Privacy Notice

At Mexus CRM, operated by Soluciones de Software Toracom (“Toracom”, “we”), we recognize the importance of protecting your personal data, and we are committed to processing it in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Mexico’s Federal Law on Protection of Personal Data Held by Private Parties, LFPDPPP) and other applicable regulations in Mexico.

1. Data Controller

Soluciones de Software Toracom is the controller responsible for processing the personal data collected through Mexus CRM and its related sites.

• Address: Av. Faro 2350 1E, Verde Valle, CP 44550, Guadalajara, Jalisco, Mexico
• Privacy contact: privacidad@mexuscrm.com
• Website: www.toracom.net

2. Purposes of Processing

Primary purposes (necessary to provide the service)

• Provide access to and operation of the Mexus CRM platform.
• Authenticate users and identify sessions.
• Manage the deals, prospects, contacts, companies, and activities that you record.
• Synchronize information with third-party services that you explicitly authorize (for example, Google Calendar and Google Drive) to create events, send invitations, and store documents.
• Provide technical support and respond to your requests.
• Issue invoices and process payments where applicable.
• Comply with legal, tax, and security obligations.

Secondary purposes (require your consent)

• Send commercial communications, newsletters, and promotions about Mexus CRM or other Toracom products.
• Conduct market research, aggregate usage analysis, and product optimization.
• Create segmented profiles to improve the experience.

You may withdraw your consent to the secondary purposes at any time by sending an email to privacidad@mexuscrm.com. Declining the secondary purposes will not affect your access to the services.

3. Personal Data Collected

Depending on how you use Mexus CRM, we may collect the following categories of data:

Sensitive data: Mexus CRM does not intentionally collect sensitive data. If you include such data in your records (notes, documents), it is protected under the highest standards of security and confidentiality.

4. Use of Google Integrations (Calendar and Drive)

When you authorize the integration of Mexus CRM with your Google account, we request permissions strictly limited to the following operations:

• Google Calendar: create, update, and delete events corresponding to the activities you record in Mexus CRM (meetings, calls, video calls), as well as send invitations to the participants you specify.
• Google Drive: store and read only the documents that you associate with a deal, prospect, person, or company from Mexus CRM.

Mexus CRM’s use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not use your Google data for advertising, we do not sell it, and we do not share it with third parties, except where necessary to operate the service you requested, by legal obligation, or with your express consent.

You may revoke access at any time from your Google account settings or from the integrations section within Mexus CRM.

5. ARCO rights (Access, Rectification, Cancellation, Objection)

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete information.
• Cancel data when you consider it is not necessary for the purposes disclosed.
• Object to specific processing or to the secondary purposes.

Procedure:

1. Send an email to privacidad@mexuscrm.com with the subject line “Exercise of ARCO rights”.
2. Include: full name, address, a copy of official identification, and a clear and precise description of the right you wish to exercise.
3. We will respond within a maximum of 20 business days from receipt of the request.
4. If the request is granted, we will implement the corresponding action within an additional maximum period of 15 business days.

Support hours: Monday to Friday, 9:00 a.m. to 6:00 p.m. (Central Mexico Time).

6. Cookies and Similar Technologies

You can manage cookies from your browser settings. More information at www.aboutcookies.org.

7. Data Transfers

Mexus CRM uses technology providers to deliver the service. These include: cloud infrastructure, authentication, email, database, and storage providers (including Supabase and Google). These transfers are carried out under security measures equivalent to Mexican standards and are limited to what is necessary to operate the service.

Transfers may occur within Mexico and to the United States or other countries where our providers operate data centers. We do not carry out transfers that require your consent without first obtaining it.

8. Security Measures

• Technical: TLS encryption in transit, encryption at rest, role-based access control (RLS), regular backups, immutable audit logs.
• Administrative: internal access policies, staff training, confidentiality agreements, audits.
• Physical: our providers’ data centers have access controls, surveillance, and redundancy.

9. Retention and Deletion

We retain your personal data for as long as a contractual or legal relationship justifies it. When such relationship ends, your data is retained for the applicable legal period and is subsequently deleted or securely anonymized. Please also see our data deletion instructions.

10. Changes to This Notice

We reserve the right to modify this privacy notice. Any material change will be communicated through:

• Publication on this page.
• Email notification to registered users.

We recommend that you review this notice periodically to stay informed.

11. Contact

• Privacy email: privacidad@mexuscrm.com
• Website: www.toracom.net
• Support hours: Monday to Friday, 9:00 a.m. to 6:00 p.m. (Central Mexico Time).

Acceptance

By using Mexus CRM or providing your personal data by any means, you express your agreement with the terms of this Privacy Notice. If you do not agree, we ask that you refrain from providing personal information and discontinue use of the service.