Exercising your rights regarding your
ARCO rights.
Last updated: 10/04/2026
PAYMENTS LATAM S.A.C., domiciled in the Republic of Peru, acting as the data controller, is committed to the privacy, security, and proper protection of the personal information of its clients, representatives, suppliers, employees, job applicants, users, and other individuals whose personal data is processed by the company.
In compliance with Peruvian regulations regarding personal data protection, PAYMENTS LATAM S.A.C. makes available to data subjects the information and channels necessary to exercise their rights of Access, Rectification, Cancellation, and Opposition (ARCO), as well as any other rights applicable under the law.
The exercise of these rights is free of charge and will be addressed in accordance with the requirements and timeframes established by current regulations.
Applicable regulations on personal data protection
PAYMENTS LATAM S.A.C. processes personal data in accordance with the provisions currently in force in the Republic of Peru regarding personal data protection.
The exercise of rights regarding personal data is primarily regulated by:
- Law No. 29733, Personal Data Protection Law.
- Regulations under Law No. 29733, Personal Data Protection Law.
- Other applicable provisions, supplementary regulations, and amendments regarding personal data protection.
This regulation recognizes every person’s right to maintain control over their personal data and establishes the mechanisms for exercising the rights of access, rectification, cancellation, and opposition.
Identification of the personal data bank
To facilitate locating the information and properly addressing the request, the data subject must specify the personal data bank or the relationship they maintain or maintained with PAYMENTS LATAM S.A.C.
They may select, as applicable:
- Clients.
- Suppliers.
- Employees.
- Applicants.
- Users.
- Others.
This information will make it easier to identify personal data related to the request and expedite its processing.
This section follows the logic of the template, which requires identifying the database to facilitate locating the information.
ARCO Rights to be Exercised
Access
It allows you to know whether PAYMENTS LATAM S.A.C. processes your personal data and, if so, to access information related to such data and understand how it is used.
You can request:
- Access to your personal data contained in personal data databases owned by PAYMENTS LATAM S.A.C.
- Detailed information regarding the personal data PAYMENTS LATAM S.A.C. holds about you.
- Information on the source of your personal data.
- Information on the purposes for which your personal data is processed.
- Information regarding transfers or recipients of your personal data, where applicable.
- To have the requested information provided in a clear, legible, and understandable manner.
- To be informed as to whether or not PAYMENTS LATAM S.A.C. holds personal data relating to you.
Rectification
It allows you to request the correction, updating, or modification of your personal data when it is inaccurate, incomplete, erroneous, or outdated.
You can request:
- The rectification of your personal data held in PAYMENTS LATAM S.A.C.’s personal data databases.
- The updating of information that has become outdated.
- The correction of inaccurate or erroneous information.
- The inclusion of information necessary to complete your personal data.
- Confirmation of the rectification once it has been carried out.
- A duly substantiated response when the requested rectification is not warranted.
The request must identify the data requiring rectification and include, where applicable, documents substantiating the correct information.
This approach to outlining Access and Rectification expressly follows the model format: brief definition + “What you can request” + specific conditions.
Cancellation
It allows you to request the deletion of your personal data when it is no longer necessary or relevant for the purposes for which it was collected, when the established processing period has expired, or when appropriate under applicable regulations.
You can request:
- The cancellation of your personal data held in the personal data databases of PAYMENTS LATAM S.A.C.
- The deletion of data the processing of which is no longer necessary or relevant.
- Confirmation of the cancellation once it has been carried out.
A duly substantiated response in cases where the requested cancellation is not warranted.
Cancellation will not apply where there is a legal, contractual, or regulatory obligation, or any other ground permitted by applicable regulations, justifying the retention of personal data.
Important consideration: The cancellation of certain personal data may limit or prevent the provision of some services when such information is necessary to maintain the contractual relationship, comply with legal obligations, or carry out the corresponding service.
The template also includes this warning regarding the potential consequences of cancellation.
Opposition
It allows you to object to the processing of your personal data when there are legitimate and well-founded grounds relating to a specific personal situation, provided that applicable regulations allow for the exercise of this right.
You can request:
- To object to the processing of your personal data contained in the personal data databases of PAYMENTS LATAM S.A.C.
- To have the processing of your personal data cease with respect to one or specific purposes.
- To receive confirmation that processing has ceased when the request is well-founded.
- To receive a duly substantiated response when the requested objection is not well-founded.
The request must clearly indicate the processing to which the objection relates and, where applicable, include documentation supporting the grounds invoked.
Other rights and requests
In addition to ARCO rights, the data subject may submit requests regarding the processing of their personal data where such requests are recognized under applicable regulations.
Personal data portability: allows the data subject, where legally applicable, to obtain the personal data provided to PAYMENTS LATAM S.A.C. in a structured, commonly used, and machine-readable format, as well as to request its transmission to another data controller where applicable and technically feasible.
Withdrawal of consent: when processing is based on the data subject’s consent, the data subject may request its withdrawal in accordance with the conditions set forth in current regulations.
Inquiries, clarifications, and complaints: inquiries or requests regarding specific situations concerning personal data processing may be submitted, including potential errors, misuse of information, identity theft, or other circumstances requiring assessment.
The model also expressly distinguishes ARCO rights from other requests, including portability and specific complaints.
Request and response channels
Requests to exercise rights regarding personal data may be submitted via the channels enabled by PAYMENTS LATAM S.A.C.:
Email: Soporte@payment-latam.com
website: https://payment-latam.com/
The response will be sent to the email address or contact method specified by the data subject in their request.
To protect personal information, PAYMENTS LATAM S.A.C. may request the documentation necessary to verify the data subject’s identity or, where applicable, to prove the authority of the person acting on their behalf.
Response times
Requests will be processed within the maximum timeframes established by applicable regulations:
Response times
Maximum response time
Information
Up to 8 business days
Access
Up to 20 business days
Rectification
Up to 10 business days
Cancellation
Up to 10 business days
Opposition
Up to 10 business days
The time period shall be calculated starting from the day following the submission of the request.
When it is necessary to request additional information to address the matter, the calculation of the time period shall be subject to the rules established by current regulations.
Time periods may be extended on a single occasion when justified by circumstances and provided that such an extension is permitted under applicable legislation. The extension shall be communicated to the holder prior to the expiration of the relevant time period.
Total or partial denial of an application
When PAYMENTS LATAM S.A.C. determines that a request is not admissible—whether in whole or in part—it will notify the data subject of said decision, stating the grounds for it.
The data subject may appeal to the competent personal data protection authority using the mechanisms provided under Peruvian law, without prejudice to the right to seek judicial recourse via a *habeas data* action where applicable.
The model concludes precisely with this option to file a complaint in response to a fully or partially negative decision.
Company: PAYMENTS LATAM S.A.C.
Approved by: Harold Jeferson Sotomayor Salazar
Position: General Manager
Approval date: July 8, 2026