Terms of Service

For the purposes of these Terms, the following terms shall have the meaning ascribed to them below:

• "Boleti.mx" or the "Platform": the software-as-a-service (SaaS) platform, the mobile applications, the websites (boleti.mx, app.boleti.mx), the APIs and the ancillary services operated by KRZ Systems.
• "KRZ Systems": the legal entity that owns the brand, intellectual-property rights and operation of Boleti.mx. KRZ Systems is in the process of transitioning to the corporate name KRZ Soluciones México, S.A. de C.V.; any reference to KRZ Systems shall be understood as made to the operating entity then in effect.
• "Operator" or "Carrier": the individual or legal entity that registers on the Platform for the purpose of using it to manage the sale of tickets, configure routes, departures, fares, branches (box offices), buses, drivers and other resources associated with its ground passenger transportation service.
• "Passenger" or "End Customer": the individual who purchases, through the channels enabled by the Platform (box office, web, WhatsApp, payment link or others), a Ticket to use a transportation service provided by an Operator.
• "Transportation Service": the physical transportation of passengers, their luggage and other ancillary goods, provided by an Operator in accordance with its own permits, concessions, authorizations, vehicles, drivers, infrastructure and applicable regulations.
• "Ticket": the electronic voucher issued through the Platform evidencing the Passenger's right to receive the Transportation Service from the Operator identified on the Ticket itself.
• "Subscription": the plan contracted by the Operator to use the Platform, in any of its modalities (Estándar, Empresarial, Premium, Corporativo or A tu medida / Tailored).
• "Commission": the charge that Boleti.mx collects for providing technology services to the Operator, whether as consideration for the Subscription, as a percentage of the amount of Tickets sold, or as a fee for ancillary services.
• "Payment Processor": Stripe Inc. or the financial provider that Boleti.mx engages for the processing, authorization, capture, reconciliation and settlement of payments made by Passengers.

Use of the Platform in any modality — registration, free trial, paid plan, API integration, access by an authorized collaborator — entails express acceptance of these Terms, as well as of the Privacy Notice, the Cookie Policy and any complementary agreement applicable to the contracted plan.

If you do not agree with any provision, you must refrain from using the Platform. Continued use after the publication of amendments (section 23) is deemed acceptance of the version then in effect.

The Terms are permanently available at https://boleti.mx/terms. We may require active acceptance (clickwrap) upon material changes. Your account will not operate normally until you confirm.

Representation of capacity: by accepting these Terms, the Operator represents under oath that (i) it has full legal capacity to contract; (ii) if acting on behalf of a legal entity or business, it is fully authorized to bind it; (iii) the information provided upon registration is truthful, complete, accurate and up to date; (iv) it does not appear on any international sanctions list (OFAC, UN, EU) and does not deal with persons or entities subject to such sanctions.

This section is essential to the proper understanding of Boleti.mx's business model and is a determinative condition of the Operator's consent. The Operator acknowledges, accepts and represents that it is fully informed of the following:

A. Boleti.mx is a technology platform. Boleti.mx develops, operates and markets a software-as-a-service (SaaS) platform that allows the Operator to (i) manage its catalogue of routes, departures, buses, branches, fares and commercial policies; (ii) issue and distribute Tickets to its Passengers through digital and physical channels; (iii) collect payment of the price of such Tickets through a Payment Processor; (iv) communicate with its Passengers via WhatsApp Business, email and SMS; (v) generate operational, accounting and audit reports.

B. Boleti.mx does NOT provide the Transportation Service. Boleti.mx is not a carrier, is not a porteador (carrier under Mexican commercial law), is not a transport commission agent, is not a travel agency within the meaning of article 13 section VII of the General Tourism Law, is not a ticketing sales agent within the meaning of article 50 of the Regulation of Federal Motor Transport and Ancillary Services, and assumes no liability for the physical transportation of passengers, luggage, goods or parcels. Boleti.mx does not own, operate, lease, control, supervise or maintain transportation vehicles; it does not hire, direct, supervise, dismiss or assign drivers or vehicle operators; it does not set itineraries, schedules, routes, stops, fares, service conditions, capacities, or any other operational aspect of the Transportation Service. Such decisions are made, configured and executed exclusively by the Operator, under its own management, risk and responsibility.

C. The Operator is the actual counterparty of the Passenger. The transportation contract is entered into between the Passenger and the Operator, not between the Passenger and Boleti.mx. The Ticket issued through the Platform clearly identifies the Operator as the provider of the Transportation Service. Boleti.mx intervenes solely as (i) a technology platform for the issuance and custody of the Ticket, (ii) a facilitator of payment collection from the Passenger for the account and on behalf of the Operator, and (iii) a communication channel between the parties.

D. Clear information to the Passenger. Boleti.mx shall endeavor, through the information displayed at the time of Ticket purchase, on the Ticket itself, in transactional emails and on its public website, to identify the Operator as the actual provider of the Transportation Service, so that the Passenger knows in advance who its contractual counterparty is.

E. Express acknowledgment by the Operator. The Operator acknowledges and accepts that this legal architecture is an essential condition of the Service; the Operator agrees not to contradict it, not to represent Boleti.mx before Passengers, authorities or third parties as a provider of the Transportation Service, and to expressly state this in its own documents when relevant (privacy notices, receipts, customer-service communications).

The Operator is an independent provider of the Transportation Service. No relationship of agency, mandate, mercantile commission, distribution, franchise, partnership, joint venture, association in participation, nor any legal representation exists between KRZ Systems and the Operator, except those exclusively arising from the limited mandate for the collection of the Ticket price for the account and on behalf of the Operator, described in section 9.

A. Operational independence of the Operator. The Operator (i) acts on its own behalf, with its own resources, vehicles, personnel and permits; (ii) freely determines its routes, fares, policies, schedules, sale and service conditions; (iii) bears the risk and full responsibility of the Transportation Service; (iv) responds directly to its Passengers, authorities and third parties for any incident, accident, delay, cancellation, damage, theft, loss, injury, penalty, claim or dispute arising from or related to the Transportation Service.

B. Nature of the Ticket. The Ticket issued through the Platform is an electronic voucher evidencing the contracting of the Transportation Service between the Operator and the Passenger. KRZ Systems is not a party to the transportation contract that the Ticket documents. The terms of use of the Ticket (cancellation, change, refund, luggage, pets, unaccompanied minors, accessibility, etc.) are set by the Operator in its own commercial policies, which the Operator agrees to publish clearly and accessibly to its Passengers, in accordance with the Federal Consumer Protection Law (LFPC) and equivalent regulations.

C. Identification of the Operator before the Passenger. The Operator authorizes Boleti.mx to display, on the Ticket, in transactional emails, in WhatsApp messages, on the public search page (where applicable) and on any other informational material, the identifying information of the Operator (legal name, trade name, RFC, contact details, commercial policies, logo) that the Operator itself has uploaded to the Platform.

D. Passenger complaints and claims. Without prejudice to section 16, complaints, claims, disputes or refunds arising from the Transportation Service (failure to comply with the itinerary, delays, accidents, luggage damage, injuries, service quality, staff treatment, vehicle condition, etc.) shall be directed to the Operator as the Passenger's contractual counterparty. Boleti.mx may facilitate contact and, within its technical capabilities, assist in the transmission of the claim, without such activity implying any assumption of liability for the conduct or obligations of the Operator.

Registration requires providing truthful, up-to-date and complete information, including legal name, RFC, primary contact, fiscal address, contact methods and a valid payment method. The Operator is solely responsible for:

• Keeping access credentials confidential.
• Activating and maintaining the second factor (TOTP) for admin roles.
• Creating individual accounts for each collaborator (no user sharing).
• Defining internal policies for revoking access when staff leaves.
• Immediately notifying Boleti.mx of any unauthorized access or suspected compromise.

Sharing credentials or using false identities is expressly forbidden. Boleti.mx may preventively suspend accounts with signs of credential sharing, impersonation or security compromise.

A primary COMPANY_ADMIN role is assigned to the first user registered by the Operator, who may create, modify and revoke additional users with the roles defined in the Platform (MANAGER, CASHIER, SALES, CALLCENTER, USER). The actions of any person using the Operator's credentials shall be attributable to the Operator itself before Boleti.mx, except upon proof of credential compromise timely notified.

Upon registering on the Platform and at all times during which its account remains active, the Operator represents, warrants and undertakes under oath, in terms of articles 247 and 248 of the Mexican Federal Criminal Code, the following, each representation being an essential condition of KRZ Systems's consent:

A. Permits and authorizations. The Operator holds all permits, concessions, authorizations, registrations, licenses and enrollments — federal, state, municipal and/or sectoral — that applicable regulations require to provide the Transportation Service, including, as applicable to its specific regime:

• Permit from the Secretariat of Infrastructure, Communications and Transport (formerly SCT) for federal motor transportation of passengers, tourism or mixed service, in accordance with the Roads, Bridges and Federal Motor Transport Law, its Regulations and Mexican Official Standard NOM-012-SCT-2-2017 and other applicable NOMs.
• State concessions, permits or authorizations for public passenger transportation, suburban, intra-state foreign or tourism services, in accordance with the state legislation of the corresponding federal entity.
• Municipal licenses and permits where applicable.
• Enrollment in the Public Registry of Federal Motor Transport and in equivalent local registries.
• Applicable health and civil-protection permits.

B. License-plate and vehicle regime. Each vehicle used by the Operator to provide the Transportation Service has (i) current license plates of the type corresponding to the authorized regime (passenger, tourism, federal, state, mixed, etc.); (ii) current vehicle-registration card; (iii) current vehicle inspection where applicable; (iv) physical-mechanical inspection in accordance with NOM regulations; (v) current third-party liability and passenger insurance policy with sufficient coverage as required by law.

C. Personnel and drivers. The Operator's drivers and personnel (i) hold a current federal or state license of the type corresponding to the service provided; (ii) comply with medical, psychophysical and anti-doping examinations required by applicable regulations; (iii) have received the corresponding training; (iv) are hired, directed, supervised and remunerated exclusively by the Operator, with no employment, mercantile or any other relationship with KRZ Systems (see section 14).

D. Tax compliance. The Operator complies with its tax obligations in terms of the Federal Tax Code (CFF), the Income Tax Law, the VAT Law and applicable SAT (Mexican tax authority) regulations. The Operator is solely responsible for issuing the Digital Tax Receipt via Internet (CFDI 4.0) for the Transportation Service and/or for the Ticket to the Passenger or customer that requests it, in its capacity as service provider. Boleti.mx will issue CFDI solely for the Commission and/or subscription it charges to the Operator.

E. Personal-data compliance. The Operator complies with the 2025 Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and concordant regulations in respect of the processing of personal data of the Passengers it captures on the Platform. The Operator maintains its own Privacy Notice accessible to its Passengers and validly obtains the consents required for processing.

F. Consumer-protection compliance. The Operator complies with the Federal Consumer Protection Law (LFPC), publishes the terms of Ticket sale, its change, cancellation, refund, luggage, accessibility, complaint-handling and other applicable policies.

G. Truthfulness of information. All information that the Operator uploads, publishes or configures on the Platform (routes, departures, stops, fares, buses, branches, photos, descriptions, policies, etc.) is truthful, accurate, up-to-date and consistent with the Operator's actual operation, with no deception, concealment or false representation.

H. No unlawful activities. The Operator does not use the Platform to conduct, conceal or facilitate transactions with resources of unlawful origin, terrorism financing, fraud, tax evasion, human trafficking or any other unlawful activity.

I. Key disclaimer acknowledgment. The Operator expressly acknowledges that (i) KRZ Systems does not verify in all cases the truthfulness of the foregoing representations, but rather relies on and trusts the Operator's good faith, without prejudice to applying reasonable KYC procedures; (ii) the falsity, inaccuracy or breach of any representation or warranty in this section is grounds for immediate termination without refund pursuant to section 22, and obligates the Operator to fully indemnify KRZ Systems pursuant to section 18; (iii) the Operator's regulatory non-compliance is its sole responsibility and may in no case be attributed to Boleti.mx.

Boleti.mx may, at any time and at its discretion, request from the Operator documentation evidencing the representations made under section 6, including without limitation:

• Current Tax Status Certificate (SAT certificate).
• Articles of incorporation and notarial powers of attorney of the persons signing in representation.
• Current official identification of the legal representative.
• Copy of the federal, state and/or municipal permits, concessions, authorizations, registrations and licenses applicable to the Transportation Service.
• Vehicle-registration cards of the vehicles used, with legible license plates.
• Current third-party liability and passenger insurance policies.
• Operator's proof of address.
• In the case of natural persons with business activity, identification + CURP (Mexican personal ID code) + RFC enrollment certificate.
• Any additional document that Boleti.mx reasonably deems necessary to confirm compliance with section 6.

The Operator undertakes to deliver the requested documentation within 10 business days following the request. Failure to deliver or delivery of false, altered or inaccurate documentation shall entitle Boleti.mx, at its sole discretion, to (i) request additional information, (ii) preventively suspend the Operator's access to the Platform, (iii) block or temporarily withhold pending settlements until compliance is evidenced, or (iv) terminate the Operator's account pursuant to section 22, with no refund or indemnification in favor of the Operator.

Periodic re-verification. Boleti.mx may require documentary update at least annually, and with any reasonable periodicity when it receives verifiable complaints, indicia of non-compliance, or where required by the authority or by the payment processor.

Audits and insurers. Boleti.mx may share KYC documentation with its own insurers, legal advisors and, when required by competent authority, with such authority. Such circulation is performed in accordance with the Privacy Notice and subject to confidentiality obligations.

Boleti.mx facilitates the collection from the Passenger of the price of the Ticket for the account and on behalf of the Operator, through the Payment Processor (currently Stripe) and the enabled payment methods (credit and debit card, transfer, OXXO Pay, digital wallets, depending on jurisdiction and configuration).

A. Nature of the collection mandate. The Operator grants Boleti.mx a limited, non-exclusive, revocable mandate, free of additional commission, to receive, in its name and on its behalf, through the Payment Processor, the amounts corresponding to the price of the Tickets sold. This mandate is solely for collection, and does not imply or constitute mercantile commission over the Transportation Service, passenger commission, financial intermediation, capture of funds from the public within the meaning of the Credit Institutions Law, nor any activity reserved to financial entities within the meaning of the Law to Regulate Financial Technology Institutions (Fintech Law) or any other Mexican or foreign financial regulation.

B. Payment Processor. The processing, authorization, capture, reconciliation, and, where applicable, chargebacks and disputes, are executed by the Payment Processor in accordance with its own terms. Boleti.mx does not store the Passenger's card number (PAN); sensitive payment data are tokenized in accordance with PCI-DSS Level 1 by the Payment Processor.

C. Reconciliation and settlement to the Operator. The amounts collected from the Passenger, after deducting (i) the Payment Processor's fees, (ii) the applicable Boleti.mx Commission, (iii) any legally withheld taxes, and (iv) any pending refund, chargeback or claim, are settled to the Operator in accordance with the timeframes, frequencies and mechanisms published in the console and/or agreed in its plan. Settlements are made to the bank account registered and validated by the Operator on the Platform.

D. Risk-based withholdings. Boleti.mx may withhold or suspend settlements when (i) there are pending chargebacks, disputes or claims regarding Tickets sold by the Operator; (ii) there is well-founded suspicion of fraud, money laundering, terrorism financing or misuse; (iii) so required by the Payment Processor, an authority or KYC compliance itself; (iv) the documentation under section 7 is pending regularization. Withholdings are notified to the Operator with the corresponding justification.

E. Chargebacks and refunds. Chargebacks and refunds arising from the Transportation Service (including those for non-compliance by the Operator) are entirely at the Operator's expense. Boleti.mx may deduct their amount from future settlements or require direct payment from the Operator.

F. CFDI for the sale of the Ticket. The Operator is solely obligated to issue the CFDI for the Transportation Service and/or for the Ticket to the Passenger or to the customer that requests it. Boleti.mx neither issues nor can issue the CFDI for the Transportation Service because it is not the provider. Boleti.mx issues CFDI exclusively for the Commission and/or subscription charged to the Operator.

G. Tax refunds. If the tax authority refunds, reassigns or reclassifies amounts linked to the Transportation Service, such effects shall be borne by the Operator. Boleti.mx does not assume tax contingencies of the Transportation Service.

Boleti.mx offers four main self-serve plans — Estándar, Empresarial, Premium and Corporativo — plus a Tailored (A tu medida) scheme (sales-led, no listed price, for Operators with requirements beyond the Corporativo plan in terms of dedicated infrastructure, contractual SLA and compliance pack). Prices and limits of the self-serve plans are published at https://boleti.mx/pricing. General features of the model:

• Free trial: 30 calendar days with the full Premium plan upon registration, no card required. The trial may convert to a paid plan at the end of the period if the Operator so elects; if not, the account moves to PAST_DUE status and subsequently SUSPENDED pursuant to section 22.
• Billing cycles: monthly or annual, at the Operator's choice. The annual plan includes a discount published on the pricing page.
• Payment processor: Stripe. Accepted methods: credit/debit cards, bank transfers in countries where Stripe supports them, OXXO Pay for customers in Mexico (via Stripe).
• Auto-renewal: the Subscription renews at the start of each cycle. The Operator may cancel at any time from the panel; cancellation takes effect at the end of the current cycle.
• Plan changes: upgrades apply immediately with proration ("create_prorations"); downgrades apply at the start of the next cycle to avoid partial refunds and misalignment with the Operator's tax calendar.
• Taxes: prices are exclusive of taxes. VAT or equivalent is added per jurisdiction.
• Subscription refund policy: Subscription payments are non-refundable, except (i) Service downtime exceeding 24 continuous hours not attributable to force majeure or scheduled maintenance, (ii) material absence of contracted features unresolved within 15 days after notice, or (iii) where required by applicable local law. Refunds are processed to the original payment method within 10 business days.
• Late payment: payment failure triggers a 7-day grace period with notifications; after 14 days the account is suspended; after 60 days data may be anonymized in accordance with the Privacy Notice.

*This section governs exclusively the Operator's Subscription to the Platform. Refunds in respect of the Transportation Service (unused Tickets, cancellations, delays, etc.) are a matter between the Operator and the Passenger under the Operator's own commercial policies.*

The Operator may use the Platform exclusively for the lawful operation of its passenger transportation business, within the regulatory framework applicable to its specific regime.

The following is expressly prohibited:

• Using the Platform for unlawful activities in any applicable jurisdiction, including providing the Transportation Service without the corresponding permits.
• Configuring routes, departures or stops that exceed or are not covered by the Operator's permits.
• Issuing Tickets for services the Operator is not authorized to provide.
• Carrying out fraud, money laundering or terrorism financing.
• Reverse engineering, decompiling, copying or attempting to access the Platform's source code.
• Scraping, automated crawling or attempts to mass-extract data through means other than the documented API.
• Bypassing, disabling or interfering with security or quota controls.
• Impersonating others or falsifying the origin of communications.
• Sending mass WhatsApp, SMS or email spam in violation of Meta terms, telecom carrier rules or anti-spam laws.
• Uploading copyrighted content without authorization, unlawful content or content that violates third-party rights.
• Conducting load tests, penetration tests or DDoS attacks without prior written authorization.
• Reselling access to the Platform without a signed partner agreement with Boleti.mx.
• Using the Platform to capture Passengers in irregular, covert or unpermitted transportation operations.

Violation of any of these provisions authorizes Boleti.mx to suspend or terminate the account immediately, withhold settlements, report to competent authorities and reserve the corresponding legal actions.

Boleti.mx software, brand and materials: all intellectual-property rights over the Platform — source code, architecture, database, algorithms, designs, interfaces, the "Boleti.mx" brand, logos, mascot, documentation, and any derived improvements — are the exclusive property of KRZ Systems and/or its licensors. The Operator is granted a limited, non-exclusive, non-transferable and revocable license to use the Platform during the term of the Subscription and pursuant to these Terms.

Operator data and materials: the Operator retains ownership of its content uploaded to the Platform — corporate logos, vehicle photographs, route descriptions, Passenger base, historical trip database, loyalty-program configuration. The Operator grants Boleti.mx a limited, non-exclusive, worldwide, royalty-free license, exclusively to store, process and display such materials in the context of providing the Platform, including their display to the Passenger at the time of Ticket purchase.

Suggestions and feedback: any suggestion, idea or improvement proposed by the Operator may be incorporated by Boleti.mx without additional compensation or required attribution, with the improvement remaining property of KRZ Systems.

With respect to personal data of Passengers and end customers that the Operator captures on the platform, Boleti.mx acts as data processor within the meaning of article 50 of the LFPDPPP Regulations, article 28 of the GDPR, and equivalent figures in other jurisdictions.

This means:

• Boleti.mx processes such data exclusively under the Operator's documented instructions.
• The Operator is the controller and must maintain its own Privacy Notice toward its Passengers.
• Boleti.mx applies security measures equivalent or superior to those applied by the Operator.
• Boleti.mx will assist the Operator, to a reasonable extent, in addressing ARCO rights requests of its Passengers, security breaches and impact assessments.
• Upon termination of the agreement, Boleti.mx will make data available for export by the Operator (JSON/CSV format) for 30 days; thereafter, data will be anonymized or deleted, except for mandatory legal retention.

The Operator undertakes to validly collect every necessary consent, to maintain its own Privacy Notice, and not to transfer to Boleti.mx sensitive data exceeding what is necessary for the provision of the Platform.

Model DPA. For Empresarial or Corporativo customers that so require, Boleti.mx makes available a model Data Processing Agreement (DPA), downloadable and signable, detailing the technical and organizational measures applied. Requests are sent to privacidad@boleti.mx.

A. Preferred channel. Complaints, grievances, comments and requests from Passengers related to the Transportation Service must be directed to the Operator, as the Passenger's contractual counterparty, through the channels that the Operator itself publishes in its commercial policies and through the contact information shown on the Ticket.

B. Platform support. Requests related to the use of the Platform or to payment processing (not to the Transportation Service) — for example, non-receipt of the Ticket by email, charging errors, payment-method failure, difficulties downloading the Ticket — may be addressed to Boleti.mx through the enabled channels (https://boleti.mx/contacto and soporte@boleti.mx).

C. Operational mediation by Boleti.mx. If a Passenger submits a transportation complaint directly to Boleti.mx, Boleti.mx may (i) forward the complaint to the Operator, (ii) facilitate contact between the parties, (iii) share information relevant to its handling, (iv) provide the Passenger with general information about the Platform. This operational mediation does not constitute acknowledgment of liability for the Transportation Service, assumption of the status of carrier, collection management, or representation mandate.

D. Resolution and refunds to the Passenger. Any resolution, adjustment, compensation, refund or credit to the Passenger arising from the Transportation Service is decided and executed by the Operator. Where applicable, the refund of the Ticket price is processed through the Payment Processor and deducted from pending settlements owed to the Operator.

E. Consumer-protection authorities. The Passenger may, where applicable, file before the Federal Consumer Protection Bureau (PROFECO) or equivalent authority. The Operator is the respondent party and retains the status of provider of the Transportation Service before such authority. Boleti.mx, in its capacity as provider of the technology platform, will reasonably cooperate with such information as corresponds to it, without assuming liability for the Transportation Service.

The parties expressly acknowledge and accept that:

A. No employment relationship exists between KRZ Systems and the Operator. The Operator is an independent provider. No employment, subordination or any other relationship exists between KRZ Systems and the Operator, its partners, shareholders, directors, officers, employees, contractors, drivers or collaborators. Each party preserves its operational, managerial and economic autonomy.

B. KRZ Systems is neither employer nor substitute employer. KRZ Systems does not hire, direct, supervise, remunerate, evaluate, dismiss or assign the Operator's personnel. KRZ Systems is not an employer nor a substitute employer within the meaning of the Federal Labor Law (LFT) or applicable labor legislation, and cannot be deemed an intermediary or beneficiary within the meaning of the reforms to the LFT regarding subcontracting (LFT 2021) or equivalent regulations.

C. Social-security contributions and labor taxes. The Operator fully assumes employer-employee contributions to IMSS (Mexican Social Security Institute), INFONAVIT (workers' housing fund), AFORE (retirement fund), ISN (state payroll tax), payroll ISR (income tax) withholdings and all other labor, tax and social-security obligations regarding its personnel. The Operator undertakes to keep such obligations current and to deliver, when Boleti.mx so requests with reasonable cause, compliance opinions or corresponding certifications.

D. Labor indemnification. The Operator agrees to hold KRZ Systems harmless from any claim, labor lawsuit, penalty or administrative requirement arising from the relationship with its personnel, pursuant to section 18.

Boleti.mx commits to a target monthly availability of 99.5% (measured as the percentage of minutes during which the main API and the web console are operational) on Premium plans and above. For Estándar and Empresarial plans, the target is best-effort with no contractual commitment. For the A tu medida (Tailored) plan a contractual SLA of 99.9% with credits is offered.

Excluded from the availability calculation:

• Scheduled maintenance announced at least 48 hours in advance.
• Failures of indispensable third-party providers (Stripe, Meta WhatsApp, Google Maps, telecommunications networks, DNS registrars), even when reasonable mitigation efforts are made.
• Force majeure events (section 25).
• Incidents caused by the Operator's integrations, scripts or configurations.
• Unauthorized penetration tests or load testing.

Service-level credits: if monthly availability falls below 99.5% (on plans that cover this), the Operator may request a proportional credit on the next invoice, per the following table: 99.0%–99.5% → 5%; 95.0%–99.0% → 10%; below 95.0% → 25%. The request must be filed within 15 days of the closing of the breached month.

Real-time Platform status is available at https://boleti.mx/status.

Service channels and hours:

• WhatsApp Business: Monday to Friday 9:00–19:00 Mexico City time (UTC-6).
• Email: soporte@boleti.mx, response within 24 business hours.
• In-app chat: available when an agent is connected; outside hours, leave a message and we will respond the next business day.
• Help center and documentation: https://boleti.mx/help.
• Service status: https://boleti.mx/status.

Response SLA per plan (target, not contractual guarantee except in the A tu medida plan):

• Estándar: 24 business hours.
• Empresarial: 12 business hours.
• Premium: 4 business hours.
• Corporativo: 1 business hour + priority direct channel.
• A tu medida: 30 minutes + assigned engineer + 24/7 support for critical incidents.

Critical incidents (full outage, security breach, payment-processing failure) are handled with maximum priority on any plan.

Support does not cover transportation operational advice. Inquiries related to permits, license plates, insurance, SCT regulations, state regulations, accidents, Passenger complaints regarding the Transportation Service, or any other aspect outside the technical use of the Platform, shall be channeled by the Operator to its own advisors.

To the maximum extent permitted by applicable law, and except in cases of willful misconduct, gross negligence, breach of confidentiality obligations, indemnification for infringement of third-party intellectual-property rights, or a personal-data breach attributable to Boleti.mx, the total aggregate liability of KRZ Systems toward the Operator for any cause related to the Platform shall not exceed the greater of: (i) the amount actually paid by the Operator to Boleti.mx in Commission and Subscription in the immediately preceding twelve (12) months of the event giving rise to the claim, or (ii) USD $10,000 (ten thousand United States dollars).

This limitation constitutes an essential element of the contract economics. The Operator acknowledges that the Commission and Subscription have been calculated taking this limitation into account; without it, Boleti.mx could not offer the Platform at current prices.

KRZ Systems SHALL NOT BE LIABLE for:

• Any incident, accident, delay, damage, injury, theft, loss, or claim arising from or related to the Transportation Service provided by the Operator.
• Indirect, special, incidental, punitive, consequential or emergent damages.
• Lost profits, lost customers, lost business opportunity, reputational damage, costs of cover or substitute services.
• Data loss not directly caused by gross negligence or willful misconduct of Boleti.mx.
• Commercial, operational or legal decisions made by the Operator based on data, reports or recommendations from the Platform.
• Outages or failures of indispensable external providers (Stripe, Meta, Google, Microsoft, Vercel, telephone networks).
• Inaccuracies in data provided by the Operator itself or by its Passengers.
• Fines, administrative or regulatory penalties imposed on the Operator for its own non-compliance.
• Conduct of the Operator's personnel, drivers, contractors or representatives.
• Decisions of transport, customs, immigration, health or civil-protection authorities affecting the Operator.

THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE". Boleti.mx does not warrant that the Platform will be free from errors, defects or interruptions, nor that it will satisfy specific Operator expectations not expressly agreed. The only warranties are those expressly set forth in these Terms.

Nothing in these Terms limits liability arising from willful misconduct, gross negligence, or rights that the law deems non-waivable.

The Operator agrees to indemnify, defend and hold harmless KRZ Systems, its subsidiaries, affiliates, and their respective partners, shareholders, directors, officers, employees, contractors, advisors, agents and representatives (the "Indemnitees"), against any and all claims, demands, complaints, proceedings, investigations, requirements, penalties, fines, awards, damages, losses, costs or expenses (including reasonable attorney fees, expert fees, court costs and litigation expenses) of any nature — civil, commercial, criminal, administrative, tax, labor, regulatory, health, environmental, consumer-protection, personal-data protection — arising from, derived from or related, directly or indirectly, to:

A. The Transportation Service provided by the Operator, including any accident, injury, death, luggage damage, delay, cancellation, breach of itinerary, theft, assault, quality issues, accessibility, staff treatment, mechanical condition of the vehicle, or any other event related to the physical provision of the Transportation Service.

B. Falsity, inaccuracy or breach of any representation, statement or warranty made by the Operator under section 6 (including permits, license plates, insurance, licenses, tax, personal data, no unlawful activities).

C. Lack of permits, concessions or authorizations of the Operator to provide the Transportation Service offered through the Platform, or any penalty from SCT/SICT, SEMOVI (Mexico City mobility authority), local authorities, PROFECO, SAT, IMSS, labor authorities or any other federal, state or municipal authority arising from the Operator's operation.

D. Labor and social-security claims of the Operator's drivers, employees, contractors and personnel.

E. Tax claims related to the Transportation Service, including VAT, ISR, withholdings, CFDI, local contributions and SAT obligations.

F. Passenger claims arising from or related to the Transportation Service, including PROFECO or equivalent authority proceedings.

G. Processing of Passengers' personal data by the Operator with defective consent, lack of its own Privacy Notice, unauthorized transfers, or any other violation of the LFPDPPP or concordant regulations.

H. Third-party claims for content uploaded by the Operator that infringes intellectual-property rights, image rights, publicity rights or any other third-party rights.

I. The Operator's breach of Meta WhatsApp Business terms, Payment Processor terms, anti-spam regulations (CAN-SPAM, LFPDPPP, GDPR), or any other regulation applicable to its communications with Passengers.

J. Any material breach of the Terms or of the Platform's procedures by the Operator.

Defense procedure. KRZ Systems may, at its sole election, (i) assume the direction of the defense with its own counsel and at the Operator's cost; (ii) require the Operator to assume the defense at its cost with counsel acceptable to KRZ Systems; or (iii) actively participate in the defense with its own counsel. The Operator shall reasonably cooperate with the defense, provide all necessary information, documentation and testimony, and may not settle, acquiesce, acknowledge liability or agree with third parties on claims affecting KRZ Systems without prior written consent of KRZ Systems.

Broad scope. The Operator's indemnification obligation comprises judgments, awards, fines, defense costs, administrative costs, reasonable professional fees, expert fees, default interest and any other concept reasonably linked to the attention and resolution of the claim. The indemnification obligation survives termination of the agreement for the statutory limitation period of the corresponding action.

Without prejudice to Operator's rights. The foregoing is without prejudice to the Operator's right to sue third parties directly responsible for the facts giving rise to the claim, with KRZ Systems being subrogated to the Operator's rights when the latter has been indemnified by KRZ Systems.

Each party agrees to treat as confidential all non-public information received from the other in connection with the agreement, including (without limitation): financial, commercial, technical, operational information, Passenger lists, configurations, negotiated prices, source code, internal documentation and product plans.

The parties will use such information solely for the purposes of the agreement and will not disclose it to third parties, except to their collaborators, contractors and advisors who require it to perform their duties and who are bound by equivalent confidentiality obligations.

The confidentiality obligation survives for 5 years after termination of the agreement, except with respect to trade secrets and personal data, which remain protected indefinitely. Excluded are publicly available data, independently developed data, data lawfully received from third parties without restriction, or data whose disclosure is required by competent authority (in which case the other party will be notified in advance whenever legally possible).

Without prejudice to the general scope of the representations and warranties of section 6, the Operator assumes and undertakes to permanently observe the following regulations, as applicable to it:

D. LATAM and the Americas: equivalent local legislation in each jurisdiction in which the Operator operates or uses the Platform.

E. International sanctions: OFAC (United States), United Nations and European Union lists; the Operator declares not to appear on restricted lists and not to operate with sanctioned persons or entities.

Boleti.mx provides tools (invoicing, tax reports, exports, audit, cookie-consent setup) to facilitate compliance, but DOES NOT PROVIDE LEGAL, TAX, REGULATORY OR TRANSPORTATION ADVICE, and DOES NOT REPLACE the Operator's duty to retain its own advisors. The Operator is solely responsible for the regulatory diligence of its business.

Without prejudice to the termination right under section 22, Boleti.mx may preventively suspend the Operator's access to the Platform, in whole or in part, as well as temporarily withhold pending settlements, without prior notice and without such action implying termination of the agreement, in the following cases:

• Well-founded indicia of breach of section 6 (Operator representations) or section 10 (acceptable use).
• Verifiable complaints from Passengers, authorities or third parties regarding irregular operation of the Transportation Service.
• Request, requirement or instruction of a competent authority.
• Payment Processor request due to sustained increase in chargebacks, disputes, fraud or financial risk.
• Well-founded suspicion of fraud, money laundering, terrorism financing, impersonation or account-security compromise.
• Failure to update the KYC documentation required under section 7.
• Default exceeding 14 days in payment of the Subscription.

During preventive suspension, Boleti.mx (i) will notify the Operator of the reasonable cause, save for legal or authority restrictions; (ii) may request additional information to evaluate continuation of the Service; (iii) may restore access once the cause is remedied, without such restoration implying waiver of rights arising from the facts that motivated the suspension.

A. Voluntary termination: either party may terminate the agreement without cause with 30 calendar days prior notice. Termination takes effect at the close of the current billing cycle.

B. Termination for material breach: the non-breaching party may rescind after written notice and a 15-calendar-day cure period. If the breach is not cured, rescission operates by right.

C. Immediate termination by KRZ Systems without refund: Boleti.mx may terminate the account immediately, without refund, in the event of:

• Falsity, inaccuracy or breach of any representation or warranty of the Operator under section 6.
• Unlawful use of the Platform, risk of compromising the security or privacy of other Operators, or serious reputational or legal risk to Boleti.mx.
• Payment default exceeding 30 calendar days.
• Material breach of section 10 (acceptable use).
• Operation of the Transportation Service without the corresponding permits, evidenced by complaint, authority requirement or reasonable evidence.
• Insolvency, reorganization or bankruptcy proceedings of the Operator.
• Well-founded requirement from a competent authority.
• Recurrence of serious Passenger claims or material administrative penalties.

D. Effects of termination: access to the Platform ceases. Boleti.mx makes the Operator's data available in exportable format for 30 days thereafter; once that period elapses, the Privacy Notice retention policy applies. Final settlements are processed deducting chargebacks, pending disputes, refunds to Passengers and pending claims, pursuant to section 8.

E. Surviving provisions: provisions that by their nature must survive — intellectual property (11), confidentiality (19), limitation of liability (17), indemnification (18), financial withholdings (8 D and E), governing law and jurisdiction (24) — survive termination for the corresponding limitation period.

Boleti.mx may amend these Terms at any time. Material amendments will be notified at least 30 calendar days in advance through:

• Email to the primary account contact.
• Prominent banner inside the Operator console upon login.
• Publication of the updated version at https://boleti.mx/terms with a date stamp.

Minor changes (typographical corrections, clarifications, legal-reference updates without altering substantive rights) may apply without prior notice.

If the Operator does not agree with a material amendment, it may terminate the agreement without penalty before the effective date. Continued use of the Platform after that date is deemed acceptance of the new version.

We maintain a version history available upon request to legal@boleti.mx.

These Terms are governed and interpreted in accordance with the federal laws of the United Mexican States, without regard to conflict-of-laws rules that may refer to another jurisdiction.

A. Competent courts. The parties expressly submit to the jurisdiction of the federal courts sitting in Mexico City for the resolution of any controversy arising out of or related to these Terms, waiving any forum that might correspond to them by reason of their current or future domicile.

B. Pre-suit mediation (B2B). Before initiating judicial actions, the parties will endeavor to resolve the controversy in good faith through direct negotiation for a period of 30 calendar days from written notice of the controversy. If no agreement is reached within such period, the parties may, by written agreement, submit the matter to the Mediation and Arbitration Center of the National Chamber of Commerce of Mexico City (CANACO).

C. Optional arbitration. If the parties so agree in writing, the controversy may be submitted to arbitration administered by CANACO under its arbitration rules then in effect, seated in Mexico City, Spanish-language, with a single arbitrator appointed under such rules. The award will be final, binding and non-appealable. Arbitration costs will be allocated as the arbitrator determines, considering procedural conduct and the success of the claims.

D. Class-action waiver (between Operators and KRZ Systems). In its capacity as Operator, the Operator agrees to resolve its controversies against KRZ Systems individually and, to the extent permitted by law, waives participation as member or representative of a collective action, group action or class action. This waiver does not apply to non-waivable rights granted by Mexican local or other applicable law to the Operator where it qualifies as a protected consumer.

E. CISG. Application of the United Nations Convention on Contracts for the International Sale of Goods (Vienna Convention, CISG) is excluded.

F. Consumer reservation. The foregoing is without prejudice to the non-waivable rights that the Federal Consumer Protection Law (LFPC) and consumer-protection laws of the Operator's jurisdiction may recognize, where the Operator qualifies as such.

Entire agreement: these Terms, together with the Privacy Notice, the Cookie Policy, the addenda of the contracted plan and any signed purchase orders, constitute the entire agreement between the parties and replace any prior agreement or understanding, oral or written, on the same subject matter.

Severability: if any provision is held invalid or unenforceable, the remainder of the document remains in force; the affected provision will be interpreted as close as possible to the original intent within legal limits.

Assignment: the Operator may not assign rights or obligations under these Terms without prior written consent of Boleti.mx. KRZ Systems may freely assign rights and obligations to an affiliate, successor or acquirer of all or substantially all of its business (including the entity KRZ Soluciones México, S.A. de C.V. once incorporated), with 30 days prior notice.

Waivers: the failure or delay of Boleti.mx in enforcing any provision will not constitute a waiver.

Notices: in writing, to the email registered in the account or, for Boleti.mx, to legal@boleti.mx. Notices are deemed delivered upon electronic confirmation of receipt.

Force majeure: no party will be liable for breaches resulting from events beyond their reasonable control: natural disasters, pandemic, armed conflict, governmental acts, generalized internet or power outages, failures of indispensable providers (Stripe, Meta, Microsoft, Google, Vercel, telecommunications networks), cyberattacks on critical third-party infrastructure, etc. The affected party will notify as soon as reasonable and use commercially reasonable efforts to mitigate.

Languages: the Spanish version is the official one; any translation is provided as a courtesy and, in case of conflict, the Spanish text prevails.

Headings: section titles are for reference only and do not affect interpretation.

Interpretation. Plurals include the singular and vice versa. "Including" and analogous expressions are illustrative, not limiting. References to laws include their amendments, regulations and rules that may replace them.

For any contractual, commercial or legal matter:

• Legal and contractual: legal@boleti.mx
• Privacy and data protection: privacidad@boleti.mx
• Security and vulnerabilities: security@boleti.mx
• Technical and operational support: soporte@boleti.mx
• Address: Corporativo Torre A, Mz 004, Residencial Lomas de Sotelo, ZIP 53390, Naucalpan de Juárez, Estado de México, Mexico.
• Site: https://boleti.mx

We will respond to any legal communication within 10 business days of receipt. Notices requiring formal Bureau service must be sent simultaneously to legal@boleti.mx to ensure timely acknowledgment.