Privacy Policy

This Privacy Policy describes how Railon ("Company", "we", "us", or "our") collects, uses, stores, and protects information in connection with the use of our platform and services. This policy is issued in compliance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP") and its associated regulations.

1. Data Controller

Railon is the data controller responsible for the personal data processed through our platform. For questions regarding this policy or your personal data, contact us at: info@railon.com.mx

2. Data We Collect

2.1 Business Information

For business clients and API partners, we collect:

• Legal entity name and registration details
• Beneficial ownership information
• Director and officer information
• Business address and contact details
• Tax identification numbers (RFC)
• Banking and payment account details

2.2 Compliance and Verification Data

For regulatory compliance and KYC/KYB purposes, we may collect:

• Government-issued identification documents
• Proof of address documentation
• Business registration documents
• Source of funds information
• Transaction history for AML monitoring

2.3 Technical Data

When you use our platform, we automatically collect:

• IP addresses and device identifiers
• API request logs and usage data
• Browser and operating system information
• Session and authentication data

3. Purpose of Data Processing

We process personal data exclusively for the following purposes:

• Compliance: AML/KYC verification, sanctions screening, and fulfillment of legal reporting obligations;
• Service Delivery: Providing API access, processing transactions, and supporting platform operations;
• Security: Fraud prevention, account protection, and platform integrity;
• Legal Obligations: Compliance with applicable laws, regulatory requirements, and court orders;
• Communications: Responding to inquiries, sending service notifications, and account management.

We do not use personal data for marketing purposes without explicit consent, and we do not sell personal data to third parties under any circumstances.

4. Data Sharing

4.1 Licensed Financial Partners

We share necessary data with our network of licensed financial institution partners for the purpose of processing payments and settlement. These partners are contractually required to protect your data and use it only for the agreed purpose.

4.2 Compliance Providers

We share data with licensed KYC/AML verification providers for identity verification and compliance screening purposes.

4.3 Legal Requirements

We may disclose data to government authorities, regulators, or law enforcement when required by applicable law, court order, or regulatory directive.

4.4 No Sale of Data

We do not sell, rent, or otherwise transfer personal data to third parties for commercial purposes.

5. Data Retention

We retain personal data for the period necessary to fulfill the purposes outlined in this policy, and in any case for the minimum period required by applicable law. Under Mexican AML regulations, transaction records and KYC documentation are retained for a minimum of five (5) years from the date of the transaction or the termination of the business relationship, whichever is later.

6. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS 1.2+) and at rest;
• Access controls and role-based permissions;
• Regular security assessments and audits;
• Incident response procedures;
• Employee training on data protection.

7. Your Rights

Under the LFPDPPP, you have the following rights with respect to your personal data (ARCO rights):

• Access (Acceso): The right to know what personal data we hold about you;
• Rectification (Rectificación): The right to correct inaccurate or incomplete data;
• Cancellation (Cancelación): The right to request deletion of your data, subject to legal retention requirements;
• Opposition (Oposición): The right to object to certain processing activities.

To exercise your rights, submit a written request to info@railon.com.mx. We will respond within twenty (20) business days as required by law.

8. International Data Transfers

Where personal data is transferred to our licensed partners outside of Mexico, we ensure that appropriate safeguards are in place, including data processing agreements that provide equivalent protection to that afforded under Mexican law.

9. Cookies and Tracking

Our website uses essential cookies required for platform functionality and security. We do not use third-party advertising or behavioral tracking cookies. You can control cookie settings through your browser preferences.

10. Modifications to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform or by email. Continued use of the Services after notification constitutes acceptance of the updated policy.

11. Contact

For questions, requests, or complaints regarding this Privacy Policy or our data practices, contact our data privacy team at: info@railon.com.mx