Data processing agreement

Parties

The Controller is the Customer that contracts SignSolú, the «Customer».

The Processor is SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V. with tax ID SOB240719U87, «SignSolú».

This agreement is part of the service contract and prevails on data matters.

1. Framework and roles

In Mexico it follows the LFPDPPP and articles 49 to 52 of its Regulation.

The Customer controls the data of its signers.

SignSolú processes it only on the Customer’s behalf and instructions.

The Customer’s own account data follows the Privacy notice.

2. Purpose, nature and duration

SignSolú processes the data to provide the e-signature service.

• Receives and stores signer data.
• Creates and sends a unique link by email or from the Customer’s WhatsApp.
• Stores the ID and documents the Customer requests.
• Reads the Mexican voter ID to extract name, CURP and date of birth.
• Captures the drawn signature.
• Logs IP, browser, approximate location and timestamps.
• Computes the SHA-256 hash and issues the audit certificate.
• Keeps the evidence file for viewing and download.

SignSolú does not use this data for its own purposes or to train models.

Processing lasts while the Customer’s account exists.

Cancelling the subscription does not delete signed documents.

3. Data processed

Data subjects are the signers the Customer adds to its documents.

The data depends on what the Customer collects and requests.

• Name, email, phone and address.
• CURP, voter key, date of birth and sex from the voter ID.
• ID images and supporting documents.
• Photo of the signer holding the ID and the drawn signature.
• IP, browser, operating system, approximate location and timestamps.
• Any data contained in the document itself.

4. Customer instructions

The initial instruction is the use of the Platform as configured.

SignSolú only discloses data on the Customer’s instruction or to its subprocessors.

It also does so under a legal request and warns the Customer when allowed.

If an instruction seems unlawful SignSolú says so without delay.

5. Confidentiality

Everyone with access to the data has a duty of confidentiality.

Access is limited to those who need it to provide the service.

6. Security measures

• TLS across the site with HSTS on.
• AES-256 encryption at rest.
• Private storage with signed temporary links.
• Per-account isolation with row-level security.
• Passwords stored as cryptographic hashes.
• A unique link per signer.
• SHA-256 hash under NIST FIPS 180-4 and a log per document.

Declared scope

The service is a simple electronic signature with an evidence file.

The infrastructure provider holds SOC 2 Type 2 and ISO/IEC 27001.

SignSolú holds no certifications of its own and is not a certification provider.

Reading the voter ID does not query the INE voter registry.

7. Assistance to the Customer

SignSolú helps the Customer answer data subject requests.

It replies to each request within five business days.

The Customer can export its full history from its account.

A signed document is never edited because its hash would change.

8. Subprocessors

The Customer authorizes the subprocessors of the service.

SignSolú is responsible to the Customer for each of them.

Any addition or change is announced 30 calendar days in advance.

The Customer can object on reasonable data protection grounds.

WhatsApp messages are sent from the Customer’s own number.

That is why WhatsApp is not a SignSolú subprocessor.

9. Transfers

Data is hosted and processed in the United States.

Under Mexican law this is a remission and needs no data subject consent.

The Customer discloses in its notice that data is hosted abroad.

10. Security breaches

SignSolú notifies the Customer within 72 hours of confirming a breach.

The notice explains what happened, who is affected and what was done.

The Customer informs its data subjects when the law requires it.

11. Audits

SignSolú provides the information needed to show it complies.

It accepts one audit per year with 30 calendar days of notice.

12. Return and deletion

When the contract ends the Customer chooses return or deletion.

It can download its full history at any time at no cost.

On request SignSolú delivers the package within 30 days.

Deletion covers IDs and backups as far as technically possible.

13. Contact

The privacy officer is José Rodrigo Barrios Villa.

Requests are answered at rodrigo@solufintech.com.

The Customer names a privacy contact to receive notices.

Without one we use the email of the account owner.

14. Final provisions

This agreement is accepted by accepting the Terms of use.

Article 51 of the LFPDPPP Regulation does not require a handwritten signature.

It is governed by the laws of Mexico.

Disputes are resolved before the courts of Tepic, Nayarit.

The version in force is the one published on this page.

Annex for the EU, the UK and Brazil

It applies when the Customer or its signers are in those regions.

• SignSolú acts as processor under article 28 of the GDPR.
• Transfers to the United States use the European Commission standard contractual clauses.
• For the UK the international data transfer addendum is added.
• For Brazil the standard clauses recognized by the ANPD apply.
• Breach notice deadlines remain 72 hours.

The Customer can request a signed copy of these clauses at rodrigo@solufintech.com.

Published by SignSolú, a Mexican e-signature platform that works over WhatsApp.