Rebill recognizes that, as a user of our Rebill Services, you are the sole owner of your personal data and strives to protect the privacy and confidentiality of that data, in accordance with the terms required by the applicable regulations in each Rebill country.

This Privacy Policy describes how Rebill collects, uses, shares, and protects your personal information when you use our technology platform (the “Rebill System” or the “System”), our websites, or make payments through the Rebill Services. By using our Rebill Services, you agree to the practices described in this Privacy Policy.

The Rebill Companies are the companies that provide Rebill Services in six (6) countries: Colombia, Argentina, Brazil, Mexico, Chile, and Uruguay (hereinafter the “Rebill Countries”). The Rebill Company incorporated in Colombia is Rebill S.A.S.; the one incorporated in Argentina is Rebill S.A.; the one incorporated in Brazil is Rebill do Brasil Pagamentos Ltda.; the one incorporated in Mexico is Rebill Payments, S.A. de C.V.; the one incorporated in Chile is Rebill SpA; and the one incorporated in Uruguay is Fitzwill S.A.   (individually or collectively, as applicable, “Rebill” or the Rebill Companies). Fitzwill S.A. does not provide services to individuals or entities in Uruguay and does not process transactions for customers or payers within Uruguay.

‍

‍1. INFORMATION WE COLLECT
We collect personal and non-personal information when you interact with our Services
Rebill. This includes:

• Personal information: name, email address, phone number, address, payment information (such as credit/debit card numbers, security codes, expiration dates), financial information, and identification information.
• Transaction Information: Details about payments, purchases, dates, amounts, and merchants involved.
• Technical information: IP address, browser type, device used, cookies, geolocation data (if applicable), and access logs.
• Third-party information: Data obtained from partners, such as financial institutions or payment networks, to validate transactions.

‍
Third-party information: Data obtained from partners, such as financial institutions or payment networks, to validate transactions.

We do not collect sensitive information unless it is strictly necessary for the Rebill Services and with your explicit consent where required by law.

‍

‍2. USE OF INFORMATION
We use your information to:

• Process and validate payments, prevent fraud, and manage transactions.
• To improve and personalize our Rebill Services, including recommendations and features.
• To comply with legal, regulatory, and compliance obligations.
• Send communications, such as transaction confirmations, service updates, and promotions (you can choose not to receive them).
• Conduct internal analyses, audits, and investigations to optimize our products.
• Share with third parties for specific purposes, such as payment verification or business partnerships, always with appropriate safeguards in place.

‍
Rebill processes your personal data based on the performance of payment contracts, compliance with legal and regulatory obligations, a legitimate interest in preventing fraud and improving the service, and consent when required by law (for example, for marketing communications or non-essential cookies).

3. SHARING INFORMATION
We share your information with:

• Rebill Merchants: To confirm payments and process transactions (we do not share full card details without authorization).
• Partners and suppliers: Financial institutions, payment networks (Visa, Mastercard, etc.), anti-fraud providers, and partners for operating Rebill Services.
• Authorities: When required by law, such as in investigations or tax compliance.
• Rebill Group companies: For internal and operational purposes.
• Third Parties in Mergers or Acquisitions: If Rebill is a party to a corporate transaction.

We do not sell your personal information to third parties for marketing purposes without your consent.
‍
4. INTERNATIONAL TRANSFERS‍

Your information may be transferred to servers outside your country of residence, including Argentina, Brazil, Mexico, Chile, Uruguay, and the United States. Rebill ensures adequate levels of protection through intercompany agreements, standard contractual clauses, or other recognized mechanisms, in accordance with applicable laws (for example, in Brazil, in accordance with the LGPD).

‍5. SECURITY‍

We implement technical, administrative, and physical measures to protect your information, including encryption, firewalls, and compliance with PCI DSS. However, no system is foolproof, and we do not guarantee absolute security.

In the event of security incidents affecting personal data, Rebill will notify users, merchants, and/or authorities when required to do so by applicable regulations.

‍
‍6. YOUR RIGHTS‍

You may access, correct, update, delete, or object to the processing of your data; revoke your consent; and request data portability and restriction of processing (where applicable), in accordance with applicable laws. Contact protecciondedatos@rebill.com. In some countries, you may file complaints with authorities such as the Superintendency of Industry and Commerce in Colombia.

Requests will be forwarded to the Rebill Company in the corresponding country for processing. In Mexico, responses to ARCO requests will be provided within 20 days, and the requests will be processed within an additional 15 days. In Colombia, inquiries will be addressed within a maximum of 10 business days, and complaints within 15 business days.

‍

‍7. COOKIES AND SIMILAR TECHNOLOGIES
We use cookies to improve your experience, analyze usage, and personalize content. You can manage your preferences in your browser, but this may affect certain features.

‍

‍8. CHANGES TO THIS POLICY
We may modify this Privacy Policy. Changes will be posted at www.rebill.com and will take effect immediately. Continued use constitutes acceptance.

‍

9. CONTACT
For questions, contact protecciondedatos@rebill.com.
‍
COUNTRY-SPECIFIC PROVISIONS

Provisions applicable to Argentina
Rebill complies with Law 25,326 on the Protection of Personal Data and the provisions of the Agency for Access to Public Information (AAIP). As the data controller, we collect data for explicit and legitimate purposes. You may exercise your rights of access (free of charge every 6 months), rectification, updating, erasure, or confidentiality with the AAIP. International transfers require adequate levels of protection or your consent.

‍Applicable provisions for Brazil
Rebill complies with the General Data Protection Law (LGPD - Law 13.709/2018). We are data controllers and process information based on consent, the performance of a contract, or legitimate interest.   You may request access, correction, anonymization, portability, deletion, or revocation of consent through the National Data Protection Authority (ANPD). International transfers use standard contractual clauses or equivalent safeguards.

‍Provisions Applicable to Colombia
(The privacy provisions set forth in this section apply when you use the platform or system, or make a payment through Rebill.)

For the processing of personal data of users located in Colombia that is processed by Rebill, a company incorporated in Colombia (REBILL SAS), the following provisions shall apply, relating to acceptance of the information processing policy or privacy policy, and authorization for the processing of personal data is hereby requested:

‍Authorization for the Processing of Personal Data.
In order to comply with Law 1266 of 2008 and Law 1581 of 2012, as well as other related and complementary regulations, REBILL SAS (“Rebill” or the “Company”), with its registered office in the city of Bogotá, at Calle 99 No.  14-49, 7th Floor, Bogotá, hereby informs you that it acts as the Data Controller for your personal data and financial data collected through the platform and/or transactional channel and/or through payments made via the Rebill payment system.

Consequently, your use of the platform or system, or the making of a payment, implies that you are aware of this Privacy Policy and freely, in advance, expressly, and with full knowledge of the facts, authorize the collection, use, storage, dissemination, deletion, and any other processing activity in general for the purposes set forth in this Policy.   This authorization extends to anyone representing Rebill’s rights, anyone Rebill contracts to exercise those rights, or anyone to whom Rebill assigns its rights, obligations, or contractual position for any reason.

This authorization will remain in effect until it is revoked in accordance with the circumstances provided for by law. You may exercise your rights to access, update, correct, and delete your personal information at any time, as well as request proof of this authorization or revoke it by contacting protecciondedatos@rebill.com or the Superintendency of Industry and Commerce.

‍Applicable provisions for Chile
Rebill complies with Law 19.628 on the Protection of Privacy (as amended by Law 21.096). We are the data controller and collect data for specific purposes. You may exercise your rights of access, rectification, cancellation, and objection (ARCO) with the responsible
. International transfers require consent or appropriate safeguards.

‍Applicable provisions for Mexico
Rebill complies with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). We are the data controller.   You may exercise your ARCO rights (access, rectification, cancellation, and opposition) by contacting protecciondedatos@rebill.com or the INAI. We include comprehensive privacy notices and obtain consent for secondary purposes.