Comprehensive Privacy Notice of MayanSoft

November 10, 2026

Introduction

Federal Law on the Protection of Personal Data Held by Private Parties

In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and other applicable provisions, this Comprehensive Privacy Notice is made available to data subjects.

1. Identity and Address of the Controller

Disruptive Innovation Technologies, S.A. de C.V., RFC DIT1607049BA, which commercially uses the MayanSoft brand, hereinafter “MayanSoft”, is the controller responsible for the processing of the personal data covered by this Privacy Notice.

Address: Calle 18 #103 Int. 1 x 23 y 25, Col. México, Mérida, Yucatán, México.

Email for privacy and personal data protection matters: privacidad@mayansoft.com

This Notice applies, as applicable, to data obtained from:

visitors and users of www.mayansoft.com;

prospects;

clients;

representatives or employees of clients;

suppliers;

potential suppliers;

distributors;

potential distributors;

strategic allies;

business partners;

business contacts;

event participants;

job candidates;

individuals who submit their résumé or professional information;

any other individual who interacts with MayanSoft through its websites, applications, forms, digital channels, communications, or business relationships.

2. Personal Data We May Process

The data we process depend on the relationship the data subject has with MayanSoft, the functionality used, and the information the data subject decides to provide.

A. Identification data

Among others:

first name;

last names;

signature, when applicable;

date of birth, when necessary;

official identification, when required for a legal relationship;

RFC (federal taxpayer registry number);

CURP (unique population registry code);

nationality;

data contained in identification or accreditation documents.

Not all of this data is requested from every user.

B. Contact data

Among others:

email address;

telephone;

mobile telephone;

address;

city;

state;

country;

business contact details;

professional profiles or contact channels provided by the data subject.

C. Professional and business data

Among others:

company;

organization;

job title;

department;

industry;

responsibilities;

professional profile;

technology needs;

problem or requirement;

information related to projects;

systems and platforms used;

information related to a potential business relationship;

business communications.

D. Information related to clients, suppliers, distributors, and allies

When necessary to establish or manage a relationship, we may process:

representative data;

contact information;

corporate data;

contractual information;

data necessary for quotes;

purchase orders;

billing;

support;

business relationship;

compliance with obligations;

project information.

E. Financial or asset data

When a commercial, contractual, supplier, or similar relationship requires it, MayanSoft may process data such as:

banking information;

payment information;

tax data;

billing information;

economic conditions;

data related to transactions.

When the law requires express consent for such data, MayanSoft will implement the corresponding mechanism.

F. Browsing and digital technology usage data

We may obtain automatically, or through authorized technologies, information such as:

IP address;

date and time of access;

pages visited;

duration of visits;

navigation;

clicks;

events and interactions;

entry and exit pages;

referring URL;

UTM parameters;

campaign source;

session identifiers;

advertising identifiers;

cookie identifiers;

device type;

browser;

operating system;

language;

screen resolution;

technical device characteristics;

approximate location derived from IP address;

technical logs;

security information;

application errors;

interactions with forms.

When a functionality requests precise geolocation, the corresponding permission will be requested beforehand through the device, browser, application, or applicable mechanism.

G. Communications and content provided by the data subject

We may process:

messages;

comments;

requests;

attachments;

documents;

photographs;

audio or video recordings, when applicable and disclosed;

content of meetings or communications;

survey responses;

information voluntarily provided.

3. Recruitment and Candidate Data

When a person takes part in a recruitment process or submits professional information, MayanSoft may additionally process:

curriculum vitae;

professional experience;

work history;

academic background;

certifications;

languages;

technical knowledge;

competencies;

portfolio;

professional references;

salary expectations;

availability;

documentation necessary to evaluate the candidacy;

information needed to verify experience or studies;

migration status or work authorization, when applicable;

information necessary for a possible hire.

The data collected will be used exclusively for recruitment, evaluation, selection, and hiring processes and, when the person authorizes it, for consideration for future professional opportunities.

4. Sensitive Personal Data

As a general rule, MayanSoft does not request sensitive personal data through the Site’s general forms.

However, in certain relationships or processes, especially recruitment, compliance with legal obligations, or specific requests from the data subject, it may be necessary to process information considered sensitive.

This could include, only when relevant:

health information;

disability or reasonable accommodation needs;

biometric information, when a future legitimate functionality requires it;

racial or ethnic origin;

religious beliefs;

genetic information;

or other categories considered sensitive by law.

MayanSoft will endeavor not to request such data unless it is necessary, legitimate, and proportionate.

When legally required, the processing of sensitive data will be subject to the express consent of the data subject, given in writing or through an equivalent electronic authentication mechanism.

The user must refrain from providing sensitive data that has not been requested and is not necessary for the purpose of the interaction.

5. Primary Purposes of Processing

Personal data may be used for the purposes necessary for the relationship between the data subject and MayanSoft, including:

Handling requests

answering questions;

processing forms;

managing information requests;

contacting prospects;

arranging meetings;

handling support or contact requests.

Needs assessment

understanding business or technology challenges;

evaluating requirements;

determining applicable capabilities;

preparing meetings;

identifying collaboration opportunities.

Commercial management

preparing proposals;

quotes;

presentations;

scopes of work;

work orders;

contracts;

commercial follow-up;

managing opportunities and relationships through CRM systems.

Client relationship

providing and managing services;

managing projects;

maintaining communications;

support;

billing;

collections;

contractual compliance;

handling incidents;

relationship management.

Suppliers, distributors, and allies

evaluating potential relationships;

establishing contacts;

negotiating;

contracting;

managing agreements;

coordinating activities;

making payments;

meeting obligations.

Recruitment

receiving and analyzing applications;

evaluating profiles;

communicating with candidates;

verifying information when appropriate;

conducting interviews;

considering candidates for open positions;

managing selection and possible hiring processes.

Operation and security

operating the Site;

preventing misuse;

detecting incidents;

managing security;

protecting systems;

investigating anomalies;

generating technical logs.

Compliance

complying with legal obligations;

contractual obligations;

tax obligations;

administrative obligations;

judicial obligations;

audit requirements;

security requirements;

document retention.

These purposes are necessary for the relationship or interaction requested by the data subject.

6. Secondary Purposes

With the corresponding consent, or when legally permitted, MayanSoft may use data to:

send information about MayanSoft;

newsletters;

invitations;

content;

events;

webinars;

new solutions;

marketing campaigns;

surveys;

satisfaction studies;

market analysis;

generating and managing audiences;

content personalization;

advertising;

remarketing;

campaign measurement;

analysis of user behavior;

generating statistics;

improving the experience;

developing and optimizing products, services, and content.

These purposes are not essential to maintaining a primary relationship with MayanSoft.

The data subject may request at any time that their data not be used for these purposes by writing to privacidad@mayansoft.com.

When communications include cancellation or unsubscribe mechanisms, those mechanisms may also be used.

7. Artificial Intelligence, Profiling, and Automated Processing

MayanSoft may use automation and artificial intelligence technologies to support processes such as:

classifying requests;

internal distribution of contacts;

needs analysis;

prioritizing opportunities;

content personalization;

statistical analysis;

support;

searching and organizing information;

interaction analysis;

support for recruitment processes.

When an automated processing may produce legal effects or significantly affect the rights or interests of a person, MayanSoft will adopt the measures required by applicable law, including human intervention when appropriate.

8. Cookies and Other Technologies

The Site uses, or may enable, technologies that allow information to be obtained about the browser, the device, and the way a person interacts with the Site.

These technologies may include:

first-party cookies;

third-party cookies;

pixels;

tags;

scripts;

web beacons;

local or session storage;

device identifiers;

analytics technologies;

measurement tools;

technical session recordings;

heat maps;

advertising technologies;

attribution technologies;

CRM tools.

Depending on the Site’s current configuration and the user’s consent preferences, MayanSoft uses or may enable services such as:

Google Analytics 4;

Google Tag Manager;

Google Ads;

Microsoft Clarity;

HubSpot Forms;

HubSpot Tracking;

Meta Pixel;

LinkedIn Insight Tag;

and other equivalent or successor technologies.

These technologies may be used, as applicable, for:

technical operation;

security;

remembering preferences;

analytics;

measurement;

attribution;

optimization;

personalization;

advertising;

remarketing.

When the law requires it, technologies that are not strictly necessary will be subject to the consent mechanism available on the Site.

9. New Technologies and Forms of Interaction

MayanSoft may incorporate in the future new functionalities or technologies to improve its services and interaction with users, such as:

chatbots;

artificial intelligence assistants;

voice assistants;

video calls;

dynamic forms;

diagnostic tools;

personalization;

portals;

applications;

authentication systems;

geolocation;

document uploads;

social media integrations;

collaboration tools;

automation technologies;

new analytics or marketing platforms.

These tools may require additional information relevant to the functionality used.

MayanSoft will not interpret this clause as unlimited authorization to collect any type of data.

Any additional data must be adequate, relevant, and reasonably necessary for a legitimate purpose related to the data subject’s interaction.

When a new technology involves a substantial change in the categories of data, the purpose, the processing of sensitive data, transfers, or any other condition that legally requires additional information or consent, MayanSoft will update this Privacy Notice and, when appropriate, request the data subject’s consent again.

10. Transfers and Processors

MayanSoft may allow data to be processed by providers acting on its behalf for functions such as:

technology infrastructure;

hosting;

cloud services;

email;

CRM;

forms;

analytics;

security;

support;

communications;

recruitment;

marketing;

storage;

collaboration.

These providers may process information in Mexico or in other countries and will be subject to the contractual or legal obligations that apply.

Likewise, MayanSoft may make domestic or international transfers when:

they are required by a competent authority;

they derive from a legal obligation;

they are necessary to exercise or defend rights;

they are necessary to fulfill a legal relationship;

they take place between controlling companies, subsidiaries, affiliates, or members of the same group under compatible processes and policies;

any other case permitted by law applies.

When a transfer requires the data subject’s consent, MayanSoft will request that consent through the corresponding mechanism.

Additionally, when a request from the data subject requires the participation of a distributor, strategic ally, business partner, or other third party that does not act as a MayanSoft processor, data will only be transferred in accordance with the law and, when applicable, after obtaining the data subject’s consent.

Consent for transfers that legally require it

When applicable, the consent statement will read as follows:

“I agree that my personal data may be transferred to third parties for the purposes disclosed that require my consent.”

Consent may be obtained through the electronic, contractual, or documentary mechanism that MayanSoft enables for the corresponding interaction.

When MayanSoft notifies the data subject that a data transfer will take place, the data subject may exercise the applicable ARCO rights, in particular the right to object when applicable, and may also request revocation of their consent under the terms set out in this Privacy Notice and applicable law. To do so, they may contact privacidad@mayansoft.com.

The exercise of ARCO rights or the revocation of consent is subject to the exceptions, limitations, and grounds for applicability established by law, and will have no retroactive effect on processing or transfers lawfully carried out previously.

11. Options to Limit Use or Disclosure

The data subject may request that their data not be used for certain secondary purposes, or that its disclosure be limited.

The request may be sent to privacidad@mayansoft.com, indicating:

full name;

means of contact;

data whose use they wish to limit;

purpose or communication to which the limitation applies.

For commercial communications, the unsubscribe mechanism included in the messages may also be used when available.

13. ARCO Rights

The data subject, or their legal representative, may exercise at any time the following rights:

Access

To know what personal data MayanSoft holds and the conditions of its processing.

Rectification

To request the correction of inaccurate, incomplete, or outdated information.

Cancellation

To request the deletion of data when legally appropriate.

Objection

To object to processing in the cases provided by law.

14. Procedure to Exercise ARCO Rights

The request must be sent to privacidad@mayansoft.com and must contain, as applicable:

1. the name of the data subject;

2. an address or other means to receive notifications;

3. documentation proving identity;

4. when acting through a representative, documentation proving that representation;

5. a clear and precise description of the personal data involved;

6. the right the data subject wishes to exercise;

7. any information or document that facilitates locating the data;

8. in the case of rectification, the requested changes and the documentation supporting them.

MayanSoft will communicate its decision within the maximum period provided by applicable law. If the request is granted, it will be carried out within the corresponding legal deadline.

The exercise of ARCO rights is free of charge, except for costs permitted by law related to reproduction, copies, or shipping.

15. Protection of Rights Before the Authority

If a person believes that their right to the protection of personal data has been violated, they may use the protection mechanisms provided by the Federal Law on the Protection of Personal Data Held by Private Parties before the competent authority.

Under current legislation, the competent federal authority in this matter is the Secretaría Anticorrupción y Buen Gobierno, without prejudice to subsequent changes to the legal framework.

16. Retention and Deletion

MayanSoft will retain data for the period necessary to:

fulfill the purposes for which it was obtained;

maintain a legal relationship;

comply with legal or contractual obligations;

address liabilities;

exercise or defend rights.

When data is no longer necessary and the legal or contractual retention periods have expired, it will be subject to the blocking, suppression, or deletion processes that apply.

Data of candidates who are not selected may be retained for future opportunities when a legal basis or consent permits it.

17. Security and Confidentiality

MayanSoft maintains reasonable administrative, technical, and physical measures to protect personal data against:

damage;

loss;

alteration;

destruction;

unauthorized use;

unauthorized access;

unauthorized processing.

Persons who take part in the processing of data must observe the corresponding confidentiality obligations, including after their relationship with MayanSoft ends, when applicable.

If a security breach occurs that significantly affects the property or moral rights of a data subject, MayanSoft will make the notifications required by law.

18. Third-Party Data

When a person provides personal data of third parties to MayanSoft, they declare that they have sufficient authority or authorization to do so and that they have informed the third party about the corresponding processing when legally required.

19. Minors

MayanSoft’s general commercial services and the Site are aimed primarily at adults and representatives of companies or organizations.

MayanSoft does not intend to intentionally collect information from minors through its general forms.

If a future functionality were aimed at minors, the measures and consent mechanisms required by law will be implemented.

20. Changes to the Privacy Notice

MayanSoft may modify this Privacy Notice as a result of:

legislative changes;

authority criteria;

new technologies;

new functionalities;

changes in its operations;

incorporation of new channels;

changes to the purposes;

security measures;

organizational changes;

any other reason that makes updating this Privacy Notice necessary.

Changes will be communicated by publishing them at www.mayansoft.com, indicating the date of the latest update.

When a change legally requires new consent, MayanSoft will implement the corresponding mechanism before carrying out the new processing.

21. Contact

For any question related to privacy, personal data, ARCO rights, revocation, or limitation of processing:

MayanSoft

Disruptive Innovation Technologies, S.A. de C.V.

RFC: DIT1607049BA

Address:

Calle 18 #103 Int. 1 x 23 y 25, Col. México, Mérida, Yucatán, México.

Privacy email:

privacidad@mayansoft.com

Website:

Introduction

1. Identity and Address of the Controller

2. Personal Data We May Process

3. Recruitment and Candidate Data

4. Sensitive Personal Data

5. Primary Purposes of Processing

6. Secondary Purposes

7. Artificial Intelligence, Profiling, and Automated Processing

8. Cookies and Other Technologies

9. New Technologies and Forms of Interaction

10. Transfers and Processors

11. Options to Limit Use or Disclosure

12. Revocation of Consent

13. ARCO Rights

14. Procedure to Exercise ARCO Rights

15. Protection of Rights Before the Authority

16. Retention and Deletion

17. Security and Confidentiality

18. Third-Party Data

19. Minors

20. Changes to the Privacy Notice

21. Contact