Privacy notice

1. Identity and address of the data controller

FISCAL API S. DE R. L. DE C. V. (hereinafter “FISCAL API”) is a sociedad de responsabilidad limitada de capital variable (a Mexican limited liability company with variable capital) duly incorporated under the laws of the United Mexican States, as evidenced by public deed No. 101,250, executed before Licenciado Enrique Jiménez Lemus, Notary Public No. 3 of the State of Guanajuato. Its address is Av. Acueducto No. 6075 A, Local 4, Puerta de Hierro, Código Postal 45116, in the municipality of Zapopan, Jalisco, México.

Fiscalapi makes this privacy notice available to you in compliance with and under the terms of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Mexico's Federal Law on the Protection of Personal Data Held by Private Parties; hereinafter the “Law”). Fiscalapi is the data controller for the processing of your personal data in accordance with the Law, so your data will be processed under the principles of lawfulness, purpose, loyalty, consent, quality, proportionality, information, and accountability.

For Fiscalapi, the legitimate, controlled, and informed processing of your personal data is of vital importance. Fiscalapi respects your privacy and your right to informational self-determination, and ensures that this privacy notice is observed at all times by Fiscalapi or by the third parties with which it has a legal relationship.

2. Personal data subject to processing

The personal data collected depends on the type of legal relationship. By way of example and without limitation:

• Partners and staff:full name, résumé, official ID (INE voter ID: Mexico's voter ID card, the most common official ID), CURP (Mexico's population registry ID, Clave Única de Registro de Población), RFC (Mexico's taxpayer ID, Registro Federal de Contribuyentes), Opinión de Cumplimientodocuments (the SAT's opinion on whether a taxpayer is current with its tax obligations; SAT: Mexico's tax authority, Servicio de Administración Tributaria), professional license (cédula profesional, the government-issued license to practice a profession in Mexico), proof of address, university degree, bank account, email address, and mobile phone number.
• Suppliers of goods or services: articles of incorporation, power of attorney, Constancia de Situación Fiscal (the SAT tax status certificate), bank accounts, corporate purpose, IDs, attorneys-in-fact or legal representative, and licenses.
• Licensees: full name, copies of official ID, legal name (as registered with the SAT), whether of a legal entity (persona moral) or an individual (persona física), RFC, CURP, tax address (the address registered with the SAT; a CFDI 4.0 carries only its postal code), password, Constancia de Situación Fiscal (CSF), Certificado de Sello Digital (CSD, the digital seal certificate used to sign CFDIs), email address, and phone number.
• Licensees' customers:when a licensee issues CFDIs (Mexico's electronic invoices) in the name of its customers from its own solution, the tax details of those issuers are processed, such as their name or legal name, RFC, tax regime (régimen fiscal, the SAT category a taxpayer is registered under, such as 601 or 626), tax address, Certificado de Sello Digital (CSD), and private key password, as well as the data of the recipients included in the CFDIs.

With respect to the data of the licensees' customers, Fiscalapi acts as data processor on behalf of the licensee, who is the controller with respect to its customers and must have their authorization and its own privacy notice. Fiscalapi processes this data solely to provide the service contracted by the licensee.

Card or bank account details, IP address, browser type, operating system, pages visited, and interaction time may also be collected.

Sensitive and financial data

The sensitive data identified are the pages visited and the IP address. As for financial data, the Certificado de Sello Digital (CSD) and the private key password have been identified.

3. Purposes of processing

The main purpose for which your personal data is collected and processed is to fulfill our functions and obligations, that is, to provide the services offered by Fiscalapi, such as: generating and stamping (the certification by a SAT-authorized provider that makes a CFDI valid) CFDI 4.0 via JSON, bulk download (the SAT service that delivers the CFDIs a taxpayer issued and received) of XML files or metadata from the SAT portal, as well as updates, invoice storage, and other services that may be offered according to the needs of each licensee.

The personal data of staff, suppliers, and licensees is processed to prepare the corresponding contracts. Financial documentation related to bank accounts is used to process payments and comply with applicable tax obligations.

Cookies and similar technologies

Fiscalapi uses cookies, web beacons, and scripts to collect information about your interaction with our website, such as your preferences, traffic analysis, and browsing behavior.

4. Options and means to limit use or disclosure

The security of your information is important to Fiscalapi. To limit the use or disclosure of your personal data, Fiscalapi relies on restricted access, this privacy notice, and contractual confidentiality clauses in the corresponding legal instruments.

You can disable cookies, web beacons, and scripts in your browser settings; however, this may affect the functionality of our website.

Fiscalapi maintains the technical, administrative, and physical security measures necessary to protect your personal data and prevent its damage, loss, alteration, destruction, misuse, or unauthorized processing. For your security and confidence, we have a person in charge of personal data, as well as ongoing training and education.

If you do not agree with any of the processing of your personal data, you may state your objection by notifying it to legal@fiscalapi.com in a free-form written statement, accompanied by an official document that proves your identity or the capacity in which you appear. You are entitled at all times to exercise your ARCO rights (Access, Rectification, Cancellation, and Opposition: the rights Mexico's personal data protection law gives you over your personal data) under the terms set out in this privacy notice.

5. Mechanisms to exercise ARCO rights

ARCO rights allow individuals to exercise control over their personal data:

• Access: to know what personal data we hold, manage, and generate about you, what we use it for, and the conditions of its use.
• Rectification: to request the correction of your personal information when it is outdated, inaccurate, or incomplete.
• Cancellation: to request that we delete your data from our records when you consider that it is not being used properly.
• Opposition: to object to the use of your personal data for specific purposes.

To exercise any of the ARCO rights, you must send a request by email to legal@fiscalapi.com containing the following:

1. The data subject's name and address, or any other means to receive notifications.
2. Documents that prove the identity of the data subject or, where applicable, the capacity and identity of their representative.
3. A clear and precise description of the personal data with respect to which any of the ARCO rights is to be exercised, except in the case of the right of access.
4. A description of the ARCO right to be exercised, or of what the data subject requests.
5. Any other element or document that helps locate the personal data.

For the right of rectification, the data subject must also indicate the changes to be made and provide the documentation that supports the request.

We will inform the data subject by email of the decision adopted within a maximum of twenty days from the date the request was received, so that, if it is granted, it takes effect within the fifteen days following the date the response is communicated. These periods may be extended only once, for an equal period, when the circumstances of the case justify it. For the right of access, the data will be delivered once the identity of the data subject or of their legal representative has been proven.

If the request does not meet all the requirements, Fiscalapi may, within the first 5 business days, issue a request for information, which must be answered within the following 10 business days; otherwise, the request will be deemed not submitted.

Fiscalapi may deny access, rectification, cancellation, or opposition in the cases set out in Article 33 of the Law, including: when the data subject or the representative is not duly accredited; when the data is not in the controller's possession; when the rights of a third party would be harmed; when there is a legal impediment or a resolution of a competent authority; and when the rectification, cancellation, or opposition has already been carried out.

The denial may be partial when part of the request does not fall under the grounds above, in which case the corresponding access, rectification, cancellation, or opposition will be carried out. In all cases, we will inform you of the reason for our decision within the established periods and through the same means by which you submitted your request, together with the relevant evidence, where applicable.

Exercising ARCO rights is free of charge; charges may be made only to recover reproduction, copying, or shipping costs.

6. Data transfers

Fiscalapi may transfer the personal data in its database to the Servicio de Administración Tributaria (SAT) and to proveedores autorizados de certificación (PACs, SAT-authorized providers that stamp CFDIs), such as SW Sapien, within the scope of their authority, for the performance of their functions and obligations, in compliance with Article 35 of the Law.

Under Article 36 of the Law, domestic or international data transfers may be made without your consent when they:

• Are provided for in a Law or Treaty to which Mexico is a party.
• Are necessary for medical prevention or diagnosis, the provision of health care, medical treatment, or the management of health services.
• Are made to holding companies, subsidiaries, or affiliates under the common control of the controller, or to a company of the same group that operates under the same processes and policies.
• Are necessary by virtue of a contract entered into, or to be entered into, in the interest of the data subject, between the controller and a third party.
• Are necessary or legally required to safeguard a public interest, or for law enforcement or the administration of justice.
• Are required for the recognition, exercise, or defense of a right in a judicial proceeding.
• Are required to maintain or fulfill a legal relationship between the controller and the data subject.

7. Consent, changes, and scope

Changes to the privacy notice

Fiscalapi reserves the right to update, extend, or change the content and scope of this document. Any modification will be posted physically at our premises and on our official website, https://fiscalapi.com/, in the “Aviso de Privacidad” (Privacy notice) section. If we have email databases of licensees, suppliers, and staff, updates to the notice may be sent by that means.

Scope

This privacy notice meets the requirements of Article 15 of the Law and applies generally to Fiscalapi, as well as to licensees, suppliers, or any other third party with which it has a legal relationship.

Revocation of consent

Consent may be revoked at any time, without retroactive effect. For certain purposes, revoking your consent means that we can no longer provide the requested service, or that your relationship with us ends.

Consent

Pursuant to Article 7 of the Law, having read and understood the scope of the provisions set out in this privacy notice, you are deemed to grant your tacit consent once it is made available to you. You can consult the privacy notice and its updates at https://fiscalapi.com/ and at Fiscalapi's premises.

8. Contact information

If you have questions or comments about this privacy notice, or want to exercise your ARCO rights, contact us:

• Email: legal@fiscalapi.com
• Phone: +52 33 5980 0384
• Address: Av. Acueducto No. 6075 A, Local 4, Puerta de Hierro, Código Postal 45116, Zapopan, Jalisco, México.

Competent authority: if you believe your right to the protection of personal data has been violated, you may turn to the Secretaría Anticorrupción y Buen Gobierno(Mexico's Ministry of Anti-Corruption and Good Governance), the authority that took over the functions of the former INAI (Mexico's former transparency and data protection institute, dissolved in 2025) in this matter.