Mercado Productivo Privacy Policy

LEONARDO RAFAEL LOZANO RUIZ, RUC 0900000051001, AUTOPISTA ESTATAL E486, Daule, Guayas, Ecuador, is the sole business responsible for your personal information in every country where Mercado Productivo operates. Privacy contact: [email protected]. Privacy officer: being appointed; in the meantime, write to [email protected]. Mercado Productivo's representation in each country is in its section of the Country-specific provisions.

Information you give us:

• Account: name, username (public), account type (individual or business), phone number, email, profile photo and your statement that you are of legal age.
• Verification: the result of each verification point and, to verify your identity, the information from the ID document you show or send us.
• Locations: name, address, coordinates, business hours, payment methods and delivery options of the locations you register.
• Marketplace activity: listings, photos, conversations, deals, ratings and reports you make.
• Subscription and billing: plan, dates and the tax information needed to issue invoices. Mercado Productivo does not receive or store card numbers: in-app payments are processed by Apple or Google.
• Requests and support: what you write to us when you ask for help or exercise your rights.

Information generated when you use the service (with or without an account):

• Technical data: IP address, browser type, device and operating system, date and time of requests, access and error logs. We receive it directly and through our network and security provider (P-5).
• Usage events: which features you use (for example, "listing created"), identified by an internal code instead of your name.
• Preferences: the market and role you chose, stored on your device (P-12).
• Device location (mobile app only, single use): if you allow it, the app reads your device position once, while you are using it, to place you in your province and canton and show nearby services. That coordinate is not stored on our servers or shared, and we never access your location in the background. You can deny or withdraw the permission in your device settings and keep using Mercado Productivo by choosing your area by hand.

Information we receive from others:

• Sign-in provider: if you sign in with Google, Apple or Facebook, we receive from that provider an identifier, your name, your email and, if available, your photo, as you authorize on their screen. We do not receive your password or your contacts.
• Other users: ratings you receive, reports about you or your listings, and messages they send you.
• Sanctions: those applied by our staff under the Sanctions and Appeals Policy (Part IV of the Terms of Service).

We do not ask for sensitive information except the information from your ID document, and only if you request that verification point.

| Purpose | Basis | |---|---| | Create and maintain your account, show your profile and username | Performance of the contract (Terms) | | Listing, search, conversations, deals and ratings | Performance of the contract | | Verify your phone and identity | Performance of the contract; for ID document information, your express consent when you request it | | Moderation, fraud prevention, handling reports and applying sanctions | Legitimate interest of Mercado Productivo and other users in a safe marketplace; legal obligations | | Protect the service against attacks, abuse and automated traffic | Legitimate interest in the security of the service and its users | | Charge subscriptions and issue invoices | Performance of the contract; tax obligations | | Record which legal documents you accepted and from which IP address | Legal obligation and defense against claims | | Improve the service with usage statistics | Legitimate interest. Usage events are pseudonymized: they are identified by an internal code, never by your name, phone, email or exact location | | Produce aggregated, de-identified market statistics (for example, prices or volumes by area) and share them with third parties (P-5A) | Legitimate interest. The result cannot identify any person | | Develop new features and maintain the system, including with artificial intelligence tools (P-7B) | Legitimate interest in a service that works and improves | | Prevent an account from being deleted to evade an active sanction (encrypted fingerprint, P-9) | Legitimate interest in community safety | | Respond to your support and rights requests | Performance of the contract; legal obligation | | Send you marketing messages | Only with your express consent, which you can withdraw at any time |

We do not make decisions with legal effects about you based solely on automated processing. Automatic hiding of contact details in messages (P-7) is a safety measure and does not decide sanctions on its own.

• Public (even without an account): your username, profile photo, your listings, ratings you received and, for your locations, only an approximate area.
• The exact coordinates of your properties are never public. Only the exact address of a location you mark as public is shown.
• The other party in a conversation sees what you write, except contact details, which are hidden automatically.
• Your phone number and email are not shown to other users.
• Mercado Productivo staff access your information only as far as their role requires; access to conversations and locations is explained in P-7 and P-7A.

We do not sell your personal information and we do not share it for targeted or cross-context behavioral advertising. We share it only with:

Service providers (processors), who process information on our behalf, under contract, with confidentiality obligations and only to provide their service to us:

| Provider | Purpose | Where | |---|---|---| | TELECU Cloud (GIGAIPNET S.A.S.) | Servers and database where all service information is stored | Ecuador | | Cloudflare, Inc. | Content delivery, attack protection and security: all website and app traffic passes through it | United States and global network | | Twilio Inc. | Sending sign-in codes by text message (receives your phone number) | United States | | PostHog Inc. | Pseudonymized usage statistics (receives events with an internal code, without your name, phone, email or exact location) | United States | | RevenueCat, Inc. | Managing subscriptions bought in the apps (receives an internal identifier and the store receipt) | United States | | Artificial intelligence tool providers | Developing and maintaining the system (P-7B) | Depends on the provider |

The current list, with the specific providers and the history of changes, is in the service provider register published in the Legal Center. We update it before we start using a new provider.

Third parties that decide about your information under their own policies:

• Google, Apple and Meta (Facebook), if you choose to sign in with their account.
• Apple and Google, when you buy a subscription in their apps.
• Map providers: when a map is shown, your browser or app downloads the map images directly from a mapping provider, which receives your IP address and the area you are viewing, but not your identity.

Authorities, when a law, court order or valid legal request requires it (P-5B).

Recipients of aggregated statistics (P-5A): they only receive de-identified information.

Business transfers: if LEONARDO RAFAEL LOZANO RUIZ merges, is acquired or transfers the service, your information will pass to the new business, which must honor this Policy, and we will let you know.

We use platform data to produce statistics about the sector (for example, average prices, listed volumes or activity by area and category) that we may publish or share with industry associations, public bodies, financial institutions, researchers or other third parties.

• They are aggregated: they combine data from many people and include no names, usernames, phone numbers, emails, exact coordinates or individual listings.
• We only publish a figure when it groups a minimum number of people, so no one can work out who is behind it.
• We maintain this information in de-identified form, we do not attempt to re-identify anyone, and we contractually require recipients not to attempt it either.

We disclose information to an authority only when there is a valid legal basis (law, court order or request from a competent authority). We review each request and disclose only what is strictly required. Where the law allows, we will tell you. We may also keep or share information when necessary to prevent fraud, protect someone's physical safety or defend ourselves against a claim.

Mercado Productivo's main servers are in Ecuador (P-5). Some service providers, such as network and security, text messaging, statistics and subscriptions, operate in the United States or on global networks. If you live outside Ecuador, using the service means your information is transferred to the responsible business in Ecuador. When your information is processed outside your country, we do so with the safeguards required by applicable law (adequate level of protection, contractual clauses or another valid safeguard), and each provider is bound to protect your information to a level equivalent to this Policy.

Your conversations are private between the parties, but authorized Mercado Productivo staff can read them in these circumstances:

• When there is a report about the conversation or one of its participants.
• When there are signs of fraud, scams or other violations of the Listing and Conduct Rules (Part II of the Terms of Service).
• When a law or order of a competent authority requires it.

Each access requires a specific permission and a written reason, and is recorded in a log that no one can delete. Mercado Productivo staff cannot see the text of conversations in general lists, only when opening a specific conversation with that justification.

Authorized Mercado Productivo staff can view the locations registered on the platform —public ones, private ones and public points of interest (fairs, auctions)— to moderate listings, prevent fraud, handle reports and support requests, verify information and comply with requests from authorities.

• Staff work lists show locations without exact coordinates.
• Viewing the exact coordinates of a private location requires a specific permission granted only to those who need it, and each view is recorded in a log that no one can delete.
• None of this changes what the public sees: the exact coordinates of your properties are still never public (P-4).

We use artificial intelligence tools to develop new features and maintain the system (for example, writing and reviewing code, diagnosing failures or analyzing how the service performs). They may be third-party tools or models that run on our own infrastructure, always for this same purpose. While doing these tasks, the tool may have incidental access to service data.

• An external artificial intelligence provider acts as a service provider (P-5), under a contract that prohibits it from using your information to train its models or for any purpose of its own. A model we run on our own infrastructure does not send information to third parties.
• We do not train artificial intelligence models with your personal information.
• We do not use artificial intelligence to make decisions about you (approving listings, sanctions, identity verification).
• Changing providers for this same purpose only updates the service provider register. If we ever want to use artificial intelligence for another purpose, we will publish a new version of this Policy before doing so.

We apply technical and organizational measures: access control by country and by permission, restricted access to verification evidence and to exact location coordinates, encryption in transit, network attack protection, an immutable log of administrative actions and two-step authentication for staff. No system is infallible; if a breach affects your information, we will record it and notify you and the authorities as required by applicable law.

As a rule, we do not delete: we deactivate (for example, expired listings or suspended accounts) so we can resolve claims and show what happened, but only for the following periods:

| Information | Period | |---|---| | Active account | As long as the account exists | | Account you deleted | Immediate deletion of personal information (see below) | | Encrypted fingerprint of the phone and email of a deleted account with an active sanction | Until the sanction expires, and at most the period set for the country | | Conversations | 2 years from the last message; then deleted | | Expired or withdrawn listings | 2 years from when they stopped being active; then their photos and description are deleted | | ID document information and verification evidence | 6 months after the verification is resolved; only the result is kept | | In-app notices (the notifications inbox) | 180 days from the latest notice if you read it, 365 if you did not; then deleted | | Devices registered to receive notices, and delivery records for those notices | 90 days from when the device was deactivated (for example, when you log out) or from delivery; then deleted | | Usage events (statistics) | Up to 24 months | | Technical and security logs (IP, access, errors) | Up to 90 days, except those needed to investigate a specific incident | | IP address with which you accepted our policies | As long as the account exists | | Which version of our policies you accepted and when, reports, sanctions and the administrative log (including staff access to conversations and locations) | As long as they may be needed to handle claims or as required by law | | Billing | The period required by tax law |

When you delete your account we delete: your name, phone, email, profile photo, your locations (name, address and coordinates), the photos and descriptions of your listings, the text of your messages (the other person will see "Message deleted"), your replies to ratings, the evidence you provided for verification, the IP address with which you accepted our policies and your sign-in access. We also ask our statistics provider to delete the events associated with your internal code.

We keep, without information that identifies you:

• Ratings you gave and received: they are part of other people's reputation. They appear as from "Deleted user".
• Deals you took part in: they are also the other party's history.
• The accounting record of your subscriptions: tax obligation.
• Which version of our policies you accepted and when: proof of your consent.
• Reports, sanctions and the log of our staff's actions: needed for community safety and to respond to authorities.

If you had an active sanction, we keep an encrypted, irreversible fingerprint of your phone and email (the original cannot be rebuilt from it) only while the sanction remains active. If a new account is created with the same phone or email during that time, the sanction applies to the new account.

You have the right to:

• Access: know what information about you we process.
• Correction: correct inaccurate information. You can edit much of it yourself in your profile.
• Deletion: you can delete your account yourself from the app or the web, with immediate effect (P-9).
• Object to processing based on legitimate interest or for marketing purposes.
• Portability: receive your information in a structured, commonly used format.
• Restriction of processing and not to be subject to solely automated decisions.
• Withdraw your consent at any time, without retroactive effect.
• Not be discriminated against for exercising any of these rights.

To exercise them, write to [email protected] from your account email, or use the option in the app when available. To protect your information, we will verify that the request comes from you before answering. We will respond within the period required by the law of your country. If you are not satisfied, you can contact the data protection authority where you live. If the section for your country regulates these rights differently (for example, with other deadlines or names), that section applies.

Mercado Productivo is intended exclusively for people who meet the minimum age for their country (Country-specific provisions), which is never under 18. When you register you confirm that you meet that age. We do not knowingly create accounts for minors or knowingly collect their information; if we detect an account belonging to a minor, we deactivate it and delete their personal information.

• Our own storage: we use your browser or device storage to keep you signed in and remember preferences (for example, the market and role you chose). These preferences stay on your device, not on our servers.
• Security cookies: our network and security provider may set strictly necessary cookies to tell people apart from automated programs and protect the service against attacks. They are not used for advertising or to track you on other sites.
• Maps: when you view a map, your device connects to the mapping provider (P-5).
• We do not use third-party advertising or analytics cookies. Usage statistics are generated on our servers (P-3). If we ever use such cookies, we will say so here and ask for your consent where the law requires it.

Every version is recorded and available in the Legal Center. If a change affects how we process your information, we will ask you to accept the new version and show you a summary of what changed. Changes to the service provider register that do not change the purposes are published in that register.

For any question about this Policy or your information: [email protected]. Responsible business: LEONARDO RAFAEL LOZANO RUIZ, RUC 0900000051001, AUTOPISTA ESTATAL E486, Daule, Guayas, Ecuador.