal Data that You (“Data Subject”) have provided directly or through electronic, optical, audio or visual media, or through any other technology or other sources permitted by the LFPDPPP.

II. DEFINITIONS

For the purposes of this Privacy Notice, the terms set out below, when written with an initial capital letter, shall have the meanings specified in this document, whether used in the singular or the plural:

Privacy Notice: A document made available to the person to whom the information pertains, in physical, electronic or any other format generated by the controller, from the time their personal data are collected, to inform them of the purposes for which the data will be processed, in accordance with Article 14 of the Law.

Consent: The freely given, specific and informed expression of the data subject’s wishes by which the data are processed.

Cookies: Technologies through which it is possible to monitor the data subject’s behavior as an Internet User and their preferences.

Personal Data Department: The area designated by the Controller that promotes the protection of Personal Data and handles requests and concerns from Data Subjects.

Personal Data: Any information relating to an identified or identifiable individual.

Sensitive Personal Data: Personal Data that affect the intimate sphere of the
Data Subject, or whose improper use could give rise to any type of discrimination or entail a serious risk to the Data Subject. This category includes data that may reveal personal aspects of the Data Subject, such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, trade union membership, political opinions, sexual preference or financial circumstances.

ARCO Rights: Rights of Access, Rectification, Cancellation and Objection.

Law: Refers to the LFPDPPP, its regulations, and any legal provisions that
govern the collection, storage and transmission of Personal Data.

LFPDPPP: Refers to the Ley Federal de Protección de Datos Personales en Posesión de los
Particulares.

Processor: An individual or legal entity that, alone or jointly with others, processes personal data on behalf of the controller;

Regulations: The Reglamento de la Ley Federal de Protección de Datos Personales en Posesión
de los Particulares.

Controller: An individual or private legal entity that decides on the Processing of personal data.

Services: Refers to the services provided by “BTM” as a money transmitter, consisting of sending money to a specified Beneficiary User or receiving money.

Website: Refers to the website www.bpay.capital owned by “BTM”.

Third Party: A domestic or foreign individual or legal entity other than the Data Subject, the
Controller or the Personal Data Processor.

Data Subject/You: The individual to whom the Personal Data pertain (hereinafter
referred to interchangeably as the “Data Subject” or “You”).

Processing: Any operation or set of operations performed on personal data, by
any means. Use encompasses any action involving access, collection, storage,
circulation, handling, utilization, Transfer or disposal of Personal Data.

Transfer: Any communication of data to a person other than the Controller or
Processor.

Beneficiary User: Any individual or legal entity that receives, within the national territory,
rights or funds in national currency, having been designated to receive them by the Data Subject who contracted the Services of “BTM” for that purpose.

III. PERSONAL DATA WE COLLECT

The personal data that BTM collects from its Users are those necessary to identify them, compile and update their files, provide the contracted services, and comply with applicable legal and regulatory obligations, particularly those relating to the prevention and detection of transactions involving resources of illicit origin and terrorist financing.

Personal data may include the following, as appropriate to the nature of the User, their participation in the transaction, and the requirements established by applicable regulations:

a) Identification data: full name, nationality, date and place of birth, gender or sex where applicable, address, Clave Única de Registro de Población (CURP), Registro Federal de Contribuyentes (RFC), occupation, profession or economic activity, official identification document details, and handwritten signature.

b) Contact data: telephone number, email address, and address for receiving communications.

c) Asset and financial data: bank account information, interbank CLABE, source and destination of funds, transaction amounts, economic activity, transaction profile, and other financial information necessary to provide the services and comply with applicable obligations.

d) Transaction-related data: information about senders, beneficiaries, legal representatives, and other persons involved in transactions, where required under applicable provisions.

Personal data will be collected through BTM’s established identification and contracting procedures, in accordance with its in-person operations and applicable regulations.

The documentation and information obtained may be retained in physical or electronic form, in accordance with the corresponding legal periods and obligations.

WHEN DO WE COLLECT PERSONAL DATA?

BTM may collect personal data in the following circumstances:

a) When carrying out the identification and know-your-user process before establishing a business relationship.

b) When entering into contracts for the provision of money transmission services.

c) When receiving instructions to carry out money transmission transactions.

d) When identifying persons involved as senders, beneficiaries or legal representatives, in accordance with applicable provisions.

e) When updating Users’ identification files.

f) When handling requests, inquiries, complaints or communications relating to the contracted services.

g) When complying with requests from competent authorities and other applicable legal obligations.

Information will be collected in accordance with BTM’s internal procedures and applicable legal and regulatory provisions.

IV. PURPOSES OF PERSONAL DATA PROCESSING

The personal data we collect from you will be used for the following primary purposes:

  • Providing the contracted services and/or fulfilling contractual relationships.
  • Issuing invoices, collecting payments and/or carrying out administrative activities.
  • Complying with legal, contractual and commercial obligations.
  • Evaluating the quality of services and conducting satisfaction surveys.

Additionally, we will use your information for the following secondary purposes, which are not necessary for the requested service but enable us to provide you with better service:

  • Sending commercial, advertising or promotional information.
  • Invitations to events, courses, seminars and/or newsletters.

If you do not wish your data to be processed for these secondary purposes, you may indicate this from this time by sending an email to hello@bpay.capital.

V. DATA TRANSFERS

“BTM” does not Transfer Personal Data to unrelated third parties without your consent, except for transmissions it may make among its affiliates, associates, commission agents or related companies and/or any other party related to “BTM”, provided that these are necessary for its operations and primary purposes. Such transmissions will therefore be made solely to fulfill the Services You have contracted with “BTM”, as well as in the other circumstances provided for in Article 37 of the LFPDPPP:

A) When the Transfer is provided for in a Law or Treaty to which Mexico is a party;

B) When the Transfer is made to holding companies, subsidiaries or affiliates under common control with “BTM”, or to a parent company or any company in the controller’s group that operates under the same internal processes and policies, such third parties shall have access to Personal Data solely to provide the Services and fulfill the primary and secondary purposes specified in this Privacy Notice, or to comply with applicable legislation, exclusively;

C) When the Transfer is necessary by virtue of a contract entered into or to be entered into in the interest of the Data Subject, by the controller and a third party;

D) When the Transfer is necessary or legally required to safeguard a public interest, or for the pursuit or administration of justice;

E) When the Transfer is required for the recognition, exercise or defense of a right in judicial proceedings,

F) When the Transfer is required for the maintenance or fulfillment of a legal relationship between “BTM” and the data subject.

“BTM” may disclose your Personal Data where required by applicable legislation, that is, the transmission does not fall within those circumstances, we will request your consent for such Transfer under the terms specified by the Law.

“BTM” does not trade in Personal Data or sell them to third parties.

If “BTM” intends to Transfer Personal Data to third parties unrelated to “BTM” with whom it has entered into collaboration agreements, “BTM” must inform the Data Subject of such Transfer through the relevant electronic means. Accordingly, those third parties will become Controllers or Processors, as it will be the Data Subject who grants consent or permits the Transfer, except for Transfers made in the circumstances provided for in Article 37 of the LFPDPPP. “BTM” will not be the Controller and will not be required to answer for or protect information that the Data Subject has provided to third parties as a result of the foregoing.

Under no circumstances will we trade in, sell or rent your personal information without your prior consent.

VI. ARCO RIGHTS (ACCESS, RECTIFICATION, CANCELLATION AND OBJECTION)

The Data Subject or their duly authorized legal representative may limit the use or disclosure of their Personal Data, as well as exercise, where applicable, the rights of Access, Rectification, Cancellation or Objection recognized by the LFPDPPP, as follows:

a) Access: knowing what personal data we hold about You, what we use them for, and the conditions under which we use them;

b) Rectification: requesting the correction of your personal information if it is outdated, inaccurate or incomplete;

c) Cancellation: requesting that such information be deleted from our records or databases when you consider that it is not being used appropriately; and

d) Objection: objecting to the use of your personal data for specific purposes.

These rights are known as ARCO rights. To exercise any ARCO right, You must submit the corresponding request by contacting the Personal Data Department at the email address hello@bpay.capital, containing the following information:

  • The data subject’s full name
  • A means of communicating the response (email address or postal address)
  • Documents establishing their identity
  • A clear and precise description of the data in respect of which an ARCO right is to be exercised
  • Any other information that helps locate the data

“BTM” will have a maximum period of 20 (twenty) business days from the request to inform you whether it can be granted. This information may be stored using manual or electronic systems with restricted access, with the aim of protecting it against loss, fraudulent use, unauthorized access, disclosure, alteration or destruction.

If the request can be granted, it will be implemented within 15 (fifteen) days following the date on which the response is communicated. The periods referred to above may be extended once for an equal period, provided that “BTM” justifies this based on the circumstances of the case.

If the information provided in the request is insufficient or incorrect for processing it, or if the documents establishing the data subject’s identity and/or the legal representative’s authority are not enclosed, “BTM” may, on one occasion and within 5 (five) days following receipt of the request, require the Data Subject to provide the information or documents needed to process it. The Data Subject will have ten (10) business days to respond to this requirement, counted from the day after receiving it. If no response is provided within that period, the corresponding request will be deemed not to have been submitted.

If the Data Subject responds to the request for information, the period for the controller to respond to the application will begin on the day after the Data Subject has met that requirement. “BTM” will not be required to provide access to, rectify, cancel or grant an objection concerning the Data Subject’s personal data in the circumstances established in Article 34 of the LFPDPPP.

The Data Subject has the right to initiate a Rights Protection Proceeding before the Secretaría Anticorrupción y Buen Gobierno, within or after the expiry of the period of 20 (twenty) business days counted from the date of receipt of their request to exercise their rights, if no response has been received.

You are informed that when the Data Subject or their representative revokes and/or cancels the use of their Personal Data, “BTM” may be unable to continue providing its Services, or the User experience may change.

The exercise of the rights of cancellation and objection will be subject to the limitations and exceptions provided for in applicable legislation. Accordingly, “BTM” may retain and process personal data where necessary to comply with legal and regulatory obligations, particularly those relating to User identification, file retention, the prevention of transactions involving resources of illicit origin and terrorist financing, and to respond to requests from competent authorities.

VII. MECHANISMS FOR REVOKING CONSENT

The Data Subject may revoke the consent granted for the processing of their personal data at any time by sending a request to hello@bpay.capital, following the procedure established for exercising ARCO rights.

Revocation of consent will not have retroactive effect and will not apply to processing that must continue in order to fulfill legal or regulatory obligations incumbent upon “BTM”, particularly concerning the prevention of transactions involving resources of illicit origin and terrorist financing.

VIII. CHANGES TO THE PRIVACY NOTICE

BTM Pay, S.A. de C.V. reserves the right to make changes or updates to this privacy notice at any time. These will be available on the website www.bpay.capital or sent to you through the contact details provided.

IX. CONSENT

Personal data will be processed in accordance with the purposes established in this Privacy Notice and applicable legal provisions.

Where the processing of personal data requires the Data Subject’s consent, “BTM” will obtain it under the terms provided for by the LFPDPPP.

Consent will not be required where the processing falls within any of the exceptions provided for in applicable legislation, particularly where it is necessary to fulfill legal obligations incumbent upon “BTM”.

X. APPLICABLE LEGISLATION, JURISDICTION AND COMPETENCE.

This Privacy Notice will be governed by the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, its Regulations and other applicable provisions, as well as by the Ley General de Organizaciones y Actividades Auxiliares del Crédito and the regulatory provisions applicable to Money Transmitters, insofar as they relate to the processing and retention of personal data.

Last updated: October 15, 2026