Data controller
BoolPay Servicios Financieros, with offices in Mexico City, is the party responsible for processing the personal data you provide. Data is protected under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, the INAI Privacy Notice Guidelines and other applicable Mexican regulation.
For any matter relating to your personal data, including exercising your rights or withdrawing consent, write to privacidad@boolpay.mx.
Data we collect
- Identification: name, age, gender, nationality, CURP, date and country of birth, official ID, signature, photograph.
- Contact: address, email, mobile and landline numbers.
- Tax: RFC and tax status certificate.
- Employment and professional: occupation, role, profession, workplace.
- Commercial: business name, industry, average ticket, transaction volume, trade references.
- Financial and asset data: banking information, CLABE account number, proof of income, transaction history.
- Technical and geolocation: IP address, device identifier, device geolocation at registration or transaction time, logs.
- Biometric (where applicable): only what is required for remote identity validation, such as facial recognition or liveness checks, which requires your express consent.
We do not request sensitive personal data as defined by the LFPDPPP (racial or ethnic origin, health status, genetic information, religious or philosophical beliefs, union membership, political opinions, sexual preferences).
Why we process it
Primary purposes — necessary for the relationship: verifying your identity and Know Your Customer obligations; complying with anti-money-laundering and counter-terrorism-financing regulation (PLD/FT); formalizing the contract; providing the contracted services, including accepting, processing and settling card payments; issuing receipts, statements and invoices; building and retaining your file; reporting to competent authorities where required; handling queries, claims and clarifications; and preventing, detecting and investigating fraud, chargebacks and unusual activity.
Secondary purposes — optional, and you may object at any time: offering upgrades or improvements, promotions and benefits, marketing communications, quality and satisfaction surveys, and statistical analysis and market research. Objecting to secondary purposes will never be grounds to deny you the service. To object, email privacidad@boolpay.mx.
Transfers
We may transfer data, inside and outside Mexico, to: group companies; acquirers, clearing houses and card schemes for authorization, clearing, settlement and chargeback handling; financial institutions; credit information bureaus and identity-validation providers; technology, cloud, support and professional-services providers acting as processors; competent authorities (Banxico, SAT, UIF, CNBV, CONDUSEF, INAI, tax, judicial and administrative authorities); and acquirers or assignees in the event of a corporate transaction. We require recipients to observe the principles and duties of the LFPDPPP and to apply equivalent security measures.
Your rights (ARCO)
You may at any time request Access to your data, Rectification of inaccurate or incomplete data, Cancellation where it is not being handled per applicable duties, and Objection to specific uses. Send your request to privacidad@boolpay.mx including your name, a contact channel for our reply, proof of identity or legal representation, and a clear description of the data concerned. We respond within a maximum of 20 business days and, where the request is well-founded, act on it within the following 15 business days.
Retention
We keep personal data for as long as needed to fulfil the purposes above, plus any additional statutory periods — including tax, commercial, financial and PLD/FT obligations, which can reach ten years from the end of the contractual relationship. After that, data is blocked and then deleted under the procedure set out in the law.
Security
We apply administrative, technical and physical safeguards: controls aligned with PCI DSS, encryption in transit and at rest, tokenization, access controls, continuous monitoring, and business-continuity and incident-response plans. No system is completely infallible; if a security breach materially affects your rights, we will notify you through the contact details on file.
Cookies
We collect usage information automatically through cookies, web beacons, logs and pixels: domain name, browser type, language preference, device type and operating system, pages visited, links clicked, IP address, device identifiers, approximate location, timestamps and referring URL.
Changes and supervisory authority
We may update this policy; changes are published on this site. If you believe your data protection rights have been affected, you may file a complaint with Mexico's National Institute for Transparency, Access to Information and Personal Data Protection (INAI) at inai.org.mx.
Authoritative version. This page is an English summary provided for convenience. The complete and legally binding notice is the Spanish Aviso de privacidad integral; in case of any discrepancy, the Spanish version prevails. Machine-readable version: /privacy.md. Last updated: May 2026.