Privacy Notice

Last updated: October 10, 2026

This is an English translation of our Aviso de Privacidad Integral, provided for convenience. The Spanish version is the one that governs; if the two differ, the Spanish version prevails.

---

1. Identity and address of the data controller

David Manuel Sarmiento Flores, an individual carrying on business activity, operating under the trade name Centro de Envíos y Logística and the brand "Enviadores", with Federal Taxpayer Registry number (RFC) SAFD650617J51 (hereinafter "Enviadores", the "Controller" or "we"), with address at Av. Cuauhtémoc 53, local 2, Col. Amatitlán, Cuernavaca, Morelos, C.P. 62410, Mexico, is responsible for the processing of your personal data under the Federal Law on the Protection of Personal Data Held by Private Parties (published in the Official Gazette of the Federation on March 20, 2025 and in force since March 21, 2025; hereinafter, the "Law") and other applicable regulations.

For any matter related to this Privacy Notice and the processing of your personal data, you can contact us at:

• Privacy email: [email protected]
• Contact emails: [email protected] / [email protected]
• Phone: 777 318 4838
• WhatsApp: +52 222 565 5184

Note on a change of controller: The Controller is currently the individual identified above. If the operations of "Enviadores" are transferred to a legal entity (a S.A.P.I. de C.V. or another), a new Privacy Notice will be issued and published in the name of the new entity, which will become the Controller, and that transfer of data will be carried out under the applicable provisions of the Law.

---

2. Personal data we collect

For the purposes described in this Notice, Enviadores collects and processes the following categories of personal data:

2.1 Sender / customer data (the account holder)

• Identification data: first name, paternal surname, maternal surname, company name.
• Contact data: phone, email.
• Location / address data: street, numbers (exterior and interior), neighborhood (colonia), municipality, state, postal code, country, address references and notes.

2.2 Third-party recipient data (shipping data)

To process each shipment, we collect data about the recipient, which you, as the sender, provide to us:

• Recipient's name.
• Full delivery address.
• Recipient's phone and email.
• Delivery instructions.

Notice on data collected indirectly (Art. 17 of the Law): When you give us data about a recipient other than yourself, you take on the obligation to inform that person about the processing of their data and to have obtained their consent where required. When the recipient provides their own data directly through the public destination form (a shared link protected by Cloudflare Turnstile), the corresponding simplified privacy notice is made available to them at the time of collection.

2.3 Shipment (parcel) data

• Declared contents and declared value of the shipment.
• Dimensions and weight.
• Tracking number (guía).
• Proof of delivery (image / delivery receipt).
• Shipment notes.
• International shipments: customs description of the contents, SAT customs code and declared customs value (in USD).

2.4 User account data

• Username.
• Email.
• Phone.
• Password (stored hashed; we never keep it in plain text).
• User role and date of last sign-in.

2.5 Tax data

• RFC, name or company name, tax regime, postal code of the tax address and CFDI use.
• Where applicable, CURP, to issue electronic invoices (CFDI 4.0).

2.6 Browsing data and technical records (logs)

• IP address and user agent, linked to sessions, password resets, public destination forms and audit records.
• A random session identifier (UUID) and device class, collected by our first-party analytics.
• When you connect an AI assistant or an API integration (see section 5.3): the authorization or access key for that connection and a technical record of each request (operation, result, source IP address, date, time and duration). We do not receive or keep your conversation with the assistant.

2.7 SENSITIVE PERSONAL DATA

Enviadores processes the following categories of data, which receive enhanced protection under the Law:

• RFC (required in all cases for international shipments and for invoicing).
• CURP (for customers who provide it in the CFDI invoicing flow).
• Official ID number of the person who receives the parcel (for example, an INE voter card or passport number, captured in the delivery custody flow).

Express written consent (Art. 8 of the Law): Processing the sensitive personal data above requires your express written consent, which may be given by handwritten signature, electronic signature or any authentication mechanism established for that purpose. This data is collected for the specific and legitimate purpose of meeting tax obligations (CFDI), international shipping and customs requirements, and verifying the identity of the person who physically receives the parcel. Enviadores does not create databases of sensitive data without a legitimate, specific purpose consistent with its activities.

---

3. Purposes of processing

3.1 Primary purposes (necessary for the legal relationship)

The following purposes are necessary to provide the service and do not require additional consent, since they are essential to the existence and fulfillment of the legal relationship between you and Enviadores:

1. Quote and contract third-party parcel and courier services on your behalf and in your name.
2. Generate, issue and manage shipping labels.
3. Manage and apply your prepaid credit balance.
4. Process, track and confirm delivery of shipments.
5. Meet tax obligations, including issuing CFDI 4.0 invoices.
6. Handle requests, clarifications, claims and support.
7. Verify the identity of the person who physically receives the parcel (delivery custody).
8. Prevent fraud and keep the platform secure.
9. Comply with legal requirements and requests from competent authorities.

3.2 Secondary purposes (not necessary)

The following purposes are not necessary to provide the service and require your consent. You may refuse them without affecting the main service:

1. Sending marketing communications, promotions and news.
2. Non-transactional messages by WhatsApp or other channels.
3. Statistics and usage analysis of the platform for improvement (first-party analytics).

How to refuse secondary purposes: If you do not want your data processed for the secondary purposes above, you can say so at any time by emailing [email protected]. Refusing these purposes will not be a reason to deny you the services you request or contract with us.

---

4. Legal basis and consent

Your personal data is processed on the basis of the principles and lawful grounds set out in the Law. For data used for primary purposes, processing is necessary to fulfill the legal relationship with you. Sensitive personal data (RFC, CURP, the recipient's official ID number) requires your express written consent, under Article 8 of the Law. Financial or patrimonial data (declared shipment value, declared customs value and credit balance amounts) requires, where applicable, your express consent, unless a legal exception applies. Secondary purposes require your consent, which is deemed given if you do not object as described in section 3.2.

---

5. Sharing of personal data

To fulfill the purposes described, Enviadores shares your data with third parties, distinguishing between processors (who process data on behalf of Enviadores, which is a remission that does not require your consent) and transfers to third-party controllers. Some of these communications involve international transfers (mainly to the United States and/or the European Union).

5.1 Processors (service providers — remissions that do not require your consent)

To operate the platform we rely on service providers that process personal data on behalf of Enviadores and according to its instructions (processors), with whom we keep the corresponding data processing agreements. These providers fall, by way of example, into the following categories:

• Shipping gateways and platforms, to quote, contract and issue shipping labels on your behalf.
• Transactional email provider, to send you invoices (CFDI) and service notifications.
• Technology infrastructure (hosting, CDN, security and anti-abuse), messaging (WhatsApp), maps and service uptime monitoring.

Some of these providers are located outside Mexico (mainly in the United States and/or the European Union), so processing may involve an international transmission of data. The detailed, up-to-date list of our processors is available on request by writing to [email protected].

5.2 Transfers to third-party controllers

5.3 AI assistants you connect (ChatGPT, Claude and others)

You can use Enviadores from a third-party AI assistant, for example ChatGPT (OpenAI) or Claude (Anthropic), by connecting it to your account. In that case:

• You start and authorize the connection, and you can revoke it at any time from the assistant itself or from the API keys section of your account.
• The data you type into the assistant to use the service (for example, sender and recipient addresses and parcel details) reaches us through the assistant. Enviadores' responses (quotes, labels, tracking, balance and address book) are returned to the assistant and stay in your conversation.
• The assistant's provider processes that information as an independent controller, under its own terms and privacy policy, and not as a processor for Enviadores. We recommend reading them before connecting the service: OpenAI Privacy Policy and Anthropic Privacy Policy.
• Enviadores receives only the data needed for the operation you request. It does not receive or store your conversation history, and through this channel it never asks for or returns your RFC or other official identifiers.
• If you share data about a recipient, section 2.2 applies.

Acceptance of transfers: Except for transfers that do not require your consent under the Law, your acceptance of the other transfers is deemed given when you accept this Privacy Notice, unless you state otherwise as described in section 6.

---

6. How to exercise your ARCO rights, revoke consent and limit use or disclosure

You, or your legal representative, have the right to Access your personal data, to Rectify it when it is inaccurate or incomplete, to Cancel it when you consider it is not needed for any of the stated purposes, and to Object to its processing for specific purposes (ARCO rights). You may also revoke the consent you have given us and limit the use or disclosure of your data.

6.1 How to exercise your rights

Send your request to [email protected], addressed to our Personal Data Department / privacy officer. The request must contain at least:

1. Your name and an address or other means to send you the response.
2. Documents proving your identity or, where applicable, legal representation.
3. A clear and precise description of the personal data regarding which you want to exercise any of the rights.
4. Any element or document that helps locate the data.
5. Where applicable, the change(s) to make and the supporting documents (for rectification).

6.2 Response times

• We will tell you our decision within a maximum of 20 (twenty) business days from receipt of your request.
• If the request is granted, it will take effect within the 15 (fifteen) business days after we send you the response.
• These periods may be extended once for an equal period when justified by the circumstances.

Exercising ARCO rights is free of charge; you only cover, where applicable, justified shipping costs or the cost of copies or other formats.

6.3 Revoking consent and limiting use

You can revoke your consent or ask us to limit the use or disclosure of your data through the same channel ([email protected]). Please note that in some cases revocation will not be possible or will have a limited effect, when there is a legal obligation to keep the data (for example, data with tax effects) or while the legal relationship continues.

6.4 Competent authority

If you believe your right to the protection of personal data has been violated, or you are not satisfied with how your request was handled, you can file a data protection request with the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), the authority responsible for the protection of personal data held by private parties.

---

7. Cookies and tracking technologies

Our site and platform use cookies, local storage (localStorage/sessionStorage) and similar technologies. Some are strictly necessary to sign in and operate the service (for example, the auth_token and user_role authentication cookies), so they cannot be disabled without affecting how the service works. Other technologies, such as our first-party analytics (session identifier and device class) and optional error reporting, are not necessary and you can disable them. Through these technologies, data such as your IP address and a session identifier may be collected.

The site may also load third-party resources (Cloudflare Turnstile on the public form, and Google Maps) that could receive your IP address; the site's fonts are self-hosted and do not send data to third parties. For details on the technologies used and how to disable them, see our Cookie Policy (in Spanish).

---

8. Security measures

Enviadores has implemented and maintains administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction or unauthorized use, access or processing, under Article 18 of the Law. These include encrypted communications (HTTPS/TLS), cookies with security attributes (HttpOnly, Secure), password hashing (bcrypt), access controls, audit records and an incident response process.

If a security breach occurs that significantly affects your property or moral rights, we will inform you immediately, so you can take the corresponding measures to defend your rights (Article 19 of the Law).

---

9. Data retention (retention, blocking and deletion)

We keep your personal data only for as long as needed to fulfill the purposes that justified its processing and the applicable legal periods. Once the purposes and legal periods end, the data is blocked for the limitation period of the obligations and liabilities arising from the corresponding legal relationship, and then deleted.

Specifically:

• Data with a tax purpose (name, RFC, tax regime, postal code of the tax address, CFDI use, as well as the CFDI invoices and receipts of the transaction, and payment records): kept for the period required by Article 30 of the Federal Tax Code (5 years) and, where applicable, the special or permanent periods that article provides.
• Shipment operating data and technical records (including IP address and user agent in session, password reset and audit records, as well as WhatsApp messages and files): kept for a shorter period, defined by purpose, after which they are blocked and deleted.

---

10. Changes to this Privacy Notice

This Privacy Notice may be modified, changed or updated due to new legal requirements, our own needs or changes in our business model. Any change will be published at https://enviadores.com.mx/privacidad (and this translation at https://enviadores.com.mx/en/privacy), showing the date of the last update. For substantial changes, we will also inform you by email or through the platform.