Privacy Notice

Importa México is a use case operated by Soluciones Integrales G1S (legal name Soluciones Integrales G1S, S. de R.L. de C.V., RFC SIG2407303M6, with address at Calle Hacienda Chichimequillas No. 409, Col. Jardines de la Hacienda, C.P. 76180, Santiago de Querétaro, Querétaro, Mexico), hereinafter "Importa México", "we" or the "Controller". This Privacy Notice describes what data we process, for what purposes, how our artificial-intelligence tools are involved, and how you can exercise your rights, in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and other applicable Mexican law.

1. Who is the Controller and who is involved

The Controller of your personal data is Soluciones Integrales G1S, the Mexican entity that represents GIS Holdings Limited (a company incorporated in Hong Kong), through the brand and service Importa México. You can contact us at soporte@importamexico.com and at the address above.

So you understand who is involved in the platform:

• Soluciones Integrales G1S (Mexico) and GIS Holdings Limited (Hong Kong) own the iOrderSmart use case for Importa México and are licensed to integrate Supply Chain Management solutions for the parties that interact on the platform. G1S is your counterparty and the Controller of your data.
• The iOrderSmart platform —the software that powers the service— is owned by Tech4Trade Limited, a company incorporated in Hong Kong (Certificate of Incorporation No. 2148310, dated September 24, 2014), acting as a technology provider (processor).
• In Mexico, Tech4Trade, S.C. (RFC TEC220606ATA, based in Querétaro) provides technical support for the platform and employs the local staff that supports and develops solutions for the Mexican and Latin American markets, also acting as a processor.

2. What personal data we process

Depending on your interaction with us, we may process:

• Identification and contact: name, surname, email, mobile phone and country.
• About your company: legal or trade name, RFC (tax ID), tax regime, industry, role within the company, state and city, and website.
• Tax data for invoicing (CFDI): RFC, legal name, tax regime, tax postal code and CFDI use, when you make a payment.
• Documents from your operation: the files you upload for analysis or to build your file (invoices, pedimentos, certificates, spec sheets, product photos, and more), which may contain third-party data.
• Usage and technical data: activity logs, IP address, device identifiers for notifications, and session data.

We do not intentionally collect sensitive personal data. If the documents you upload contain third-party data, you represent that you are authorized to process and share them with us for the purposes described here.

3. Why we use your data (purposes)

Primary purposes (necessary to provide the service): create and manage your account and your company and validate your registration; provide the regulatory-analysis tools, the electronic file and collaboration features; process your documents with AI to classify, detect gaps and generate analysis (see section 4); issue CFDI 4.0 invoices and manage payments and AI credits; send you operational communications (account verification, operation notices, alerts and notifications).

Secondary purposes (not necessary; you may object): service improvement, statistics and information about new features. To opt out, write to soporte@importamexico.com.

4. Use of artificial intelligence (Nova)

• The text, documents and data you send to the AI are processed using third-party language models, including the Anthropic (Claude) API. Under that API's terms, the data sent is not used to train its models.
• For certain skills, your data may be queried against external services and sources (for example, regulatory systems and databases such as VUCEM or the DOF, web search and tracking services), only as necessary to run the requested skill.
• AI results are advisory and do not replace professional advice from your customs broker or legal counsel. You are responsible for the business decisions you make based on them.

5. Who we share your data with

We share data only when necessary to provide the service, with providers acting as processors under confidentiality and security obligations:

• Platform and technical-support providers (Tech4Trade Limited and Tech4Trade, S.C.) to operate and maintain the service.
• AI and processing providers (e.g., Anthropic) to run the AI skills.
• Authorized certification provider (PAC) to issue your CFDI invoices.
• Payment processor to handle plan and credit charges.
• Messaging and notification providers (email and push notifications).
• Other parties you invite to your projects (e.g., your customs broker, supplier or carrier), according to the permissions you define.
• Authorities, upon a duly founded and reasoned legal request.

We do not sell your personal data.

6. Your ARCO rights

You have the right to Access your data, Rectify it when inaccurate, Cancel it when you believe it is not required, and Object to its processing for specific purposes. You may also revoke your consent and limit the use or disclosure of your data.

To exercise these rights, send your request to soporte@importamexico.com stating your name, contact details for our reply, and a clear description of the data and the right you wish to exercise. We will respond within the timeframes set by the LFPDPPP.

7. Data retention and deletion

We keep your data while your account is active and for the periods required by applicable legal, tax and customs obligations (for example, keeping the file per operation). After your account is cancelled, we delete or anonymize your data within a reasonable period, except data we must keep by law. You can request deletion of your account by writing to us.

8. Security

We apply reasonable administrative, technical and physical security measures to protect your data against loss, misuse or unauthorized access, including role-based access control within the platform. You decide which parties you invite to each operation and with what permissions.

9. Data location and cookies

The platform is hosted on servers of our infrastructure provider (Hostinger). We use strictly necessary cookies for authentication and session functionality; we do not use third-party advertising cookies.

10. Changes to this Notice

We may update this Privacy Notice to reflect legal or operational changes. We will publish the current version on this page with its last-updated date and, where appropriate, notify you.

11. Governing law

This Notice is governed by the LFPDPPP and other applicable Mexican law. For its interpretation and compliance, the parties submit to the competent authorities and courts in Mexico City.