Belvo MCP Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Belvo collects, uses, shares, stores and protects your personal data when you use Belvo MCP, our consumer service that gives you a consolidated view of your own financial life by combining Open Finance banking data and social-security (INSS) data in Brazil, and tax (SAT) and employment data in Mexico. Annex A contains the requirements that apply to users in Brazil, and Annex B contains the requirements that apply to users in Mexico.

The country annex applicable to your location forms part of this policy. If an annex conflicts with the general provisions of this policy, the annex governs for users in that country to the extent permitted by applicable law.

Language. This policy is also available in Portuguese and in Spanish. The Portuguese version prevails for users in Brazil and the Spanish version prevails for users in Mexico.

You can use Belvo MCP through an AI assistant that supports the Model Context Protocol (MCP). Section 7 explains specifically what that means for your data.

Who is responsible for your data. For Belvo MCP, Belvo determines the purposes and means of processing and is the controller under Brazil's LGPD and the responsible party under Mexico's LFPDPPP. The applicable entity is:

• Belvo Tecnologias LTDA, CNPJ: 37.869.837/0001-81, Rua Cônego Eugênio Leite, 623, Térreo, Pinheiros, São Paulo – SP, CEP 05414-011 — if you are located in Brazil
• Belvo Technologies, S.A.P.I. de C.V., located at Monte Elbruz 124, Floor 2, Int 212-B, Colonia Lomas de Chapultepec III Sección, Miguel Hidalgo, Mexico City, Mexico, C.P. 11000 — if you are located in Mexico.

What this policy does not cover. This policy applies only to Belvo MCP. If you encounter Belvo because a bank, lender or fintech uses our platform to connect your accounts to their application, that processing is governed by our End User Privacy Policy (https://belvo.com/privacy-policy-end-users/) and by that company's own privacy policy — not by this one.

Effective date: September 24th, 2026.

2. Summary

• We access financial, tax and employment data only after you take an affirmative step authorising the relevant connection. The method and scope depend on the data source, as described in Section 3.
• We store the data we retrieve in your Belvo MCP account and refresh it automatically on a recurring schedule, so that we can answer your questions and show you how your finances change over time. Section 8 explains how long we keep it.
• We use it to answer your questions about your finances. We do not sell it.
• Belvo does not use your identifiable financial data to train AI models. If you connect Belvo MCP to a personal account with an AI assistant provider, the provider receives and processes your questions and Belvo MCP’s responses as an independent controller under its own privacy policy, terms and account settings. This may include retention, security review, service improvement, research or model training. Belvo MCP only discloses data to an assistant after you add the Belvo MCP connector to it and sign in to Belvo MCP to approve the connection. AI assistant providers commonly used with Belvo MCP process this information in the United States.
• You can withdraw consent and request deletion of your data or account at any time, subject to limited retention required by law or necessary to establish, exercise or defend legal claims.
• Questions: [email protected]

3. Personal data we collect

3.1 Data you provide directly

You can create a Belvo MCP account either by registering directly with us, using email-based magic authentication, a password or a passkey, or by signing in with your Google account. Authentication is managed by our authentication service provider (WorkOS). We collect:

3.2 Financial and related data you authorise us to access

We access these categories only after you provide the authorisation required for the relevant source and method. Depending on the source, access may occur through a regulated data-sharing flow, or another connection you initiate. We retrieve this data and store it in your Belvo MCP account as described in Section 8.

We do not collect or store full payment card numbers (PANs), card verification values, or online banking passwords. In Brazil, authentication with your bank happens through the regulated Open Finance authorisation flow, so Belvo does not receive your online-banking password. Other sources (INSS in Brazil, and SAT and Llave MX in Mexico) require you to enter access credentials and identifiers in the connection interface of the Belvo MCP dashboard. Where a connection is refreshed automatically, Belvo stores these credentials in encrypted form so it can access the source on your behalf, and deletes them when you delete the connection. If a source asks for a verification code during connection or refresh, you can enter it in the Belvo MCP dashboard or, if you choose, give it to your AI assistant so that it passes it to Belvo MCP. If you give the code to your assistant, the AI assistant provider also receives it.

Financial, tax, employment and social-security records may reveal sensitive personal data, such as health information, disability-related benefits, biometric data or trade-union affiliation. We do not use Belvo MCP data to infer or profile sensitive characteristics. Belvo MCP does not filter records by sensitivity, so this information may appear in the data we retrieve, store and, when you ask, include in responses to your AI assistant. Where it constitutes sensitive personal data, we process it on the basis of the specific consent you give when you accept this policy in the connection interface, as described in the applicable country annex.

3.3 Data we collect automatically

• Technical and log data: IP address, device and browser type, operating system, timestamps of access, and error/diagnostic logs.
• Usage data: which Belvo MCP features and tools you use, and when. We use Datadog to monitor service health and logs.
• Query content: the questions you ask about your data, and the responses Belvo MCP returns. See Section 7.

We do not use advertising cookies or third-party tracking pixels in Belvo MCP. Belvo MCP uses only strictly necessary cookies, which keep you signed in to your account. These cookies contain a session identifier and are not used for advertising, analytics or profiling. A session lasts a maximum of 7 days and ends earlier after 4 days of inactivity, after which you will need to sign in again. We use these cookies because they are necessary to provide the service you request. You can block or delete cookies in your browser settings, but if you do, you will not be able to stay signed in to Belvo MCP.

4. How we use your personal data

We do not:

• Sell, rent or trade your personal data.
• Use your financial, tax or employment data to train Belvo artificial intelligence models.
• Use your data for advertising or marketing profiling.
• Make decisions about you that produce legal or similarly significant effects based solely on automated processing.

5. Who we share your data with

6. Where your data is stored and international transfers

Your Belvo MCP data is stored in the United States, on Amazon Web Services (AWS) infrastructure in the us-east-2 region (Ohio). Encrypted backups are kept in the AWS us-west-2 region (Oregon, United States). AWS acts as our processor (operador under the LGPD and encargado under the LFPDPPP), processes the data only on our instructions, and keeps it for the retention periods described in Section 8.

Where we transfer personal data outside your country of residence, we identify the destination countries, purpose, duration, recipient role and applicable transfer mechanism. We rely on:

• Brazil: International transfers require both a legal basis under the LGPD and a transfer mechanism permitted by Article 33. Depending on the transfer, we may rely on an adequacy decision, the Standard Contractual Clauses approved by ANPD Resolution CD/ANPD No. 19/2024, or another mechanism permitted by applicable law. For the storage and backup of Belvo MCP data with AWS in the United States, we rely on the Standard Contractual Clauses approved by ANPD Resolution CD/ANPD No. 19/2024.

Belvo MCP transfers personal data to the AI assistant provider you connect because you instruct Belvo MCP to answer your requests through that assistant. We rely on Article 33, IX of the LGPD, as the transfer is necessary to provide the service you requested (Article 7, V). Where the data includes sensitive personal data, we also rely on the specific and prominent consent under Article 33, VIII that you give when you accept this policy in the connection interface, after being informed in this section of the international nature of the transfer. The AI assistant providers commonly used with Belvo MCP are located in the United States, for which there is no ANPD adequacy decision.

You choose the provider when you add the Belvo MCP connector to your assistant. After an independent controller receives the data, its own privacy policy, international-transfer mechanisms and data-retention practices apply.

Additional information about destination countries, security measures, onward transfers and your rights is set out in this Section, Section 7 and Annex A, and is available on request at [email protected].

• Mexico: before an international transfer to a third party that is not acting as our processor, we inform you of the recipient and purpose and, where no statutory exception applies, obtain your consent. The recipient must assume the same obligations that apply to Belvo under the LFPDPPP and this policy. Processors acting solely on our behalf are bound by contract to process data only on our instructions.

If you use Belvo MCP through a third-party AI assistant, this policy describes the categories of data disclosed, the purposes, the destination and the applicable transfer mechanism, and you accept it in the connection interface before you create your first connection. The provider may also process the information under its own privacy policy when acting as an independent controller.

7. Using Belvo MCP through an AI assistant

Belvo MCP is available as a connector for AI assistants that support the Model Context Protocol. This section explains what that means, because it is the part people most often misunderstand.

What happens when you connect.

Your Open Finance consent authorises Belvo to retrieve the selected data for the purposes shown in the regulated consent flow. The purpose shown in that flow, and the Belvo MCP terms linked from it, include making the data available to you in the Belvo MCP dashboard and through the AI assistant you connect.

To connect an assistant, you add the Belvo MCP connector (https://panorama.belvo.com/mcp) in the assistant’s settings and sign in with your Belvo MCP account to approve the connection. From then on, the assistant can request data from Belvo MCP each time you ask it a question that requires your data, until you disconnect it.

What this means for your data.

This section, together with Section 6 and the country annexes, provides the information required by applicable law about the data disclosed, the purposes, the provider’s role and international transfers. We obtain consent where applicable law requires it, as described in the country annexes.

Your questions and Belvo MCP’s responses are received and processed by the connected AI assistant provider. If it acts as an independent controller, its privacy policy and terms also apply. Depending on the provider and on your settings with that provider, your conversations, including Belvo MCP’s responses, may be retained or used by the provider for its own purposes, such as improving its models. Please review the provider’s privacy settings before connecting.

When you connect Belvo MCP to an AI assistant that you use under your own account with that provider, the provider acts as an independent controller (in Brazil) or independent responsible party (in Mexico) of the information it receives. Belvo does not determine how the provider processes, retains or uses that information, and does not have a data-processing agreement with the provider covering your conversations. The provider's own privacy policy, terms and your settings with that provider govern that processing. Belvo remains responsible for the data Belvo MCP makes available to the assistant and for disclosing it only through a connection you have approved.

Belvo MCP discloses data when you use the connected assistant to request a response. The assistant decides which Belvo MCP tools to call, and with which parameters, based on your question; Belvo MCP returns the records that match each request.

You can disconnect Belvo MCP through the assistant’s settings. Disconnecting stops future disclosures but does not delete information already received by the provider. Requests concerning that information are handled according to the provider’s role, privacy policy and legal obligations.

Disconnecting the assistant does not delete your Belvo MCP account or the data stored in it. To delete your account, see Section 10.

What Belvo MCP includes in responses to AI assistants

Belvo MCP returns the records that match each request made by the assistant, such as accounts, balances, transactions, invoices or employment records for the requested period. Results are paginated, so Belvo MCP does not send your full stored history in a single response.

Responses include the data as received from the source. This may include account and branch numbers; account-owner details, such as name, tax identifiers and contact details; and descriptions of transactions or invoices that can contain the names or identifiers of other people, such as the counterparty of a transfer or the issuer or recipient of an invoice. Payment card numbers are received from Open Finance sources only in masked form, and full payment card numbers are never stored or disclosed.

National identifiers, such as CPF, CNPJ, RFC and CURP, may be included where they form part of the records returned.

Source credentials, consent tokens and Belvo MCP authentication data are not included in responses. Verification codes are only received by the assistant if you choose to give them to it (see Section 3.2).

Belvo MCP does not filter responses by sensitivity. If a record reveals sensitive personal data, such as a disability-related benefit or a trade-union fee, it may be included when it matches your request.

Operational logs record technical information about each request and do not store the content of Belvo MCP responses.

8. How long we keep your data

We keep your account data for as long as your account remains active. When you revoke a connection, we immediately stop retrieving data from that source and delete or irreversibly anonymise the data obtained through it within 30 days. When you close your account, we do the same for all of your data, including your account data.

When you revoke a connection or close your account, we immediately delete any stored credentials and revoke the related access tokens and, where applicable, your Open Finance consent with the relevant institution. Copies held in encrypted backups are overwritten within 30 days of deletion.

We keep technical and access logs for six months. In Brazil, we keep Open Finance consent and revocation records for five years, where applicable.

We keep support communications for two years. We keep evidence of your consents, acceptances and privacy requests for five years in Brazil and ten years in Mexico. During these periods, this information is blocked: we use it only to demonstrate compliance with our obligations or to respond to claims, and for no other purpose.

We may keep information for longer where a legal obligation, an order from a competent authority or an ongoing dispute requires it, and only to the extent necessary. When that period ends, we delete or irreversibly anonymise it. Anonymised data, which can no longer identify you, may be kept for statistical purposes.

When a retention period ends, we securely delete the data or irreversibly anonymise it. If deletion is temporarily impracticable in backups, we isolate the data from active use until the backup is overwritten.

Deleting your account. You can delete individual connections at any time from your Belvo MCP dashboard at https://panorama.belvo.com. To delete your entire Belvo MCP account, email [email protected] from the address associated with your account. Deleting your account removes your stored financial, tax and employment data on the timeline above, and revokes the authorisations we hold on your behalf.

9. How we protect your data

Belvo is certified to ISO/IEC 27001:2022 and is a PCI DSS compliant Service Provider. Our security program covers all product lines, including Belvo MCP.

Because Belvo MCP stores financial, tax and social-security data, we apply:

• Encryption of personal data in transit and at rest using industry-standard algorithms
• Logical separation of each user's stored data
• Least-privilege access controls, with access logged and reviewed
• Network segmentation, monitoring and alerting
• Web application and API protection (Cloudflare, including API Shield) for the Belvo MCP endpoint
• Secure development practices, including mandatory peer review of code
• An established incident response process, tested periodically

No system is perfectly secure, but we work continuously to protect your data. We notify affected individuals and relevant authorities of security incidents where required by applicable law. Country-specific notification requirements are described in the applicable annex.

10. Your rights

Depending on your location and applicable law, you may have the following rights. The applicable country annex explains the scope, conditions and response periods:

• Confirm whether we process your personal data, and access a copy of it
• Correct data that is incomplete, inaccurate or out of date
• Request deletion, cancellation, anonymisation or blocking where applicable
• Request portability where provided by applicable law
• Obtain information about our processing, sharing and transfers
• Withdraw your consent at any time, free of charge — this does not affect processing carried out before withdrawal
• Object to processing where provided by applicable law
• Object to or request review of qualifying decisions based solely on automated processing, and request information about the criteria used, where applicable
• Submit a complaint or petition to the authority identified in the applicable country annex

How to exercise them. Email [email protected]. We may ask you to verify your identity or authority to act for another person. Requests are free, except for legally permitted reproduction or delivery costs. The applicable country annex states the response periods and any additional requirements.

Three things you can do yourself, at any time:

1. Revoke a data-source authorisation — by deleting the connection in your Belvo dashboard, or through the source’s consent-management channel, where available. This stops us retrieving further data from that source.
2. Disconnect an AI assistant — in that assistant's settings. This stops any further data being shared with it.
3. Delete a connection or your account — delete connections in your dashboard, or email [email protected] to delete your account. This removes your stored data. See Section 8.

11. Children

Belvo MCP is available only to individuals aged 18 or older. We do not knowingly collect personal data from anyone under 18. If we learn that a minor has provided personal data, we will restrict processing, investigate and delete the data where appropriate.

12. Changes to this policy

We may update this policy. We will post the updated version at this URL and change the effective date at the top. We will highlight material changes and notify you in advance by email or in-product. If a change introduces a new purpose or transfer that requires consent, we will obtain that consent before the change applies to your data. Previous versions are available on request. Users who created an account before this policy was published will be notified by email before it takes effect. From the effective date, automatic refreshes and disclosures to AI assistants for their existing connections are paused until they reconnect each data source through the connection interface and accept this policy. Connections that are not reconnected within 30 days of the effective date will be deleted, together with their stored data, as described in Section 8.

13. Contact us

Last update: September 24th, 2026.

Annex A — Brazil

Scope and controlling terms.

This Annex applies if you are located in Brazil. It supplements the Belvo MCP Privacy Policy. If this Annex conflicts with the general policy, this Annex governs for users in Brazil.
Controller and Encarregado.

Belvo Tecnologias LTDA is the controller of personal data processed through Belvo MCP in Brazil.

The identity and contact details of Belvo’s Encarregado are published in Section 13. The Encarregado receives communications from data subjects and the Agência Nacional de Proteção de Dados (ANPD).

We process personal data under Brazil’s Lei Geral de Proteção de Dados Pessoais (LGPD), applicable ANPD regulations and, where relevant, the rules governing Open Finance Brasil.
Data sources and Open Finance Brasil.

Where a connection is made through Open Finance Brasil, Belvo MCP may receive account details and balances; transaction history; credit-card accounts, bills and transactions; investment holdings; and account-owner identification data, including name, tax ID and contact details. Authentication occurs with the relevant institution, and Belvo does not receive your online-banking password through that regulated flow. The consent screen identifies the transmitting institution, data categories, purpose and duration. Consent is specific, affirmative and separate from general terms. It is not presumed or obtained through a pre-selected option. The purpose shown includes making your data available to you in Belvo MCP and through the AI assistant you connect. Open Finance consents last for the period you select, up to 12 months, and can be renewed.

You can review and revoke an active Open Finance consent through the consent-management channel of the institution that holds your account, by deleting the connection in your Belvo MCP dashboard, or by contacting [email protected]. Revocation stops further regulated retrieval without delay. It does not by itself delete data already stored in Belvo MCP. Stored data is blocked, deleted or irreversibly anonymised as described in Section 8, unless another disclosed legal basis permits limited continued processing.

Connections to INSS are made with your gov.br access credentials, which you enter in the Belvo MCP connection interface; the source may ask you for a verification code. INSS data may include contribution history, employment information and benefit status.

Legal bases and sensitive personal data.

Providing Belvo MCP, administering your account and responding to requested support may rely on performance of a contract under Article 7, V of the LGPD. Retrieving, refreshing and, where applicable, storing data from authorised sources may rely on consent under Article 7, I. Making your data available through the AI assistant you connect relies on performance of the service you request under Article 7, V. Personal data of other people that appears in your records, such as the counterparty of a transfer, is processed on the basis of legitimate interests under Article 7, IX, only as part of the records you request. Security, fraud prevention and service reliability may rely on legitimate interests under Article 7, IX, following a necessity and balancing assessment. Producing aggregated, anonymised statistics and improving Belvo’s products and technology rely on legitimate interests under Article 7, IX; where the records involved reveal sensitive personal data, this processing relies on the specific consent described below. Legal and regulatory compliance relies on Article 7, II. Where we rely on legitimate interests, we process only data necessary for the stated purpose, consider your reasonable expectations and adopt safeguards for your rights.

Financial data is not automatically sensitive personal data under the LGPD. However, financial, tax, employment and social-security records may reveal health information, disability benefits, biometric data, trade-union affiliation or other sensitive personal data. We process sensitive personal data only with specific and prominent consent or another legal basis permitted by Article 11 of the LGPD, and we apply safeguards proportionate to the risk. We do not share sensitive health data with other controllers to obtain an economic advantage, except as permitted by Article 11, §4 of the LGPD.

Sharing and international transfers.

We identify the recipients or recipient categories, purposes and data categories in Sections 5 through 7. If Belvo relies on consent to share data with another controller, we obtain specific consent for that sharing unless another LGPD basis applies.

International transfers must have both an LGPD legal basis and a mechanism permitted by Article 33. Where applicable, Belvo uses the Standard Contractual Clauses approved by ANPD Resolution CD/ANPD No. 19/2024. Information about the destination country, duration, purposes, agent roles, security measures, onward transfers and rights is provided in Section 6 of this policy. You may request a copy of the applicable transfer clauses, subject to protection of commercial and industrial secrets.

This policy identifies the data categories, purposes, destination and role of the AI assistant provider you connect, which acts as an independent controller. Where the provider is located outside Brazil, the transfer relies on Article 33, IX of the LGPD, because it is necessary to provide the service you requested. Where the data disclosed includes sensitive personal data, it also relies on the specific and highlighted consent under Article 33, VIII that you give when you accept this policy in the connection interface, after being informed of the international nature of the transfer.

Data-subject rights.

You may request confirmation of processing; access; correction; anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data; portability where regulated; deletion of data processed on consent, subject to legal exceptions; information about public and private entities with which we shared data; information about the consequences of refusing consent; and revocation of consent. You may also object to processing conducted without consent when it does not comply with the LGPD.

Send requests to [email protected]. Confirmation or simplified access is provided immediately where applicable. A complete access statement is provided within 15 days. Other requests are handled without undue delay and within any period established by applicable ANPD regulation. Requests are free of charge. If we correct, delete, anonymise or block data, we notify recipients where required by law.

Automated processing.

You may request review of decisions made solely through automated processing that affect your interests, including decisions used to define personal, professional, consumer or credit profiles. On request, we provide clear information about the criteria and procedures used, subject to commercial and industrial secrets. Belvo MCP does not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
Security incidents.

If an incident involving personal data may create relevant risk or harm, Belvo notifies the ANPD and affected data subjects within three business days after learning of the incident, as required by applicable ANPD regulation. The notice describes the affected data, risks, security measures, delay where applicable and steps taken or planned to mitigate harm.

Complaints.

You may submit a complaint concerning Belvo’s processing to the Agência Nacional de Proteção de Dados at https://www.gov.br/anpd or to a competent consumer-protection body, subject to applicable procedures. Under ANPD procedures, you will generally need to show that you first submitted your request to Belvo and that it was not resolved within the applicable period.

Annex B — Mexico

Scope and controlling terms.

This Annex applies if you are located in Mexico. It supplements the Belvo MCP Privacy Policy. If this Annex conflicts with the general policy, this Annex governs for users in Mexico.

Responsible party.

Belvo Technologies SAPI de CV is the responsible party for personal data processed through Belvo MCP in Mexico. Its registered address is listed in Section 1.

Applicable law and authority.

We process personal data under Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and its applicable regulations. The competent federal authority is the Secretaría Anticorrupción y Buen Gobierno.

Data collected and source-specific notice.

For Mexico, Belvo MCP may connect to SAT for tax data and to employment and social-security data accessed through Llave MX. SAT data may include CFDI invoices, tax returns and fiscal-status information. Employment or social-security data may include contribution weeks, employment records and salary-base information. SAT connections use your RFC and SAT password (CIEC), and employment connections use your Llave MX credentials, which you enter in the Belvo MCP connection interface. Where a connection is refreshed automatically, Belvo stores these credentials in encrypted form and deletes them when you delete the connection. This notice describes the data retrieved, the purposes, the refresh frequency and the retention period.

Consent and purposes.

We obtain your express consent to retrieve, store and refresh financial or patrimonial data through your affirmative acceptance of this privacy notice in the connection interface, before the first connection is created. If sensitive personal data is processed, we obtain express consent in writing or through an electronic authentication mechanism, unless an exception under applicable law applies. Creating and administering your account, authenticating you, providing requested support, protecting the service and complying with law may be processed when necessary for the legal relationship or under another statutory exception. Primary purposes, which are necessary for your relationship with us, are: providing Belvo MCP; retrieving, storing and refreshing the data you authorise; creating, administering and securing your account; responding to your requests; and complying with law. Secondary purposes, which are not necessary for the service, are: producing aggregated statistics and improving Belvo’s products and technology using data that is subsequently anonymised. You may object to secondary purposes at any time, including before processing begins, by writing to [email protected]. Objecting to secondary purposes does not affect your access to Belvo MCP. Consent is not inferred from silence or from acceptance of the terms of service alone.

We obtain new consent before using personal data for a materially different purpose unless a statutory exception applies.

Transfers and AI assistants.

Before transferring personal data to a third party that is not acting solely as our processor, we identify the recipient or category of recipient, purpose and data categories. Where the transfer is not covered by an exception under Article 36 of the LFPDPPP, we present a clause allowing you to accept or reject it. Belvo MCP sends financial, tax or employment data to the AI assistant you connect, acting as an independent responsible party located in the United States, only after you approve the connection. You accept this transfer by accepting this notice and connecting an assistant; you may reject it by not connecting an assistant or by disconnecting it at any time, and you can continue to use the Belvo MCP dashboard. Providers that process data solely on our behalf, such as hosting, monitoring and authentication providers, receive data as processors (remisiones) and their processing does not require your consent. Where a transfer is international, the recipient assumes the same obligations that apply to Belvo.

Processors acting solely on our behalf must follow our instructions, maintain confidentiality, use appropriate security measures and refrain from using Belvo MCP data to train artificial intelligence models. If an AI assistant acts as an independent responsible party, its own privacy notice and retention controls also apply.

ARCO rights and other choices.

You may request access, rectification, cancellation or opposition. You may also revoke consent and limit the use or disclosure of your personal data. A cancellation request may result in a legally required blocking period before final deletion.

Send requests to [email protected]. The request should include your name and a means to receive our response; documents that prove your identity or, where applicable, the identity and authority of your representative; a clear description of the data and of the right you wish to exercise; and, for rectification requests, the correction requested and supporting documentation. We communicate our decision within 20 business days after receiving a complete request. If granted, we implement it within the following 15 business days. Either period may be extended once where justified. Requests are free, except for legally permitted reproduction or delivery costs.

Automated processing.

You may object where solely automated processing produces unwanted legal effects or significantly affects your interests, rights or freedoms and evaluates personal aspects without human intervention. Belvo MCP does not make decisions about you that produce legal or similarly significant effects based solely on automated processing.

Security Incidents.

If a security breach significantly affects your financial or moral rights we’ll notify you immediately and provide available information about the incident, affected data, risks, mitigation measures and steps you can take.

Complaints.

If you are dissatisfied with our response to an ARCO request, you may initiate the applicable data-protection procedure before the Secretaría Anticorrupción y Buen Gobierno within the period established by the LFPDPPP.