Terms and Conditions of Use

01Parties and acceptance

1.1. LEGAL IN TECH, S. de R.L. de C.V. («LEGAL IN TECH») owns the technology platform «LITPACTA · Contract governance», which comprises the modules for contract lifecycle management, custody and sealing of instruments, compliance evidence by area, dialogue desk, integrity verification, prevention of transactions with illicit funds and donations (the «Platform»), and grants its use in accordance with these Terms. AMERICA LEGAL BUFETE, S.C. («AMERICA LEGAL®») provides, through the Platform, professional compliance services to the organizations that use it. Hereinafter, LEGAL IN TECH and AMERICA LEGAL® shall be jointly referred to as the «Providers».

1.2. The «User Organization» is the legal entity, whether a company, authorized donee or other entity, in whose name an account is enabled on the Platform. «Authorized Users» are the individuals to whom the User Organization or the Providers grant access credentials.

1.3. Acceptance is given by electronic means by checking the corresponding boxes and selecting «Accept and continue», which constitutes express consent under articles 1803, section I, and 1834 Bis of the Federal Civil Code, and 89 to 94 of the Commercial Code. The Platform keeps a record of the acceptance with date, time, accepted version and digital seal.

1.4. The person accepting declares, under oath, that they have sufficient authority to bind the User Organization, or that they act with its express authorization.

1.5. If a signed services or license agreement exists between the User Organization and any of the Providers, it shall prevail over these Terms to the extent of any conflict; in all matters not provided for therein, these Terms shall apply.

02Definitions

In addition to the terms defined in the text, the following shall mean:

• Personal Data, Data Subject, Controller, Processor, Remittance and Transfer: the concepts defined in article 2 of the Federal Law on the Protection of Personal Data Held by Private Parties (DOF 20-03-2025) and its Regulations.
• Vulnerable Activity: any of the activities set forth in article 17 of the Federal Law for the Prevention and Identification of Transactions with Illicit Funds («LFPIORPI»).
• Notice: the notice or report that the User Organization must file with the Ministry of Finance and Public Credit through the Tax Administration Service.
• Organization Content: the data, documents, assessments, minutes and other information that the User Organization or its Authorized Users enter or generate on the Platform.
• Digital seal: the hash value calculated with the SHA-256 algorithm over a record or document, which allows its integrity to be verified.

03Nature and scope of the service

3.1. The Platform is a technological support tool to manage the contract lifecycle, keep custody of and seal instruments and evidence, assign owners by area, document communications and collegial resolutions, identify and assess counterparties and donors with a risk-based approach, verify thresholds, formalize agreements, generate files in accordance with the official formats and follow up on obligations.

3.2. The Platform does not replace the judgment, decisions or obligations of the User Organization as a reporting entity under articles 17, 18 and 20 of the LFPIORPI when it carries out vulnerable activities, nor those of its compliance officer, nor its contractual, tax or corporate obligations. Assessments, risk levels, alerts and resolutions are the sole responsibility of the User Organization.

3.3. The Platform does not file notices or reports with any authority. Filing is carried out by the User Organization on the official portal, with its advanced electronic signature, which must never be entered or stored on the Platform.

3.4. Legal references, guides and explanatory texts are for information purposes only and do not constitute legal advice, unless there is a professional services agreement with AMERICA LEGAL® that so provides. The User Organization must verify that the applicable provisions are in force.

3.5. The Platform automatically applies the notice schema in force on the date of generation. When the authority has not published the final technical specification of a format, the Platform will build it based on the provisions published in the Official Gazette of the Federation and will adjust it once such specification is published.

3.6. The Platform does not review or validate the legal content of the contracts, instruments or evidence uploaded, unless there is a professional services agreement with AMERICA LEGAL® that so provides. The assignment of areas, deadlines, traffic lights and indicators are management tools and do not replace the review of the instruments by the User Organization.

04Accounts, access and user security

1. Credentials are personal and non-transferable. Each Authorized User is responsible for keeping them safe and for the acts performed with them.
2. The User Organization is responsible for timely requesting the registration and removal of its Authorized Users and for assigning access in accordance with the principle of least privilege.
3. Any unauthorized use, loss of credentials or incident must be reported immediately to the Providers.
4. It is prohibited to enter on the Platform passwords, electronic signatures, access keys to government portals, full card or bank account numbers, and any data that is not necessary for the purpose of the service.

05Obligations of the User Organization

1. Enter truthful, complete, lawful and relevant information, and keep it up to date.
2. Have its own privacy notice and make it available to the data subjects whose data it enters, under articles 14 to 16 of the Federal Law on the Protection of Personal Data Held by Private Parties.
3. Have the applicable lawful basis for each processing. Processing necessary to comply with the LFPIORPI is based on the exceptions to consent set forth in article 9 of said law, in particular when provided for in a legal provision or when it derives from a legal relationship between the data subject and the User Organization.
4. Refrain from entering sensitive personal data unless indispensable, in which case it must obtain the express written consent of the data subject (article 8 of the same law).
5. Timely and properly address requests from its data subjects to exercise their rights of access, rectification, cancellation and opposition.
6. Use the Platform exclusively for lawful purposes and to comply with its obligations, and not use it to evade, simulate or split transactions.

06Processing of personal data on behalf of the controller

6.1. Capacity of the parties. With respect to the data of counterparties, donors, beneficial owners, representatives, attorneys-in-fact, personnel, members of governing bodies and other persons that the User Organization enters, the latter is the Controller and the Providers act as Processors, under article 2 of the Federal Law on the Protection of Personal Data Held by Private Parties and articles 50 to 55 of its Regulations. The communication of data from the User Organization to the Providers constitutes a Remittance, which does not need to be reported to the data subject or require their consent (article 53 of the Regulations).

6.2. Instructions. The Providers will process the data only in accordance with the User Organization's instructions, contained in these Terms, in the applicable agreement and in the account configuration, and will refrain from processing them for other purposes.

6.3. Security. The Providers maintain administrative, technical and physical security measures to protect the data against damage, loss, alteration, destruction or unauthorized use, access or processing, in accordance with article 18 of the law, including: encryption of communications, access control by account and by user, logical segregation of information by organization, logs, digital integrity seals, backups and an information security management system with reference to the ISO/IEC 27001:2022 standard.

6.4. Confidentiality. The Providers will keep the data confidential, an obligation that will survive the end of the relationship, and will make it enforceable on their personnel.

6.5. Breaches. In the event of a security breach that significantly affects the property or moral rights of the data subjects, the Providers will notify the User Organization without delay, with the information necessary for it to inform the data subjects under article 19 of the law, and will cooperate in the corrective measures.

6.6. Subcontracting. The User Organization authorizes the Providers to subcontract the infrastructure, hosting, platform and communications services necessary to operate the Platform, under articles 54 and 55 of the Regulations. Sub-processors will assume obligations equivalent to those of the Providers. The list of sub-processors is available upon request of the User Organization.

6.7. Cloud computing. The Platform operates on cloud computing services that meet the conditions of article 52 of the Regulations: data protection policies consistent with the applicable regulations, transparency of subcontracting, prohibition on claiming rights over the information, confidentiality, deletion mechanisms and measures that prevent unauthorized access. The infrastructure may be located within or outside national territory, always with equivalent safeguards.

6.8. Transfers. The Providers will not transfer the data to third parties, except upon instruction of the User Organization or in the cases of article 36 of the law, such as a reasoned and grounded request from a competent authority, of which they will inform the User Organization unless legally prohibited.

6.9. Data subjects' rights. Requests that the Providers receive from data subjects whose data are processed by the User Organization will be forwarded to it within the following five business days, and the Providers will cooperate in addressing them.

6.10. Termination. Upon termination of the relationship, the Providers will make the information available to the User Organization in a structured format and, once received, will block and delete it in accordance with the legal deadlines, unless a provision requires it to be kept.

6.11. Verification. The User Organization may request reasonable information to verify compliance with this section.

07Confidentiality of anti-money laundering information

7.1. Information and documentation relating to notices is confidential and restricted under article 38 of the LFPIORPI. The Providers and their Authorized Users will keep strict confidentiality and will not disclose, not even to the donor, the existence of a notice filed or under assessment.

7.2. The filing of notices by the User Organization does not constitute a breach of confidentiality obligations, under article 22 of the LFPIORPI, and no provision of these Terms may be construed as preventing compliance with that obligation.

7.3. Keeping the supporting information and documentation for a period of no less than ten years is the responsibility of the User Organization (article 18, section IV, of the LFPIORPI). The Platform facilitates this while the relationship is in force and allows its export.

7.4. Information that the User Organization delivers to authorities is subject, in its processing by them, to the General Law on the Protection of Personal Data Held by Obligated Parties and the General Law on Transparency and Access to Public Information, especially regarding its classification as confidential or restricted information.

08Digital seals and generated documents

8.1. Digital seals make it possible to verify that a record has not been altered since its issuance. Records constitute data messages with the value recognized by articles 89, 89 bis, 93 and 1298-A of the Commercial Code. Seals do not constitute an advanced electronic signature or a preservation certificate issued by a certification service provider under NOM-151-SCFI-2016, unless expressly indicated.

8.2. The minutes, contracts, agreements, assessments, evidence and files generated or uploaded are documents of the User Organization. Their review, signature and use are its responsibility.

8.3. XML files are generated in accordance with the official schema in force. Before filing them, the User Organization must review their content; the Providers are not liable for rejections resulting from incorrect or incomplete information.

09Intellectual property

9.1. LEGAL IN TECH owns the rights to the computer program, its code, architecture, databases, matrices, methodologies, texts, design, interface and documentation of the Platform, protected by the Federal Copyright Law and the Federal Law for the Protection of Industrial Property. The names LEGAL IN TECH and LITPACTA, as well as their logo, seal and GA icon, are distinctive signs of LEGAL IN TECH, S. de R.L. de C.V., and AMERICA LEGAL® is a trademark of its owner; these Terms do not grant any license for their use. Other trademarks and distinctive signs belong to their respective owners.

9.2. The User Organization is granted a non-exclusive, non-transferable, revocable license of use, limited to its internal purposes during the term of the relationship.

9.3. It is prohibited to copy, modify, decompile, reverse engineer, extract in an automated manner, sublicense, resell or exploit the Platform or its contents, as well as to circumvent its security measures.

9.4. The Organization Content belongs to it. The Providers may only use irreversibly de-identified and aggregated information, which does not allow any data subject or organization to be identified, to improve the Platform.

10Availability and updates

The Providers will endeavor to keep the Platform continuously available, without guaranteeing uninterrupted or error-free operation. They may perform maintenance, regulatory updates and improvements, endeavoring to give advance notice of scheduled interruptions. The User Organization is responsible for planning the generation and filing of its notices sufficiently in advance.

11Liability

11.1. The Providers shall not be liable for: (a) the decisions of the User Organization; (b) penalties, tax assessments or consequences arising from false, incomplete or untimely information provided by it, or from the failure to file notices; (c) failures of networks, third-party services or government portals; (d) acts of God or force majeure; or (e) indirect damages, lost profits or loss of opportunity.

11.2. The total liability of the Providers, jointly, shall not exceed the amount actually paid by the User Organization for the use of the Platform in the twelve months prior to the event giving rise to it.

11.3. The foregoing limitations do not apply in the event of willful misconduct or bad faith, under article 2106 of the Federal Civil Code.

12Indemnity

The User Organization shall hold harmless the Providers, their partners, officers and personnel from claims, proceedings, penalties or expenses, including reasonable fees, arising from the unlawful processing of personal data it has entered, the lack of a privacy notice or lawful basis, the breach of these Terms or the infringement of third-party rights.

13Confidentiality

The parties will keep strictly confidential the information they receive in connection with the relationship, will use it only for the intended purposes and will protect it with a degree of care no less than that used for their own information. This obligation will survive for five years after the end of the relationship and, with respect to personal data and restricted information, indefinitely.

14Suspension and termination

The Providers may suspend or cancel access, without liability, in the event of breach of these Terms, unlawful use, security risk, order of a competent authority or non-payment. Termination does not affect the obligations of confidentiality, restricted information, intellectual property, indemnity and retention. The provisions of section 6.10 shall apply to the User Organization's information.

15Amendments

The Providers may amend these Terms. The version in force will be published on this page with its update date. When the amendment is substantial, the Platform will request a new acceptance before continuing its use.

16General provisions

• Communications. The parties accept communications by electronic means, including notices displayed on the Platform and emails sent to the registered accounts.
• Compliance and integrity. The parties undertake not to offer, promise or deliver undue benefits to public officials or private parties in connection with the relationship.
• Assignment. The User Organization may not assign its rights or obligations without the prior written consent of the Providers.
• Independence. No provision creates an employment, partnership, mandate or agency relationship between the parties.
• Severability and no waiver. The invalidity of one provision does not affect the others. Tolerating a breach does not imply a waiver of the right to demand subsequent compliance.

17Governing law and jurisdiction

These Terms are governed by the federal laws of the United Mexican States. For their interpretation and enforcement, the parties submit to the jurisdiction of the competent courts of Mexico City, waiving any other jurisdiction that may correspond to them by reason of their present or future domicile.

18Legal framework

• Federal Law on the Protection of Personal Data Held by Private Parties (DOF 20-03-2025) and its amendments.
• Regulations of the Federal Law on the Protection of Personal Data Held by Private Parties (DOF 21-12-2011), to the extent not inconsistent with the law in force, and the Privacy Notice Guidelines, as applicable.
• General Law on the Protection of Personal Data Held by Obligated Parties and General Law on Transparency and Access to Public Information (DOF 20-03-2025), with respect to information delivered to authorities.
• Federal Law for the Prevention and Identification of Transactions with Illicit Funds, its Regulations and the General Rules referred to in said Law.
• Resolution issuing the official formats of notices and reports and its amendments.
• Commercial Code, Federal Civil Code, Federal Copyright Law and Federal Law for the Protection of Industrial Property.
• Provisions on the simplification and digitalization of procedures before authorities, as applicable.

Contact: info@americalegal.law · 55 6385 7030 · Av. Insurgentes Sur 1425, piso 7, oficinas C y D, Col. Insurgentes Mixcoac, Alcaldía Benito Juárez, C.P. 03920, Mexico City.