Terms of Use and Privacy

Version: 3.1

This Privacy Notice applies to www.mifiel.com and to related applications, APIs, and tools (the “Sites” and “Services”), regardless of the device, channel, or means of access.

1) Identity and address of the Data Controller

Data Controller (Responsable): FIRMA SEGURA, S. DE R.L. DE C.V.

Mifiel acts as Data Controller (Responsable) with respect to the data it collects directly from users and signatories in order to establish their identity and the attribution of their signatures, as well as with respect to the evidentiary record it generates in connection with the Services. Mifiel acts as Data Processor (Encargado) with respect to the content of the documents its clients upload to the Platform in order to operate the Services; in that case the client's privacy notice governs vis-à-vis the data subjects whose data are contained in those documents, and Mifiel follows the client's contractual instructions.

2) Personal data processed

2.1 Identification and contact: first name, surnames, email address, telephone numbers, contact details, RFC (Mexican tax ID) and tax domicile.

2.2 Transactional and billing data: tax data, CFDI (Mexican digital tax receipts), references and payment methods.

2.3 Technical and usage data: IP address, device identifiers, OS and browser, time zone, language, geolocation, logs, interaction with the Sites, cookies and similar technologies.

2.4 Digital certificates (e.firma/FIEL): serial number, issuing certification authority, algorithm, validity period, holder's name, email, CURP (Mexican population registry code), public key and metadata.

2.5 Content of electronic documents: where the user/client uploads them in order to operate the Services (the content belongs to the user/client).

2.6 Biometrics (sensitive data, where applicable): facial biometrics (selfie, liveness check and comparison against the image on the official identification document) for simple electronic signature flows with verification. The front and back images of the official identification and the liveness captures are retained as part of the evidentiary record of the electronic document.

2.7 Sources: directly from the data subject (forms, use of the Sites, emails), indirectly from certification authorities and payment providers, and technologically (cookies, telemetry and logs).

For NOM-151 preservation certificates, Mifiel transmits to the certification service provider (PSC) only the hash value of the document; it does not share its content.

3) Purposes of processing

Primary (necessary): identification and account administration; provision and operation of the Services (including electronic signature and NOM-151); verification of digital certificates; authentication; supporting the attribution, integrity and evidentiary value of electronic documents; fraud prevention; billing and collections; compliance with legal obligations; security, availability and operational improvement (telemetry, logs and auditing).
‍
Secondary (not necessary): commercial communications, surveys and non-identified analytics for improvement purposes.

If you do not wish for your data to be processed for secondary purposes, you may express your refusal within 5 (five) business days after your data is collected, or at any time thereafter by sending an email to [email protected]. Your refusal will not affect the primary purposes.

4) Legal basis and consent

We process data in accordance with applicable Mexican legislation on personal data protection, based on the data subject's consent and, where applicable, other legal bases (legal relationship, contract performance, compliance with obligations, defense of rights, security, and fraud prevention). For biometric data and other sensitive data we obtain express written consent, which is given through the Platform's authentication mechanism, pursuant to Article 8 of the Law.

5) Transfers and transmissions

Transmissions to Data Processors (no consent required): cloud and telecommunications services, security and monitoring, the certification service provider (PSC) for NOM-151 (hash only), support and billing.

Transfers: competent authorities; law firms and auditors for the exercise or defense of rights; corporate transactions (merger/acquisition) with contractual safeguards.

Endorsable negotiable instruments: where an endorsable electronic document is transferred by endorsement, the associated evidentiary record — including preservation certificates, audit logs and the evidence of identity and attribution of the signatures — is made available to the subsequent holder, as it is necessary to establish standing and the chain of endorsements. This transfer requires no additional consent, as it is necessary by virtue of the instrument and of the legal relationship that gives rise to it.
‍
Where necessary, Mifiel will request prior consent. International transmissions are carried out with adequate safeguards.

6) Cookies and similar technologies

We use cookies to operate the site, remember preferences, measure performance and improve the Services. You may disable them in your browser; some functions may be affected. For further detail, please consult the Cookie Policy available on the Sites.

7) Retention, suppression, and deletion of documents

We retain data as long as the relationship exists and, thereafter, for legal or defense periods. Upon conclusion, we apply secure deletion or dissociation. If you request the deletion of documents uploaded to the Sites, Mifiel will address the request according to the Service's functionality and applicable regulations; certain evidentiary records (e.g., NOM-151 certificates, audit logs) may be retained when necessary for compliance or defense.

8) Security measures

We apply administrative, technical and physical measures proportionate to the risk: encryption in transit and at rest, MFA, access control, environment segregation, logging and auditing, vulnerability management and business continuity.

9) ARCO rights and other rights

To exercise your rights of Access, Rectification, Cancellation or Opposition (ARCO), to revoke consent or to limit the use or disclosure of your data, send a request to [email protected].

Minimum requirements: name, means of reply, description of the right being exercised, information enabling the data to be located, and a copy of an identification document.
‍
Indicative statutory time limits: up to 20 business days to respond and, where applicable, a further 15 business days to give effect to the request, in accordance with applicable law.

10) Minors

The Sites and Services are not directed at minors. If we detect processing without a valid basis, we will proceed to suppress the data promptly.

11) Changes to the Privacy Notice

We will publish the version in force at www.mifiel.com/es/privacy with its date of last update. Where there are substantial changes, we will communicate them by means of a prominent notice on the Sites.

12) Acknowledgments and definitions

This Notice is issued in accordance with the legislation in force in Mexico on the protection of personal data held by private parties and by public bodies, as well as with the criteria and guidelines issued by the competent authority. The terms “Responsable” (Data Controller), “Encargado” (Data Processor), “Transferencia” (Transfer), “Transmisión” (Transmission), “Datos sensibles” (Sensitive data) and the like are construed in accordance with that legislation.

13) Acceptance

By using the Sites or contracting the Services, you acknowledge that you have read and understood this Notice and, where applicable, give your consent to the purposes described. For secondary purposes or the processing of sensitive data, Mifiel will obtain additional consent where appropriate.