Legal

Tribal does not charge an Account Owner a fee for opening or maintaining an account. However, an Account Owner's participation in certain levels of products or services offered by Tribal may result in a monthly subscription fee and/or other fees. Additionally, late fees are incurred when payment is not received by the due date. Tribal has the right to modify its products, services, rates, and fees; however, it generally will not do so without giving Account Owner prior notice, except where such a change is required by Tribal's card issuers or third-party service providers or is required by law. Please see Tribal's legal agreements for additional details.

Thank you for choosing to be part of our community at Aingel Corp, doing business as Aingel and Tribal Credit (“Aingel”, “Tribal”, “we”, “us”, or “our”). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about our Policy, or our practices with regards to your personal information, please contact us at privacy@tribal.credit or at our registered office 75 E Santa Clara Street, Floor 6, San Jose, CA 95113, USA.

When you visit our websites (e.g., https://www.aingel.ai or https://www.tribal.credit), and use our services, you trust us with your personal information. We take your privacy very seriously. In this privacy notice, we describe our Privacy Policy. We seek to explain to you in the clearest way possible what information we collect, how we use it, and what rights you have in relation to it. We hope you take some time to read through it carefully, as it is important. This Privacy Policy applies to all information collected through our websites (such as https://www.aingel.ai and https://www.tribal.credit), and/or any related services, sales, marketing or events (we refer to them collectively in this Privacy Policy as the "Sites").

If there are any terms in this Privacy Policy that you do not agree with, please discontinue use of our Sites and our services.

PLEASE READ THIS PRIVACY POLICY CAREFULLY AS IT WILL HELP YOU MAKE INFORMED DECISIONS ABOUT SHARING YOUR PERSONAL INFORMATION WITH US.

1. DEFINITIONS

Address (email): privacy@tribal.credit

Address (physical): Tribal Credit, 75 E Santa Clara St., Floor 6, San Jose, CA 95113 USA 

Anonymization: use of reasonable technical means available at the time of processing, by which the data loses the possibility of direct or indirect association with an individual.

Anonymized data: data related to a Holder that cannot be identified, considering the use of reasonable technical means available at the time of processing.

Authorization: Prior, express, and informed consent of the Holder to carry out the processing of personal data.

Blocking: temporary suspension of any treatment operation, keeping personal data or the database.

Communication or transmission of data: disclose in any way the personal data to persons other than the Holder, whether determined or indeterminate.

Consent: free, informed, and unequivocal expression by which the Holder accepts the processing of their personal data for a specific purpose.

Data: facts, statistics, details, and information provided or collected or learned about something or someone for reference or use or storage or analysis

Data blocking: the temporary suspension of any stored data processing operation.

Data dissociation procedure: all processing of personal data in such a way that the data obtained cannot be associated with a specific or determinable person.

Data modification: any change in the content of the data stored in records or databases.

Data sharing: communication, dissemination, international transfer, interconnection of personal data or shared treatment of personal data banks by public bodies and entities in compliance with their legal powers, or between them and private entities, reciprocally, with express authorization, for one or more treatment modalities allowed by these public entities, or between private entities.

Database custodian: Natural person, within Tribal, who guards the personal databases.

Database: structured set of data, including personal data, established in one or more places, on electronic or physical support.

Elimination: elimination of data or data sets stored in a database, regardless of the procedure used.

Expired data: which has become out of date by provision of the law, due to the fulfillment of the condition or the expiration of the period indicated for its validity or, if there is no express rule, due to the change in the facts or circumstances indicated.

Habeas data: It is the right of the Holder of the personal data to demand from the database custodian access, inclusion, exclusion, correction, addition, updating and rectification of the data, as well as the limitation in its disclosure, publication, or transfer.

Holder: The person who owns the personal data that is subject to treatment.

Impact report on the protection of personal data: documentation of the database custodian that contains the description of the personal data processing processes that may generate risks to civil liberties and fundamental rights, as well as measures, safeguards, and risk mitigation mechanisms.

International data transfer: transfer of personal data to a foreign country or international organization of which the country is a member.

Legislation: European Union’s (EU) General Data Protection Regulation, Canada Personal Information Protection and Electronic Documents Act (PIPEDA), US Electronic Communications Privacy Act (ECPA), California Civil Code Section 1798.83, also known as the “Shine The Light” law, or the California Consumer Privacy Act of 2018, Colombian regulation, Law 1581 of 2012, Decree 1074 of 2015, Law 962 2005 and Law 1480 from 2011, Brazilian Regulation, Law 13,709 in relation to Law 13,853, Chilean Regulation, Law 19628, Peruvian Regulation, Law 29733 and Law 27444. Federal Law on Protection of Personal Data Held by Individuals and its Regulations (MEXICO)

Operator: a person, under public or private law, who processes personal data on behalf of the person responsible for the treatment.

Owner of personal data: Natural person whose data is subject to treatment (Holders). In the context of this Policy, the Holders may be: (i) Customers; (ii) Suppliers; and (iii) all those persons not related to Tribal whose personal data is processed.

Person: a natural person or legal person.

Person in charge of the treatment: Person of a public or private nature that by itself or in association with others, carries out the processing of personal data on behalf of the database custodian.

Personal data: Any data concerning or linked to specific or determinable natural persons.

Personal database: Organized set of personal data that are subject to treatment by a person.

Privacy notice: Verbal or written communication addressed to the Holders of the personal data that are being processed by a company, in which they are informed about the existence of the personal data treatment policies that will be applied to them, the form of access them, and the purposes for which the Holders personal data will be used.

Private data: It is that personal data that, due to its intimate or reserved nature, is relevant for the Holder.

Public data: Personal data classified as such according to the Constitution and/or the law, and that has not been classified as private or semi-private personal data.

Research body: body or entity of direct or indirect public administration or non-profit private law legal person, legally constituted under Brazilian law, with headquarters and jurisdiction in the country, which includes in its institutional mission or in its corporate purpose or basic or applied regulatory research of a historical, scientific, technological, or statistical nature; and (Wording given by Law No. 13,853, of 2019)

Responsible for the treatment: Person of a public or private nature that by itself or in association with another or others decides on the processing of personal data. In this case, Tribal will be responsible for the treatment.

Semi-private data: It is that personal data known and of interest both for the Holder and for a certain sector of person or for society in general, so it is not of an intimate, reserved, or public nature.

Sensitive data: Personal data that affects the privacy of the Holder and whose incorrect use could generate discrimination. Sensitive data, among others, are considered health data, data on sexual orientation, racial and ethnic origin, political opinions, religious, philosophical, or moral convictions.

Sources accessible to the public: records, or compilations of personal data, public or private, with unrestricted access or reserved for applicants.

Statistical data: the data that, in its origin, or because of its treatment, cannot be associated with an identified or identifiable owner.

Transfer: The transfer of personal data takes place when the database custodian and / or person in charge of the treatment of personal data sends the data or personal data to a recipient, who in turn is responsible for the treatment and is inside or outside the country.

Transmission: Processing of personal data that implies communication to a third party, within or outside the territory of the country, when said communication is intended to carry out a treatment by the person in charge on behalf of and on behalf of the database custodian, for fulfill the purposes of the latter.

Treatment: Any operation or set of operations on personal data, such as the collection, storage, use, circulation, or deletion.

Ways to collect personal data: Tribal may know, collect, store, manage the data of the Holder of the data in accordance with the data use policy contained herein through the following means: 

(i) mobile application; (ii) website or mobile application (iii) contract, alliance and / or agreement with Tribal and (iv) Tribal's Provider.

2. PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA OF DATA PROTECTION

As established in legislation, the protection of personal data will be governed by the harmonious and comprehensive application of the following principles:

• Principle of legality in the processing of personal data: The processing of personal data referred to in legislation is a regulated activity that must be subject to what is established therein and the other provisions that develop it.
• Principle of adequacy: compatibility of the treatment with the purposes informed to the owner, according to the context of the treatment.
• Principle of necessity: limitation of the treatment to the minimum necessary for the achievement of its purposes, with the scope of the pertinent, proportional, and not excessive data in relation to the purposes of the data processing.
• Principle of prevention: adoption of measures to prevent the occurrence of damages due to the processing of personal data.
• Principle of non-discrimination: impossibility of carrying out the treatment for discriminatory illicit or abusive purposes.
• Principle of accountability: demonstration, by the agent, of the adoption of effective measures capable of proving the observance and compliance with the personal data protection regulations, and even the effectiveness of these measures.
• Principle of purpose: The processing of personal data must obey a legitimate purpose in accordance with the Constitution and the law, which must be informed to the Holder.
• Principle of freedom: The processing of personal data can only be exercised with the prior, express, and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent.
• Principle of truthfulness or quality: The data subject to treatment must be truthful, complete, exact, updated, verifiable and understandable. Processing of partial, incomplete, fractional, or misleading data is prohibited.
• Principle of transparency: In the Processing of personal data, the right of the Holder to obtain from the person responsible for the treatment or the Person in charge of the treatment, at any time and without restrictions, information about the existence of data that concerns him must be guaranteed.
• Security principle: The data subject to treatment by the person in charge of the Treatment or Person in charge of the treatment referred to in legislation, must be managed with the technical, human, and administrative measures that are necessary to provide security to the records avoiding its adulteration, loss, consultation, use or unauthorized or fraudulent access.
• Principle of confidentiality: All persons who intervene in the processing of personal data that are not public in nature are obliged to guarantee the reservation of the data, even after the end of their relationship with any of the tasks that comprise the treatment, being able only carry out supply or communication of personal data when this corresponds to the development of the activities authorized in legislation and in the terms of the same.
• Principle of access and restricted circulation: The treatment is subject to the limits that derive from the nature of the personal data, the provisions of legislation and the Constitution. In this sense, the treatment can only be done by persons authorized by the Holder and / or by the persons provided for in the law.
• Principle of proportionality: All processing of personal data must be adequate, relevant, and not excessive for the purpose for which they were collected.
• Principle of adequate level of protection: For the cross-border flow of personal data, a sufficient level of protection must be guaranteed for the personal data to be processed or, at least, comparable to that provided by Law or by international standards on the matter.

3. HOW WE COLLECT THE DATA

The personal data we collect depends on the context of your interactions with us and our Sites, the choices you make, and the products and features you use. 

The personal data we collect may include the following:

By automatically storing the data of the users who access the Tribal platform using cookies. Some of the data that can be stored automatically are the URL, the browser used, IP address among others.

• By exchanging emails.
• Through access to Tribal’s web pages.
• Through access to the mobile application, creating the username and password.
• Through telephone calls.
• Through events held by Tribal.
• Through the transmission or transfer by strategic allies.
• Through forms.
• Through service offers.
• Through the cooperation contract.
• Through the service provision contract.
• Through service portfolios.
• Through meetings, regardless of the medium used (in person, video conference, telephone, etc.).

4. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information when you visit our Sites, that you provide to us through forms, or when you communicate with us.

The personal information that we collect depends on the context of your interactions with us and our Sites, the choices you make, and the products and features you use. The personal information we collect can include the following:

Data automatically collected 

In Short: Some data – such as IP address and/or browser and device characteristics – is collected automatically when you visit our Sites.

We automatically collect certain data when you visit, use, or navigate our Sites. This data does not reveal your specific identity (like your name or contact data) but may include device and usage data, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, data about how and when you use our Sites and other technical data. In some countries and/or regions, this data is considered personal data under applicable data protection and/or privacy laws or regulations. Like many businesses, we also collect data about how your device has interacted with our Sites, including the pages and products and services accessed, time spent on Sites, and links clicked through cookies and similar technologies. This data is primarily needed to maintain the security and operation of our Sites, your account security, anti-fraud measures, and for our internal analytics and reporting purposes.

 Data collected from other sources 

In Short:  We may collect data from public databases, marketing partners, social media platforms, and other outside sources to the extent permitted by applicable laws.   

We may obtain data about you from other legally permissible sources, such as public databases, governmental databases, joint marketing partners, social media platforms, as well as from other third parties. Examples of the data we receive from other sources include: profile data (your name, gender, birthday, email, current city, state and/or country, user identification numbers for your contacts, profile pictures, URL, employer, employer’s address, employment title, employment contact data, social media followers, business’ size and status, and any other data that you choose to make public or accessible); marketing leads, search results, and links, including paid listings (such as sponsored links).  

5. HOW DO WE USE YOUR DATA?  

In Short: The legal bases for using your data are legitimate business interests, the fulfillment of a contract with you, compliance with our legal obligations, and/or your consent.

We use data collected via our Sites or from outside sources for a variety of business purposes that are legally permissible as described below. We process your data for the following purposes — our legitimate business interests, in order to enter into or perform a contract with you, with your consent, and/or for compliance with our legal obligations. We indicate the specific processing grounds we rely on for each purpose listed below.  

We use the data we collect or receive to:  

The personal data that Tribal collects are included in a database to which the authorized personnel of Tribal have access in the exercise of their functions, noting that in no case is the processing of the data authorized for purposes other than those described herein, and they are communicated to the Holder directly at the latest at the time of collection.

Principal purposes of treatment

• Facilitate account creation and logon processes. If you choose to link your third-party account (such as your LinkedIn or SAT account), we use the data you allowed us to collect from those third parties to facilitate and/or expedite account creation and logon processes. See Section 6. HOW WE HANDLE YOUR THIRD-PARTY ACCOUNT LOGINS below for further details.
• Send marketing and promotional communications. We and/or our third-party marketing partners may use the data you give to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt-out of our marketing emails at any time.
• Send administrative information. We may use your data to send you product, service, and new feature information and/or information about changes to our terms, conditions, and policies.
• Fulfill and manage requests. We may use your data to fulfill and manage your requests, payments, returns, and exchanges made through our Sites.
• Post testimonials. We post testimonials on our Sites that may contain your data. Prior to posting a testimonial, we will obtain your consent to use your data. If you wish to update or delete your testimonial, please contact us at privacy@tribal.credit and be sure to include your name, testimonial location, and contact information.
• Deliver targeted advertising. We may use your data to develop and display content and advertising (and work with third parties who do so) tailored to your interests and/or location and to measure its effectiveness.
• Request feedback. We may use your data to request feedback and to contact you about your use of our Sites.
• Protect our Sites. We may use your data as part of our efforts to keep our Sites safe and secure (e.g., for fraud monitoring and fraud prevention).
• Enforce our agreements, contracts, terms, conditions, and policies.
• Respond to legal requests and prevent harm. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.
• Fulfill other business purposes. We may use your data for other business purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns, and to evaluate and improve our Sites, products, services, marketing, and user experience.

Secondary purpose of treatment:

• Collect or collect personal data and incorporate and store them in our database.
• Sort, catalog, classify, divide, or separate the data provided.
• Use the data provided in communication, disclosure and promotion campaigns or offer of products, activities and / or services developed as part of Tribal's internal strategies.
• Maintained in historical records of Tribal and maintain contact with the Holders.
• Verify or validate the data provided.
• Study and analyze the data provided to monitor and improve products, service, and care.
• Deliver the data collected to third parties with whom Tribal contracts the storage and / or administration of personal data, under the security and confidentiality standards to which Tribal is bound according to what is contained in the pertinent laws.
• Transfer personal data to any country or server in another country.
• Communicate and allow access to personal data provided to third party providers of general support services and to natural or legal persons shareholders of Tribal.
• Collect, have, manage, and use the data to control and prevent fraud, control, and prevent money laundering and financing of terrorism.
• Realization, execution, and management of business proposals and contracts for the services provided.
• Sending communications through any channel including, but not limited to, social networks, text messages, push notifications, email, phone call, etc., related to Tribal's corporate purpose such as marketing activities and / or any request made by the owner to Tribal, among others.
• Provide the services offered and / or contracted adequately and with excellent quality.
• Creation and administration of the customer’s account.
• Provide the maintenance, development and / or control of the commercial relationship between the user and Tribal.
• Provide users with the necessary information, through the website and / or mobile application, on the products of the bidders, to formalize the relationship of consumption of said products.
• Carry out processes within Tribal, for operational development and / or systems administration purposes.
• Provide the services of Tribal and carry out follow-up according to the needs of the customer, to provide the appropriate services and products to cover their specific needs.
• Keep a historical record of the data, for the purposes of user satisfaction, developing analysis of interests and needs; thus, providing better service.
• Carry out market strategies by studying user behavior towards offers and thereby improve content, personalizing presentations and services.
• Preparation of commercial prospects and market segmentation.
• Carry out satisfaction surveys and offer or recognition of benefits inherent to our loyalty program and after-sales service, to rate the service and attention through the channels provided for it.
• Carry out the activities necessary to manage the requests, complaints and claims of the users of the customer or third parties; and direct them to the areas responsible for issuing the corresponding responses.
• Present reports to the authorities and process the requirements made by administrative or judicial entities.
• Accounting, economic, tax and administrative management of customers.
• Conservation of data by the terms established in the Law.
• Transfer or transmission of personal data nationally or internationally to third parties with whom Tribal develops activities in compliance with its corporate purpose. Likewise, transmission or transfer may be made to Tribal’s strategic allies to carry out marketing, advertising and promotional activities associated with the corporate purpose.
• Send data to the data processors to facilitate and improve the quality of Tribal's products and services.
• Request the authorization of collection from the entities defined and authorized to do so.
• Transfer and transmit your personal data to third-party commercial partners of Tribal that offer their products and services on the Tribal Platform to make efficient contact between the Holder and the commercial partner, in the terms of the legislation.
• Access and consult your personal data in the credit and financial data centers, collect relevant data on credit behavior, and preserve, store, and use personal data to send commercial and advertising guidelines, and to contact in relation to matters of the Tribal business activity. It is clarified that this purpose corresponds to those users who expressly accept the financial services offered.
• Request or carry out consultancies, audits, or related services.
• Comply with the internal processes of Tribal in matters of administration.
• Advance processes within Tribal, for operational development and / or systems administration purposes.
• Make tax declarations or management of tax and collection data.
• Carry out, in accordance with the law, reports to credit bureaus for non-compliance with financial obligations derived from the business relationships.
• Carry out operations and procedures related to the generation and payment of invoices, issuance of certifications, accounting, etc.
• Compliance with legal duties and obligations.

For other purposes or treatment, prior, express, and informed authorization will be requested from the Holder.

6. WILL YOUR DATA BE SHARED WITH ANYONE?  

In Short:  We only share data with your consent, to comply with laws and legal obligations, to protect your rights, or to fulfill contracts and other business obligations.   

We may process or share data based on the following legal bases:

• Consent: We may process your data if you have given us consent to use your data in a specific purpose.

• Legitimate business interests: We may process your data when it is reasonably necessary to achieve our legitimate business interests. 

• Performance of a contract: Where we have entered into a contract with you, we may process your data to fulfill the terms of that contract. 

• Legal obligations: We may disclose your data where we are legally required to do so in order to comply with applicable law, governmental requests, regulatory requests, a judicial proceeding, court order, or other legal processes, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements). 

• Anonymized: We may disclose your data if it is anonymized. Meaning subjecting it to a procedure whereby personal data is decoupled from the data subject rendering the data shared incapable of being used or combined to identify the data subject.

• Vital interests: We may disclose your data where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our agreements, contracts, policies, applicable laws and rules and regulations, suspected fraud, situations involving potential threats to the health or safety of any person, illegal activities, or as evidence in litigation in which we are involved.

We may also need to process and/or share your data in the following situations:   

• Vendors, consultants, and other third-party service providers. We may share your data with vendors, third-party service providers, contractors, or agents who perform services for us or on our behalf and require access to such data to do that work. Examples include account onboarding, identity verification, legal requirements and legal obligations, payment processing, data analysis, email delivery, hosting services, customer service, and marketing efforts. We may allow selected third parties to use tracking technology on the Sites, which will enable them to collect data about how you access and interact with the Sites over time. This data may be used to, among other things, analyze and track data, fraud prevention, determine the popularity of certain content, or better understand online activity. Unless described in this Policy, we do not share, sell, rent, or trade any of your data with third parties for their promotional purposes.    
• Business transfers. We may share or transfer your data in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Business partners. We may share your data with our business partners in order to offer you certain products, services, or promotions.

Tribal may share the information of the personal data with those third parties that are necessary for the development of its activities and corporate purpose, always protecting the rights and data of the data owner. The transmission or transfer of personal data that is carried out will observe the rules that the applicable regulations and the supervisory authority provide for this purpose.

In the case of national transmissions or transfers of personal data, Tribal will ensure compliance with the requirements of current data protection legislation and protection measures by the person in charge or new controller.

If it is an international transfer, we make sure that the country that receives the personal data provides adequate levels of protection.

When the receiving country does not comply with the appropriate data protection standards, the transmission or transfer will be prohibited unless one of the following legal exceptions is configured:

• That the Holder has given express and unequivocal authorization for the transfer or transmission of data.
• Exchange of medical data when required by the Holder's treatment for health and public hygiene reasons.
• Bank or stock transfers, in accordance with the applicable legislation.
• Transfers agreed in the framework of international treaties to which Colombia is a party, based on the principle of reciprocity.
• Transfers necessary for the execution of a contract between the Holder and the person responsible for the treatment, or the execution of pre-contractual measures if there is authorization from the Holder.

Please note that our servers are in the US, so maybe they are located outside of the country in which we collected the data. This means that your personal data may be transferred to and processed in countries other than the country in which you reside. Data protection laws may be different in these countries than in your own country and, in some cases, may be less protective. Please be assured that we take appropriate steps to ensure that your personal data is protected in accordance with this Policy.

7. WITH WHOM WILL YOUR DATA BE SHARED?  

In Short: We only share data with the following categories of recipients:

• Our own group of companies, third-party service providers, product content providers, and partners;
• Law enforcement bodies, regulators, governmental agencies, courts and tribunals, legal proceedings, or other regulatory or governmental entities with relevant powers; and
• Any other third parties in which you have provided specific consent.

8. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?  

In Short: We may use cookies and other tracking technologies to collect and store your data.  

We may use cookies and similar tracking technologies (like web beacons and pixels) to access or store data. Cookies are small text files that are stored on your browser or device by websites, apps, online media, and advertisements that are used to remember your browser and/or device during and across website visits. Cookies are widely used by website owners to make their websites more efficient, as well as to provide reporting data. Pixels, which are also called web beacons, are small blocks of code installed on, or called by, a web page, app, or advertisement which can retrieve certain data about your device and browser, including the device type, operating system, browser type and version, website visited, time of visit, referring website, IP address, advertising identifiers, location, and other similar data that uniquely identifies your device. Pixels enable the ability to recognize when someone has visited a website or opened an email and allows monitoring the traffic patterns of users within websites, delivery or communication with cookies, determining whether a user has come to a website from an online advertisement displayed on a third-party website, to improve website performance, to measure the success of email marketing campaigns, and to set and read browser cookies from third-party domains and collect data about visitors to that domain, typically with the permission of the domain owner. 

Can you control cookies?

In Short: Yes, in certain jurisdictions, such as Mexico, the EU, and California, data subjects may have the right to choose whether or not to accept cookies and/or pixels. Cookies and pixels may be an important part of how our Sites work. You should be aware that if you choose to refuse or remove cookies and/or pixels, this could affect your ability to access and use our Sites.

Most web browsers are configured to accept cookies and/or pixels by default. You can generally configure your browser to remove or reject browser cookies and/or pixels. If interested, follow the instructions provided by your browser, which are usually located in the “help” or “preferences” menu. Some third parties also provide the ability to refuse their cookies and/or pixels directly by clicking on an opt-out link.

Please be aware that removing or rejecting browser cookies or pixels does not necessarily affect third-party cookies or pixels. For more information about cookies, including how to see which cookies have been set on your device and how to manage or delete them, visit https://youronlinechoices.com/, or https://www.youronlinechoices.eu for EU visitors.

For mobile users, your device’s operating system provides controls that enable you to choose whether or not to allow cookies or share your unique identifier with companies like us or our third-party providers. For information on controlling your mobile choices, visit https://www.networkadvertising.org/mobile-choices.

To help control or block certain ads in mobile applications, you can download and utilize the DAA mobile app, which is available at https://youronlinechoices.com/appchoices. 

In addition, many advertising networks offer you a way to opt out of targeted advertising. If you would like to find out more information, visit http://www.aboutads.info/choices/.

Can you control Do-Not-Track features?

In Short: Yes, most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (DNT) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected.

No uniform technology standard for recognizing and implementing DNT signals has been finalized, however. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Policy.

9. HOW DO WE HANDLE YOUR THIRD-PARTY ACCOUNT LOGINS?  

In Short:  If you choose to share access to your social media accounts and/or other third-party accounts, we may have access to certain data about you.  

Our Sites may offer you the ability to share access to your third-party social media account details (like your Facebook or LinkedIn logins) and/or other third-party accounts (like your SAT CIEC or FIEL (e.firma) login or Shopify login). Where you choose to do this, the providers will send us certain profile data about you, not access into your account. The profile data we receive will vary depending on the provider, but will often include your name, date of birth, email address, friends list, profile picture, as well as other data you choose to make public and/or is contained within that account.

We will use the data we receive only for the purposes that are described in this Policy or that are otherwise made clear to you on our Sites. Please note that we do not control, and are not responsible for, other uses of your data by your third-party social media providers or other third-party accounts. We recommend that you review their respective privacy policy to understand how they collect, use and share your data, and how you can set your privacy preferences on their sites and apps.        

10. HOW LONG AND WHERE DO WE KEEP YOUR DATA?  

In Short:  We only keep your data, which are stored on servers located in the United States, for as long as necessary to fulfill the purposes outlined in this Privacy Policy. Our retention requirements vary, depending on jurisdictional requirements.  

We will only keep your data for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). 

When we have no ongoing legal requirements or legitimate business need to process your data, we will either delete or anonymize it, or, if this is not possible (for example, because your data has been stored in backup archives), then we will securely store your data and isolate it from any further processing until deletion is possible.

Our servers are in the USA, which may be located outside the country in which we collected the data. Our group companies, third-party service providers, and partners, with whom we may share your data as outlined in this Policy, are located in and transfer data to various jurisdictions around the world. This means that your data may be transferred and processed in countries other than the country in which you reside. The data protection laws may be different in these countries versus your own country and, in some cases, may be less protective. Be assured, we take appropriate measures to ensure that your data is protected in accordance with this Policy.

For further information about retention time periods or international data transfers, contact us at privacy@tribal.credit.

11. HOW DO WE KEEP YOUR DATA SAFE?   

In Short:  We aim to protect your data through a system of organizational and technical security measures.  

We have implemented appropriate technical and organizational security measures designed to protect the security of any data we collect and process, which are designed to provide a level of security appropriate to the level of risk presented; however, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your data, transmission of data to and from our Sites is at your own risk. You should only access our Sites within a secure environment. 

12. DO WE COLLECT DATA FROM MINORS?  

In Short:  We do not knowingly collect data from or market to individuals under 18 years of age.  

We do not knowingly solicit data from, or market to, individuals under 18 years of age. By using our Sites, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to you minor’s use of the Sites. If we learn that data from users less than 18 years of age has been collected without authorization from the parent or guardian, we will deactivate the minor’s access and take reasonable measures to promptly delete such data from our records. If you become aware of any data we have collected from individuals under age 18, please contact us at privacy@tribal.credit.  

13. WHAT ARE YOUR DATA PRIVACY & PROTECTION RIGHTS?  

In Short:  Depending on your domicile, you may have certain data rights to learn more about your rights or to exercise any of your rights please be so kind as to consult the information referred to in sections 14 to 21 or contact our Privacy team through the comunications methods provided in Section 23.

In certain locations you may be a data subject and have some of the following data rights, which can be exercised through the comunications methods provided in Section 23:

• Right of access. You may have the right to access and receive copies of your data we hold and receive details about how and why we use your data. 
• Right to request proof of the authorization granted for the treatment. You may request the person in charge to allow you to know about the record where the consent you granted for the processing of your personal data is recorded.
• Right of portability. You may have a right to obtain your data for your own purposes, including so that you can provide or “port” that data elsewhere.
• Right of erasure. You may have the right to request us to delete the data we hold about you. We may also pass your requests on to other third parties to which we have shared your data. 
• Right to exercise your rights without discrimination. You may have the right to exercise these rights without being discriminated against.
• Right to file a complaint. You may have the right to complain to your applicable data protection authority about our collection and use of your data.
• Right to not participate.  If you do not agree with us collecting your data, you can inform us of your choice not to participate.
• Right to opt-out and/or revoke. You may have the right to revoke your consent to us collecting and/or processing your data and/or stop marketing communications and/or opt-out of participating and receiving future marketing communications, even if our reasons are based on legitimate business interests. You may also have the right to opt out of other processing activities. For email marketing communications, where applicable, click on the “unsubscribe” link found in those emails. To opt-out of other activities, you may note your preferences when going through the registration process or by accessing your account and updating your preferences.
• Right to correct. You may have the right to have us correct any inaccurate or incomplete personal data.
• Right to restrict. In certain circumstances you may be able to request that we restrict collecting and/or processing your data. Contact us to learn more about the circumstances in which this right exists at privacy@tribal.credit.
• Right to appoint others. Certain locations permit you to appoint someone else to act on your behalf. Typically, this is done through a document such as a power of attorney. If your domicile allows this, please understand that we will require this appointed person to provide proof of such appointment, which may include you verifying your identity directly with us and/or our third-party identity verification partner.
• Right to confidentiality. You have the right to have your personal data protected in a manner appropriate to its degree of confidentiality.
• Right to anonymization, blocking or deletion of unnecessary, excessive, or processed data in contravention of the provisions of the Legislation.
• Right to be obtained from the person responsible for the treatment, in relation to the data of the owner processed by him, at any time and upon request, the confirmation of the existence of treatment.

Updating or editing account data or closing an account

You can review or change the data pertaining to you in your account by logging into your account and updating your user data. 

If you close your account with us, we will deactivate your account and certain data from our active databases; however, some data will be retained in our systems to prevent fraud, troubleshoot problems, assist with any investigations, enforce our contracts and agreements and policies and procedures, and/or comply with legal requirements.        

14. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?  

In Short:  Yes, if you are a resident of California, you are granted specific rights regarding access to your personal data.   

California Civil Code Section 1798.83, also known as the “Shine The Light” law, or the California Consumer Privacy Act of 2018 (SB-1121), may permit our customers who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal data (if any) we disclosed to third-parties for direct marketing purposes and the names and addresses of all third-parties with which we shared such personal data in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided. 

If you are under 18 years of age, reside in California, and have a user account with our Sites, you may have the right to request removal of unwanted data. To request removal of such data, please contact us using the comunications methods provided in Section and include the email address associated with your account and a statement that you reside in California. We will make sure your data is not publicly displayed on our Sites, but please be aware that your data may not be completely or comprehensively removed from our systems due to legal and/or other requirements.

‍

15. DO MEXICAN RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short:  Yes, if you are a resident of Mexico, you are granted specific rights regarding access to your personal data.   

Mexico’s Regulations to the Federal Law on the Protection of Personal Data Held by Private Parties sets forth the rights of Mexican residents regarding their personal data held by private parties such as Tribal. To understand your rights, please review the Regulations via the hyperlink above. If you wish to assert any of your personal data rights, please contact our privacy team through the comunications methods provided in Section 23.

At any time, you can exercise the rights enumerated therein (your ARCO rights) by sending such a request through the comunications methods provided in Section 23. Your request must contain (i) your full name (given, middle, and surname(s)) and contact information (email address, phone number, and/or residential address), (ii) documentary evidence that proves your identity (or we may require you to verify your identity with our third-party identity verification partner), or the items outlined in the second to last bullet point of Section 13 Right to appoint others, (iii) a clear description of the right(s) you wish to exercise, (iv) any other evidence or details that support your request, and (v) if you’re seeking the Right to correct, evidence that supports your request.

16. DO EU RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short:  Yes, if you are a resident of the EU, you are granted specific rights regarding access to your personal data.   

The European Commission’s General Data Protection Regulation (GDPR) sets forth the rights of EU residents regarding their personal data held by others, such as Tribal. To understand your rights, please review the information provided via the hyperlink above. If you wish to assert any of your personal data rights, please contact our privacy team through the comunications methods provided in Section 23.

17. DO CANADIAN RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes, if you are a resident of Canada, you are granted specific rights regarding access to your personal data.  

The Personal Information Protection and Electronic Documents Act (PIPEDA) sets forth the rights of Canadian residents regarding their personal data held by private parties such as Tribal. To understand your rights, please review the Regulations in this link  https://laws-lois.justice.gc.ca/eng/acts/P-8.6/. If you wish to assert any of your personal data rights, please contact our privacy team through the comunications methods provided in Section 23.

18. DO COLOMBIAN RESIDENTS HAVE SPECIFIC DATA RIGHTS?

In Short: Yes, if you are a resident of Colombia, you are granted specific rights regarding access to your personal data.  

Colombian regulation, Law 1581 of 2012, Decree 1074 of 2015, Law 962 2005 and Law 1480 from 2011 sets forth the rights of Colombian residents regarding their personal data held by private parties such as Tribal. To understand your rights, please review the Regulations in this link  https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=49981.

If you wish to assert any of your personal data rights, please contact our privacy team through the comunications methods provided in Section 23.

19. DO BRAZIL RESIDENTS HAVE SPECIFIC DATA RIGHTS?

In Short: Yes, if you are a resident of Brazil, you are granted specific rights regarding access to your personal data.  

Brazilian regulation, Law 1581 of 2012, Decree 1074 of 2015, Law 962 2005 and Law 1480 from 2011 sets forth the rights of Brazilian residents regarding their personal data held by private parties such as Tribal. To understand your rights, please review the Regulations in this link  http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709compilado.htm

If you wish to assert any of your personal data rights, please contact our privacy team through the comunications methods provided in Section 23.

20. DO CHILEAN RESIDENTS HAVE SPECIFIC DATA RIGHTS?

In Short: Yes, if you are a resident of Chile, you are granted specific rights regarding access to your personal data.  

Chilean regulation, Law 19628 sets forth the rights of Chilean residents regarding their personal data held by private parties such as Tribal. To understand your rights, please review the Regulations in this link https://www.bcn.cl/leychile/navegar?idNorma=141599

If you wish to assert any of your personal data rights, please contact our privacy team through the comunications methods provided in Section 23.

21. DO PERUVIAN RESIDENTS HAVE SPECIFIC DATA RIGHTS?

In Short: Yes, if you are a resident of Peru, you are granted specific rights regarding access to your personal data.  

Peruvian regulation, Law 29733 and Law 27444 sets forth the rights of Peruvian  residents regarding their personal data held by private parties such as Tribal. To understand your rights, please review the Regulations in this link https://www.minjus.gob.pe/wp-content/uploads/2013/04/LEY-29733.pdf and http://www.pcm.gob.pe/wp-content/uploads/2013/09/Ley-de-Procedimiento-Administrativo-de-PersonalLey27444.pdf

If you wish to assert any of your personal data rights, please contact our privacy team through the comunications methods provided in Section 23.

22. DO WE MAKE UPDATES OR MODIFICATE TO THIS POLICY?  

In Short: Yes, we update this Policy as necessary to stay compliant with relevant laws.  

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated “Revised” date and the updated version will be effective as soon as it is accessible. If we make material changes to this Privacy Policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your information. 

Also, Tribal has the right to modify this Privacy Policy. In case of making modifications to this Privacy Policy, we will inform you by email if we have your email address. 

23. HOW CAN YOU CONTACT US ABOUT THIS POLICY?  

Regarding the exercise of your personal data protection rights as Holder (their successors, legal representatives and / or proxies (collectively referred to as the “Holder”) Tribal will enable access channels for the Holders. 

All communications, queries, complaints and / or claims must be directed to Tribal by any of the following means:

Electronic attention: The Holder may make a request to the following email: privacy@tribal.credit.

Written attention: The Holder may make a request to the following address of our registered office at: 75 E Santa Clara Street, Floor 6, San Jose, CA 95113, USA.

If you have questions or comments about this Policy, you may contact our Chief Legal Officer, Mark Graves, who is the head of our Privacy team by email to the address already provided.

24. DO WE TREAT SENSITIVE PERSONAL DATA?

Tribal will not collect, store, or process sensitive data, unless strictly necessary. If such a situation arises, it will not carry out any treatment without the due prior, informed and express authorization of the Holder of the information, and only in the following cases:

When the owner or his legal guardian consents, specifically and prominently, for specific purposes.

Without giving the consent of the owner, in cases where it is essential:

1. compliance with a legal or regulatory obligation by the data controller.
2. shared treatment of the data necessary for the execution, by the public administration, of the public policies established in the laws or regulations.
3. carry out studies by a research body, ensuring, whenever possible, the anonymity of sensitive personal data.
4. regular exercise of rights, including in contracts and in judicial, administrative and arbitration processes.
5. protection of the life or physical safety of the owner or a third party.
6. health protection, exclusively, in a procedure performed by health professionals, health services or health authorities.
7. guarantee of fraud prevention and security of the Holder, in the processes of identification and authentication of the record in electronic systems, safeguarding the rights referred to in the Legislation and except in the case in which the fundamental rights and freedoms of the Holder prevail. require the protection of personal data.
8. When the treatment is necessary to safeguard the vital interest of the Holder and he is physically or legally incapacitated.
9. When an anonymization or disassociation procedure has been applied.
10. When there is a norm for the promotion of competition in regulated markets issued in the exercise of the normative function by the regulatory bodies referred to in Peruvian Law 27332, Framework Law of the Regulatory Bodies of Private Investment in Public Services, or the to take its place, provided that the information provided is not used to the detriment of the user's privacy.
11. When the treatment is carried out during legitimate activities and with the due guarantees by a foundation, NGO, association or any other non-profit organization, whose purpose is political, philosophical, religious, or union, provided that refer exclusively to their members or to people who maintain regular contacts by reason of their purpose, in which cases, the data may not be provided to third parties without the authorization of the Holder.
12. When the treatment refers to data that are necessary for the recognition, exercise, or defense of a right in a judicial process.
13. When the treatment has a historical, statistical, or scientific purpose. In this event, the measures leading to the suppression of the identity of the Holders must be adopted.

The answers to the questions about sensitive data are optional, therefore, they will not be mandatory. In any case, Tribal will strictly observe the legal limitations on the processing of sensitive data. Tribal, will not condition, in any case, any activity to the delivery of sensitive data. Sensitive data will be treated with the greatest possible diligence and with the highest security standards. Limited access to sensitive data will be a guiding principle to safeguard the Holder’s privacy and, therefore, only authorized personnel may have access to this type of data.

Sensitive data may not be processed for purposes other than those expressly authorized by the Holder.

25. HOW WE TREAT THE PERSONAL DATA OF OUR EMPLOYEES

Tribal is responsible for the treatment of the personal data that you provide from your selection process, recruitment and, where appropriate, if the selection process is successful, when the employment relationship begins and until it concludes, regardless of the cause. The personal data collected will be processed in order to integrate the file as a candidate or employee at the service of Tribal, prove your identity, location, carry out selection and recruitment, administrative and tax procedures, cover the job profile, pay salaries and benefits, assign and verify travel expenses and national and international tickets, integrate billing, be insured on the Social Security or other similar governmental obligations or benefits and designate beneficiaries in terms of the Labor Law, receive all kinds of legal and extra-legal benefits, control attendance and grant benefits of social security, economic, in-kind and health benefits; and schedule training actions. It is made known to you that Tribal, in addition to the transfers that you make and that do not require your consent, may carry out the transfer of your personal data for the legal purposes that may arise due to the selection and recruitment process to which you are subjected or the individual employment relationship once you have signed the respective agreement; For all extraordinary transfers we will require your consent, therefore, if you do not want your personal data to be transferred for any or all of the purposes indicated, from this moment you can communicate the above, omitting the electronic signature of this notice or using the comunications methods provided in Section 23; however, please understand that your refusal to allow such transfers shall also mean that Tribal will be incapable of hiring you or continuing to keep you as an employee depending on the timing of your notification to Tribal. TO BE CLEAR: if you notify Tribal that you do not want your personal data to be transferred while employed by Tribal, this shall be considered as your written voluntary resignation notification from your employment with Tribal. If you do not express your refusal for said transfers, we will understand that you have given us such consent.

Likewise, at any time you can exercise your data protections rights contact our Privacy team through the comunications methods provided in Section 23.

‍

This Tribal Card Terms & Conditions Agreement (T&Cs) represents an agreement between each Account Owner, Tribal, Issuer Processors, and the Financial Institutions (FIs) that govern Card Network branded payment cards (Cards) within Tribal’s Card Program (each term as defined below). Phrases, including for example: “such as” do not limit the generality of the preceding provision; the word “or” will be read to link alternatives or link any combination of the preceding items; and provisions listing items while using the term “and” among the listings requires all listed items.  

Each Account Owner shall be responsible for notifying their Administrator(s) and Cardholder(s) of their authority and obligations under this T&Cs and for ensuring that each Administrator and Cardholder complies with this T&Cs. Every single Account Owner, Administrator, and Cardholder is hereby deemed to have accepted this T&Cs by opening a Tribal Account or requesting, receiving, or using Cards.

IMPORTANT: THIS T&Cs INCLUDES RESOLUTION OF DISPUTES BY BINDING ARBITRATION AND WAIVER TO CONSOLIDATED OR CLASS ACTIONS. PLEASE READ CAREFULLY.

1. DEFINITIONS — these definitions shall be equally applicable to the singular and plural forms and either gender of the defined terminology.

“Access Information” means collectively a PIN, online username, password, challenge questions, and any other security information or methodology or combination thereof used to access Tribal property, including a Tribal Account or the Tribal Card Program or a Tribal Card Account or a Tribal Card.

“Account” means the records maintained to track and calculate the remaining spending limit available for associating with Cards issued at Account Owner’s or any Administrator’s or any Cardholder’s request and the Tribal Account and Card Accounts associated with such Cards. 

“Account Owner” or “you” or “your” means the legal entity (also known as a legal person or moral person) that has qualified for and established a Tribal Account and one or more Card Account(s) by signing a Tribal Agreement (see Section 6.2 - Qualifying for and Establishing Tribal Accounts and Card Accounts).

“Administrator” or “you” or “your” means any designated Person authorized by the Account Owner to administer their Tribal Account and associated Card Account(s) and Cards and acts on Account Owner’s behalf in connection with this T&Cs, including without limitation designating Cardholders and setting Card Account and Card limitations (see Section 6.5 – Establishing Card Account Settings).

“Card” or "Tribal Card" means the Card Network-branded cards issued by FIs through which any Cardholder can spend funds in the Tribal Card Program accessible through their respective Card Account. Card is a virtual or a physical card embossed with a 16-digit number. Each reference to “Card” shall also include all “Cards” provided to Cardholders.

“Cardholder” or “you” or “your” means any Person (including Administrators) authorized or permitted by Account Owner or Administrator(s) to access Account Owner’s Tribal Account or Tribal Card Program or a Card Account or Cards and use any of the foregoing on Account Owner’s behalf.

“Card Account” means a sub-account of the Account Owner’s Tribal Account assigned to a Cardholder and the records maintained by FIs and/or Issuer Processors and/or Tribal for each Card within a Card Account associated with the Account Owner’s Tribal Account that is requested by the Account Owner or any Administrator or a Cardholder.

“Card Network” includes but is not limited to the Visa card network and the Mastercard network.

“Control Person” means at least one individual who has the full power and authority to open a Tribal Account on behalf of the Account Owner in compliance with all relevant external laws, rules, and regulations, and all internal procedures and possesses all internal consents necessary to do so. Examples of a Control Person include an executive (e.g., CxO, Managing Member, General Partner, President, Vice President, Treasurer) or a Legal Representative authorized and officially designated to open financial accounts and/or credit accounts on behalf of the Account Owner.

“Financial Crime” includes but is not limited to money laundering, terrorist financing, fraud, theft, scams or confidence tricks, tax evasion, economic sanction evasion, bribery, embezzlement, identity theft, and forgery and counterfeiting that includes the production of counterfeit legal tender, goods, and services.

“Financial Institution” or “FI” means the Financial Institution (and their successors, affiliates, and assignees) that is a principal member of a Card Network and has sponsored Tribal, directly or indirectly, to issue Cards through Tribal’s Card Program. The applicable FI is printed on the back of Tribal’s physical Cards. FIs include, but are not limited to: Visa; Regions Bank, member FDIC and Visa; Celtic Bank, member FDIC and Visa; The Bancorp Bank, a member of Visa; and Dock, a member of Visa.

“Issuer Processor” means an entity that is contracted with Tribal and directly connects with the Card Networks and FIs and Tribal to provide one or more of the following: a system of record; manage the issuance of Cards; manage the authorizations of transactions; communicate with Card Network settlement entities.

“Mastercard” means Mastercard, Inc. and its successors, subsidiaries, affiliates, and assignees.

“Person” means any individual (human) or legal entity (also known as a legal person or moral person).

“Tribal” or “we” or “us” or “our” refers to Tribal Credit, a registered trade name of Aingel Corp., a Delaware US corporation that services the Tribal Accounts, including the Tribal Card Program and hosts Tribal property, including the Websites, and the Tribal platform as part of its business of assisting Account Owners manage their corporate expenses, and its successors, subsidiaries, affiliates, assignees, or other entities under common control including but not limited to Tribal CR, S.A. de C.V.

“Tribal Account” means a corporate Account with Tribal that is used by Account Owners, Administrators, and Cardholders to access Tribal’s property, platforms, Program, products, and services offered now or in the future, including making, reviewing, and managing Card Accounts, Cards, and transactions.

“Tribal Agreement” means the separate definitive agreement between the Account Owner and Tribal pursuant to which the Account Owner receives Tribal property, including a Tribal Account, its expense management platform, Tribal Card Program, products, and services. 

“Tribal Card Program” or “Program” means the program through which Tribal is sponsored by FIs to issue Cards to Account Owners that have signed a Tribal Agreement for use by the Account Owners’ Administrators and Cardholders to assist the Account Owner in managing legitimate corporate expenses.

“Tribal Electronic Records & Signature Agreement” means the agreement between the Account Owner and Tribal pursuant to which the Account Owner agrees to use electronic signatures and to receive all agreements, acknowledgements, disclosures, notices, and the like electronically, and agrees that electronic signatures shall have the same legal effect as a physical signature.

“Tribal property” means Tribal Accounts, apps, platforms, programs, products, services, beta products, beta services, Websites, and related technology; Tribal data; and copyrights, patents, trade secrets and confidential information, trade or service marks, brands, logos, business plans, strategies, and other intellectual property incorporated into each of the foregoing.

“Ultimate Beneficial Owner” or “UBO” means every individual who owns or controls—directly or indirectly through any contract, arrangement, understanding, relationship or otherwise—x% or more of the equity interests of the Account Owner. Depending on the applicable jurisdiction and other risk factors, “x” can range between 10% and 25%.

“Visa” means Visa, Inc., and its successors, subsidiaries, affiliates, and assignees.

“Websites” means Tribal’s websites, including ones located at https://www.tribal.credit and https://www.tribal.mx.