Privacy Policy

01Identity and address of the controllers

LEGAL IN TECH, S. de R.L. de C.V., owner of the platform, and AMERICA LEGAL BUFETE, S.C., provider of the professional services offered through it (jointly, «we»), are the controllers of the personal data described in section 3, and designate as their address for all matters related to this Policy the one located at Av. Insurgentes Sur 1425, piso 7, oficinas C y D, Col. Insurgentes Mixcoac, Alcaldía Benito Juárez, C.P. 03920, Mexico City. Contact: info@americalegal.law, telephone 55 6385 7030.

02Scope and dual capacity

This Policy applies to the «LITPACTA · Contract governance» platform (the «Platform»). On it we act in two different capacities:

03Personal data we process as controllers

• Identification and contact: name, position, organization to which they belong, institutional email and telephone.
• Authentication: username and credentials, which are stored encrypted or by means of hash functions.
• Technical and activity data: IP address, browser type, date and time of access, logs of actions performed, records of acceptance of terms and associated digital seals.
• Actions on the Platform: assessments recorded, approvals, votes and reasoning issued in committee sessions, communications in the dialogue desk, evidence uploaded and documents generated under their user.

We do not request sensitive personal data from users.

04Purposes

Primary purposes, necessary for the relationship

1. Create, manage and remove accounts and access.
2. Authenticate the user and prevent unauthorized access.
3. Provide the service contracted by the organization, including technical and professional support.
4. Keep audit, traceability and record-integrity logs.
5. Document the acceptance of the Terms and Conditions of Use.
6. Comply with legal obligations and respond to requests from competent authorities.
7. Recognize, exercise or defend rights in administrative or judicial proceedings.

Secondary purposes

1. Send information on regulatory updates, new features and related services.
2. Conduct satisfaction surveys and prepare internal statistics.

You may object to the processing for secondary purposes at any time by sending an email to info@americalegal.law with the subject «Objection to secondary purposes». Your objection will not affect the provision of the service.

05Legal basis for processing

Processing for the primary purposes is necessary for the performance of the legal relationship between us and the organization to which you belong, as well as for compliance with obligations set forth in legal provisions, cases in which consent is not required under article 9 of the Federal Law on the Protection of Personal Data Held by Private Parties. For secondary purposes, consent is deemed tacitly granted if you do not object, under article 7 of said law.

06Remittances and transfers

Remittances. We communicate data to providers of cloud infrastructure, hosting, platform, email and support services, who process them exclusively on our behalf, with equivalent confidentiality and security obligations. These communications do not require your consent.

Transfers. We do not transfer your data to third parties, except in the cases of article 36 of the Federal Law on the Protection of Personal Data Held by Private Parties, including when the transfer is provided for in a law or treaty, is necessary under a contract entered into in your interest, is required by a competent authority, or is necessary for the recognition, exercise or defense of a right in judicial proceedings. LEGAL IN TECH and AMERICA LEGAL BUFETE share the data with each other only for the purposes described in this Policy, as controllers of the Platform.

07ARCO rights, revocation and limitation

You have the right to access your data, rectify it if inaccurate or incomplete, cancel it and object to its processing for specific purposes (ARCO rights), as well as to revoke your consent and to limit the use or disclosure of your data, where applicable under articles 21 to 34 of the law.

Procedure

1. Send your request to info@americalegal.law with the subject «ARCO Rights · LITPACTA».
2. Include: your name and a means to communicate the response to you; documents evidencing your identity or, where applicable, the legal capacity and identity of your representative; a clear description of the right you wish to exercise and of the data involved; and any element that facilitates their location. If you request rectification, indicate the changes and provide the supporting documentation.
3. We will inform you of the determination adopted within a maximum period of twenty business days from receipt of the request and, if appropriate, we will make it effective within the following fifteen business days. These periods may be extended once for an equal period when justified by the circumstances of the case, which will be notified to you.
4. The exercise of these rights is free of charge; only justified shipping or reproduction costs may be charged.

Cancellation or objection may not be appropriate when the data must be kept by legal provision or are necessary to fulfill obligations arising from the legal relationship.

08Data we process on behalf of user organizations

When an organization enters data of counterparties, donors, beneficial owners, representatives, members of its governing bodies or other persons, said organization is the controller and we act as processors, in accordance with articles 50 to 55 of the Regulations of the law. We process them exclusively to provide the service and according to its instructions.

These data may include: identification and contact; tax data, such as RFC, CURP and status regarding the lists of articles 69, 69-B and 69-B Bis of the Federal Tax Code and the compliance opinion; contractual information, such as purpose, consideration, terms, guarantees, communications and evidence of performance; asset and financial data, such as amounts, payment methods, monetary instruments and source of funds; information on beneficial owners and control structure; politically exposed person status; and results of list screenings. This information receives enhanced security measures and is confidential and restricted under article 38 of the LFPIORPI.

If you are the data subject of such data, the exercise of your rights must be addressed to the controlling organization. If we receive your request, we will forward it to said organization within the following five business days.

09Security measures

We maintain administrative, technical and physical security measures in accordance with article 18 of the law, including: encryption of communications, access control by account and by user, logical segregation of information by organization, logs, digital integrity seals, backups, personnel confidentiality obligations and an information security management system with reference to the ISO/IEC 27001:2022 standard. In the event of a breach that significantly affects your property or moral rights, we will inform you under article 19 of the law so that you can take the corresponding measures.

10Retention

We keep users' data while the relationship with the organization to which they belong exists and, thereafter, blocked during the limitation periods of the liabilities arising from it, after which they are deleted. Logs and acceptance records are kept for the same period due to their evidentiary value. Data processed on behalf of others are kept in accordance with each organization's instructions, which is obliged to keep the supporting information of its notices for a period of no less than ten years under article 18, section IV, of the LFPIORPI.

11Cookies and similar technologies

The Platform uses strictly necessary session cookies to maintain authentication and security, and the browser's local storage for usage preferences. We do not use advertising or tracking cookies for commercial purposes on the Platform. Fonts are loaded from a third-party service, which involves the technical communication of the browser's IP address to said provider. You can delete cookies from your browser settings, although this will prevent the session from being maintained.

12Minors

The Platform is not intended for minors. If an organization needs to record data of a minor or of a person under legal incapacity, it must obtain the consent of whoever exercises parental authority or guardianship, under its responsibility.

13Changes to this Policy

This Policy may be amended due to regulatory changes, changes in our services or in our practices. The version in force will be published on this page with its update date and, when the change is substantial, it will be reported on the Platform upon login.

14Supervisory authority

If you consider that your right to the protection of personal data has been violated, you may go before the Ministry of Anti-Corruption and Good Governance, the competent authority under the Federal Law on the Protection of Personal Data Held by Private Parties in force.

15Legal framework

• Federal Law on the Protection of Personal Data Held by Private Parties (DOF 20-03-2025) and its amendments.
• Regulations of the Federal Law on the Protection of Personal Data Held by Private Parties, to the extent not inconsistent with the law in force, and the Privacy Notice Guidelines, as applicable.
• General Law on the Protection of Personal Data Held by Obligated Parties and General Law on Transparency and Access to Public Information, with respect to information delivered to authorities.
• Federal Law for the Prevention and Identification of Transactions with Illicit Funds, its Regulations and the General Rules referred to in said Law.