Comprehensive Privacy Notice

Last updated: October 19, 2026

This is a convenience translation; the Spanish version is the legally binding one.

This Notice covers only the marketing site deliverycontrol.mx. It does not cover the app.deliverycontrol.mx SaaS platform or the consulting services, which have their own notice. It is the comprehensive notice referenced by the Site's simplified notice.

1. Identity and domicile of the Responsible Party

XN SYSTEMS, S.A.S., RFC XSY260421UC3, with conventional domicile for receiving notices at Manzana B, Carretera Transpeninsular km 5, Interior 2, Corredor Turístico, Cabo Bello, C.P. 23454, Cabo San Lucas, Baja California Sur, Mexico (the "Responsible Party"), processes the personal data collected through the website deliverycontrol.mx (the "Site"), pursuant to the Federal Law on the Protection of Personal Data Held by Private Parties (Official Federal Gazette, March 20, 2025; in effect since March 21, 2025; the "Law").

If you are the subject of that data (the "Data Subject"), write to us at support@deliverycontrol.mx on any matter concerning its processing.

2. Personal data processed

On the Site we collect only these categories:

We collect no other data: no full name, no telephone number, no RFC, no domicile, no payment or banking data.

Sensitive data. We do not collect sensitive personal data through the Site (Art. 2, fraction VI of the Law).

What is mandatory. The email address is required for delivery: without it we cannot register you or follow up. Declining has no other consequence for you. Technical data is generated automatically by the server; you do not enter it.

3. Purposes of processing

3.1 Primary purposes (necessary for the relationship you initiate; no consent beyond this Notice is required)

1. Register you on the product waitlist and follow up on your access request.
2. Forward your registration (lead), by server-to-server communication, to our customer relationship management (CRM) system, for commercial continuity and to ease your onboarding as a customer.
3. Prevent fraud and automated abuse of the form and safeguard the security and technical integrity of the Site (the IP and User-Agent serve to rate-limit submissions).
4. Attend to the demonstration or call requests you yourself initiate on the Site.
5. Comply with legal obligations and attend to well-founded requirements from competent authorities.

3.2 Secondary purposes (require your separate consent; refusing does not affect your access to the waitlist or the primary purposes)

1. Measurement and attribution of advertising campaigns through Meta technologies (Pixel and Conversions API), subject to your marketing consent.
2. Site usage analytics, browsing behavior, and experience optimization, through Google (GA4 / Google Tag Manager) and PostHog, subject to your analytics consent.

You may grant, withhold, or revoke that consent at any time. Doing so affects neither your waitlist registration nor the processing for the purposes in Clause 3.1. The mechanism (banner and cookie preference center) is described in Clause 4.

4. Cookies and tracking technologies

4.1. What cookies and similar technologies are

4.1.1. Cookies are text files that a site places on your device so it can be recognized on later visits.

4.1.2. The Site also uses browser local storage (localStorage), which keeps information on your device but does not travel with every request to the server.

4.1.3. In this section, "Cookies" covers both, unless otherwise indicated.

4.1.4. A first-party Cookie is placed by the deliverycontrol.mx domain itself; a third-party one by another provider (for example Google or Meta) through resources embedded in the Site. The tables in section 4.2 indicate this Cookie by Cookie.

4.1.5. The Responsible Party applies prior consent (opt-in) to non-essential Cookies, as set out in section 4.3.

4.2. Categories of Cookies used on the Site

Every table follows the same format: Name / mechanism, Origin (first-party or third-party), Type (cookie or localStorage), Purpose, and Duration. Durations for third-party tools are the provider's default values and may vary with its configuration.

4.2.1. Essential or strictly necessary Cookies

These are indispensable for the Site to work and to record and give effect to your consent preferences. They require no prior consent and cannot be switched off from the preference panel: disabling them requires blocking cookies and local storage in the browser, which may affect the Site's functionality.

4.2.2. Analytics Cookies

These measure use of the Site (pages visited, time on page, traffic source) in order to analyze and improve it. They load only if the User consents to the "Analytics" category in the preference panel (section 4.3).

4.2.3. Marketing or advertising Cookies

These measure the effectiveness of advertising campaigns and, where applicable, track conversions originating on advertising platforms. They load only if the User consents to the "Marketing" category in the preference panel (section 4.3).

4.2.4. Functional scheduling Cookies: Cal.com (unconditional loading)

The Site integrates the Cal.com scheduling widget to book a call. This widget loads unconditionally, regardless of the User's Analytics or Marketing preferences, because it is a function the User activates when scheduling.

4.3. Consent model

4.3.1. The Site operates under prior consent (opt-in): Analytics (4.2.2) and Marketing (4.2.3) Cookies are off by default and are activated only if the User accepts them in the preference panel.

4.3.2. Essential Cookies (4.2.1) are always active. Cal.com's technical cookies (4.2.4) load as that section states.

4.3.3. The User may accept all categories, reject all of them (except the essential ones) or choose category by category, from the banner shown on entering the Site.

4.4. How to grant, change, or withdraw consent

4.4.1. On first entering the Site, the User sees a banner with options to accept, reject, or customize by category.

4.4.2. The User may change or withdraw consent at any time from the cookie preference panel, available in the Site's footer.

4.4.3. Withdrawing consent stops the loading of new Cookies in that category going forward. It does not delete those already placed on the device, which can be removed from the browser's settings.

4.4.4. The User may also block or delete Cookies directly in the browser. This may limit or prevent some Site features.

4.5. Browser signals (Do Not Track / Global Privacy Control)

4.5.1. Some browsers emit automatic privacy-preference signals, such as "Do Not Track" (DNT) or "Global Privacy Control" (GPC).

4.5.2. The Site does not respond automatically to those signals. The mechanism for expressing your preferences is the cookie preference panel in section 4.4.

5. Remission and transfer of personal data to third parties

This Notice distinguishes two cases:

• Processor (remission / "remisión"): communicating data to a person who processes it on the Responsible Party's behalf, under its instructions and with no independent use. It is not a transfer (Art. 2, fraction XX of the Law) and does not require your consent.
• Transfer: communicating data, within or outside Mexico, to a person other than the Data Subject, the Responsible Party, or its processor (Art. 2, fraction XX of the Law), who processes it for its own purposes. Pursuant to Articles 35 and 36 of the Law, the Responsible Party will communicate this Notice to the receiving third party and will offer you the chance to accept or reject the transfer through the mechanism in Clauses 3.2 and 4.3.

The third parties that receive data processed on the Site are:

Communications outside national territory. All five third parties are domiciled in the United States of America, so these communications leave national territory. Location does not change their classification (Art. 2, fraction XX of the Law); in a transfer, the receiving third party assumes the same obligations as the Responsible Party (Art. 35).

The Responsible Party does not sell, rent, or commercialize your personal data beyond what this clause describes.

6. Basis for processing and consent

Processing of the data in Clause 2 for the primary purposes (Clause 3.1) rests on the relationship you yourself initiate by registering on the waitlist and on your consent, which the Law deems given when, this Notice having been made available to you, you do not express the contrary (Art. 7 of the Law).

The secondary purposes (Clause 3.2) require your express, separate consent, granted through the mechanism in Clause 4.3.

Revocation. You may revoke your consent at any time, without retroactive effect, by writing to support@deliverycontrol.mx or through the Site's cookie preference center (Art. 7, last paragraph of the Law).

7. Options and means to limit the use or disclosure of the data

You may limit the use or disclosure of your personal data by:

1. Setting your preferences in the Site's cookie center (for the secondary purposes in Clause 3.2).
2. Writing to support@deliverycontrol.mx to request removal from the waitlist or to object to the processing (Art. 26 of the Law; the right to object forms part of the ARCO rights in Clause 8).

8. ARCO Rights

You have the right, at any time, to Access your personal data, have it Rectified when inaccurate or incomplete, have it Cancelled when you consider it unnecessary for the purposes described here, and to Object to its processing for specific purposes ("ARCO" rights), pursuant to Article 27 of the Law.

To exercise them, send your request to support@deliverycontrol.mx with: your name and a means of contact for our response; a clear description of the data and of the right you are exercising; and any document that helps locate your data (Art. 28 of the Law).

Timeframes. The Responsible Party will communicate its determination within a maximum of twenty (20) business days from receipt of the request and, if the request is well founded, will give it effect within the following fifteen (15) business days. Both periods may be extended once for an equal period where the circumstances justify it (Art. 31 of the Law; the business-day computation derives from Art. 2, fraction VIII).

Exercising ARCO rights is free of charge; the Responsible Party may only charge justified reproduction, copying, or shipping costs. If you repeat your request within a period of less than twelve months, the cost will not exceed three times the Unidad de Medida y Actualización (UMA) then in effect, unless substantial modifications to this Notice warrant the new inquiry (Art. 34 of the Law).

If you believe your request was not handled in accordance with the Law, or you received no response within the stated period, you may file a complaint with the Secretaría Anticorrupción y Buen Gobierno within the fifteen (15) business days following the response or, absent one, following expiry of the response period (Art. 40 of the Law). The Secretariat will resolve within a maximum of fifty (50) business days, extendable once for an equal period with justified cause (Art. 42 of the Law).

9. Data retention period and criteria

The Responsible Party retains your email address while you remain on the waitlist and, after your removal or onboarding as a customer, for the additional reasonable period required by legal, accounting, or claims-defense obligations. Technical data is retained only as long as strictly necessary for the Site's security and, where applicable, for analytics under consent; after that it is deleted or dissociated. Once those periods elapse, the data is cancelled pursuant to the Law.

10. Security measures

The Responsible Party applies reasonable and proportionate administrative, technical, and physical security measures to protect the personal data processed on the Site against damage, loss, alteration, destruction, or unauthorized use, access, or processing.

11. Notification of security breaches

If a security breach occurs that significantly affects your property or moral rights, the Responsible Party will inform you immediately, under Art. 19 of the Law, so that you can take the measures needed to defend your rights. The notification will include, at minimum, the nature of the incident, the data compromised, recommendations for you, the corrective actions taken, and where to obtain more information.

12. Automated decisions and profiling

The Responsible Party does not, on the Site, adopt decisions based solely on automated processing that produce legal effects on you or significantly affect you. The tools in Clauses 3.2 and 5 (Meta Pixel and Conversions API, GA4, PostHog) serve aggregate measurement and the optimization of campaigns and of the experience, not individualized decisions about you.

13. Minors

The Site is not directed at minors and does not intentionally collect their personal data. If the Responsible Party learns that data of a minor was collected without the authorization of the person exercising parental authority or guardianship, it will delete it.

14. Changes to this Privacy Notice

The Responsible Party may modify this Notice to address legislative developments, changes in its processing practices, or changes in its business model. Any modification will be communicated by publishing the updated version at deliverycontrol.mx, with the last-updated date in the header. We recommend you review this page periodically.

15. Competent authority

The competent authority in matters of protection of personal data held by private parties is the Secretaría Anticorrupción y Buen Gobierno (Anti-Corruption and Good Government Secretariat) (Art. 2, fraction XV of the Law).

16. Language and binding version

This Notice is issued in Spanish. If the Responsible Party makes available a translation into another language as an informational courtesy, the Spanish version shall be the only binding version for legal purposes.