Comprehensive Privacy Notice

1. Who is responsible for your personal data?

Tecnologías Avanzadas Centrales, S.A.P.I. de C.V., commercially known as “KARVIA”, with address at Calle 20 No. 235 Int. 601-A, Fraccionamiento Altabrisa, Mérida, Yucatán, C.P. 97130, is the legal entity that decides on the processing of the personal data it collects for the purposes described in this Privacy Notice (the “Controller”).

This English text is a convenience translation. The Spanish notice at /privacy is the primary notice under Mexican law for data subjects in Mexico.

KARVIA offers a vehicle-management and intelligence platform (the “Platform”) to administer vehicles and fleets, receive and analyze vehicle information, generate alerts and indicators, manage maintenance and documentation, and use artificial intelligence, geolocation, telemetry and, where applicable, cameras, devices, and third-party integrations.

This Notice applies to natural persons whose data KARVIA processes as Controller, including individual customers, representatives, administrators and users of enterprise customers, prospects, website visitors, suppliers, workshop contacts, and other persons who interact with KARVIA or whose data KARVIA collects directly in connection with its Services.

2. When does KARVIA process data on behalf of an enterprise customer?

When a company contracts the Platform to manage its fleet and provides or generates through it information related to its drivers, operators, employees, vehicles, or staff, that company determines the purposes of the processing and acts as Controller of those personal data.

In those cases, KARVIA acts as a processor (Persona Encargada) and processes the data under the customer’s instructions and only as needed to provide the contracted Services.

The enterprise customer is responsible for having the privacy notice, legal bases and, where applicable, the consents required for its drivers, operators, and other staff.

This Notice mainly covers processing in which KARVIA acts as Controller and does not replace the privacy notices that enterprise customers must provide.

3. What personal data may we process?

Depending on the relationship with KARVIA and the Services used, we may process the following categories of data:

• Identification and contact: name, phone, email, address, representative or Authorized User data, and tax information needed for contracting and invoicing.
• Vehicle and driver-related data: make, model, year, plates, serial number, mileage, maintenance, vehicle assignment, licenses, and other documents uploaded to the Platform.
• Telemetry and operations: current and historical geolocation, routes, trips, stops, speed, driving, consumption, fault codes, vehicle information, alerts, indicators, and operational metrics.
• Documents and information uploaded to the Platform: policies, registration cards, permits, licenses, invoices, and other files the user or customer incorporates or processes through contracted features.
• Video and images: when camera features are contracted, KARVIA may receive events, images, or clips related to vehicle operation and driving.
• Interactions and support: messages, queries, instructions, files, and communications through the Platform, WhatsApp, AI assistants, email, or support channels.
• Commercial, financial, and payment data: billing information, payment method and status, collection history, and information needed to manage payments, orders, or third-party financing.
• Technical and browsing data: IP address, session identifiers, device, browser, activity logs, and cookies or similar technologies.

KARVIA may obtain these data directly from the data subject, from an enterprise customer, from connected vehicles or devices, from documents uploaded to the Platform, or from authorized third-party integrations.

When processing of financial or patrimonial data requires express consent under applicable law, KARVIA will collect that consent through the corresponding mechanism.

4. Sensitive personal data

KARVIA does not ordinarily request sensitive personal data as a purpose of the service.

Certain features, particularly those related to cameras, video, or information freely uploaded by users, may involve information that, depending on its nature and use, could be considered sensitive under applicable law.

When processing legally requires sensitive personal data, KARVIA or, as applicable, the customer acting as Controller must obtain the data subject’s express written consent when that consent is required.

5. How we use personal data

KARVIA may use personal data for the following primary purposes, which are necessary to provide its Services or maintain its relationship with the data subject:

• register and administer accounts, users, access, and permissions;
• contract, configure, operate, and support KARVIA Services;
• manage vehicles, fleets, documentation, maintenance, routes, expenses, and other contracted features;
• provide geolocation, telemetry, alerts, reports, and operational indicators;
• operate assistants and AI-based features;
• process events, clips, or images when camera features have been contracted;
• process documents and generate reminders or alerts;
• invoice, collect, process payments, and administer the contractual relationship;
• handle inquiries, support requests, and demonstrations;
• manage authorized integrations with third-party platforms or services;
• protect Platform security, prevent misuse, and keep activity records;
• comply with legal, tax, and contractual obligations and respond to lawful authority requests; and
• handle requests related to personal-data protection rights.

KARVIA may also use personal data for the following secondary purposes, which are not necessary to provide the Services:

• send commercial or promotional information or news about products and services;
• conduct quality surveys and market studies; and
• measure campaigns and analyze use of KARVIA’s commercial sites and channels.

When any of the above purposes requires the data subject’s consent under applicable law, KARVIA will collect that consent through the corresponding mechanism before carrying out the processing.

The data subject may at any time request that their data not be used for these secondary purposes by writing to soporte@karvia.mx. Refusal will not affect provision of the Services.

Once data have been subjected to an effective de-identification process that prevents them from being associated again with an identified or identifiable person, they may be used for statistical analysis, security, Platform improvement, feature development, and improvement of technological models.

6. Artificial intelligence and automated processing

Some KARVIA features use automated systems and artificial intelligence to analyze information available on the Platform and generate alerts, indicators, recommendations, summaries, Health Scores, driving metrics, or other support tools.

These results depend on the information available and have an informational and operational purpose. They do not replace mechanical, technical, legal, or professional evaluations that apply in each case.

If automated processing produces unwanted legal effects or significantly affects a data subject, that person may exercise the rights that apply under applicable law.

7. Providers, processors, and transfers

To operate the Platform, KARVIA may rely on processors (Personas Encargadas) and technology providers that supply infrastructure, storage, telecommunications, messaging, payment processing, artificial intelligence, security, support, or other services needed for operation.

When those providers process information exclusively on KARVIA’s behalf and under its instructions, the communication of data is not a transfer to a third party under applicable law. The law expressly distinguishes transfers to third parties from communications made to a processor.

KARVIA may make domestic or international transfers when necessary, including:

• to workshops, suppliers, or other providers selected or requested by the data subject or the Customer, to quote or provide the corresponding services;
• to third parties participating in payment or financing schemes requested by the data subject;
• to affiliates or members of the same corporate group, when applicable;
• when the transfer is necessary to enter into or perform a legal relationship in the data subject’s interest; or
• to competent authorities when there is a legal duty or valid request.

Transfers that fall under a statutory exception may be made without additional consent.

KARVIA will not make transfers that require consent without first obtaining it. When necessary, it will make available the corresponding mechanism to accept or reject that transfer.

8. ARCO rights, revocation, and limitation

The data subject or their legal representative may request access, rectification, cancellation, or objection to the processing of their personal data, as well as revoke consent when appropriate or request limitation of use or disclosure.

The request may be sent from the ARCO form or to soporte@karvia.mx and should include:

• the data subject’s name and a means to receive a response;
• documents proving identity and, if applicable, representation;
• a clear description of the right to be exercised; and
• any information that helps locate the data.

KARVIA will communicate its determination within a maximum of 20 business days from receipt of the request and, if the request is granted, will give effect to the right within the 15 business days following the date it communicates its response, without prejudice to extensions allowed by applicable law.

Cancellation, objection, or revocation may not be available for processing needed to meet legal or contractual obligations.

If KARVIA receives a request regarding data it processes only as a processor for an enterprise customer, it will channel the request to the corresponding Controller.

9. Cookies and similar technologies

The website and Platform may use cookies and similar technologies needed for authentication, security, operation, and preference storage, as well as analytics or measurement tools when enabled.

Users may manage or disable those technologies in their browser settings or, where applicable, through the consent mechanism KARVIA implements.

Some strictly necessary cookies may be indispensable for certain services to work.

10. Retention and security

KARVIA will retain personal data only for as long as needed to fulfill the purposes for which they were collected and the legal, contractual, or rights-defense obligations that apply.

After those purposes are fulfilled, the data will be blocked when appropriate and then deleted or, if applicable, irreversibly de-identified.

Specific retention periods may vary depending on the nature of the information and the Service used.

KARVIA maintains reasonable administrative, technical, and physical measures to protect personal data against damage, loss, alteration, destruction, unauthorized use, or unauthorized access.

If a security breach significantly affects data subjects’ patrimonial or moral rights, KARVIA will inform the affected persons immediately so they can take corresponding measures, in accordance with applicable law.

11. Changes to this Privacy Notice

KARVIA may modify or update this Privacy Notice because of legal, technological, operational, or Service changes.

The current version will be available at https://karvia.mx/privacy (and https://karvia.mx/en/privacy for this translation).

When a change is substantial and it is necessary to inform data subjects directly, KARVIA may communicate it by email, the Platform, or another available contact channel.

12. Contact