Privacy Notice

01 Identity of the controller

ZERO CLM is a contract management service operated by ZERO Software Legal Suite (ZERO, we or us). ZERO acts as the data controller for personal data that it collects and for which it determines the purposes and means of processing through www.zeroclm.com and its own business operations. For personal data processed within the ZERO CLM platform solely on a customer's documented instructions, ZERO may act as a processor, depending on the service and the applicable agreement.

02 Applicable law

This notice is primarily governed by Mexico's privacy framework for personal data held by private parties. The principal law is the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), published on March 20, 2025, together with other applicable regulations and administrative provisions.

03 Personal data we process

To operate ZERO CLM, provide our services and meet our legal obligations, we may process the following personal data about you, whether you are a customer, a prospect, a signing user or a legal representative:

Identification and contact data

• First and last name.
• Business or personal email address.
• Landline and/or mobile phone number.
• CURP (Mexican population registry ID) or another government-issued identifier when required for the relevant service or verification process.
• Job title, role and the company you work for.

Electronic signature and authentication data

• Digitized handwritten signature, including stroke data.
• Electronic-signature and digital-certificate data where those features are used. Where applicable, NOM-151 mechanisms may be used to support the preservation and integrity of data messages and related evidence.
• Username, encrypted password and two-factor authentication data.
• Approximate geolocation at the time of signing (where it is used as evidence).

Billing and payment data

• Company or legal name, RFC (Mexican taxpayer ID) or another tax identifier where required for billing or compliance.
• Full registered tax address.
• Payment information required to process charges for the service. Card data, where applicable, may be processed directly by the payment provider used for the transaction.

Technical and usage data

• IP address, browser, operating system and device type.
• Access logs, including the date and time of sessions.
• Event logs for contracts: creation, editing, signing and download.
• Cookies and similar technologies (see section 11).

04 Purposes of processing

Primary purposes (required to provide the service)

1. Creating, authenticating and maintaining your user account.
2. Providing the contract lifecycle management (CLM) service: drafting, reviewing, signing, storing and tracking contracts.
3. Generating and preserving electronic evidence associated with signatures and contractual activity, including NOM-151 mechanisms in Mexico where applicable.
4. Processing payments, invoicing and collections.
5. Handling technical support and customer service requests.
6. Complying with legal, tax and regulatory obligations.
7. Detecting and preventing fraud, abuse or unauthorized use of the platform.

Secondary purposes (require your consent)

1. Sending marketing communications, news and product updates.
2. Statistical and market analysis to improve the user experience.
3. Invitations to events, webinars and the ZERO Academy community.
4. Satisfaction studies and voluntary surveys.

05 Grounds for processing

We process personal data only when the processing is permitted under applicable law. Depending on the activity, this may include consent, the maintenance or fulfillment of a legal or contractual relationship, compliance with legal obligations or another exception expressly permitted by law.

06 Transfers and processors

ZERO does not sell personal data. To operate the platform, however, we share certain data with technology providers that act as data processors, under contracts that require them to apply the same level of protection as ZERO.

Categories of third parties we share data with

• Cloud infrastructure: technology providers used to host, secure and operate the service. Processing locations and safeguards depend on the provider and are governed by applicable contracts and privacy requirements.
• Payment providers: providers used to process charges, recurring payments and related billing operations, subject to their applicable security and contractual requirements.
• Electronic signature and preservation providers: certification authorities and, where applicable, accredited certification service providers (PSC) that support electronic-signature, preservation or timestamping services.
• Identity verification services: partners for KYC (know your customer), KYB (know your business) and liveness checks, when the customer contracts the Z-ID module.
• Analytics and support tools: CRM, customer service and usage metrics, always under confidentiality agreements.
• Competent authorities: when there is a legal obligation, a court order or a duly grounded request.

07 Retention periods

We keep personal data only for as long as needed to fulfill the purposes of processing and meet applicable legal obligations:

• Account data: while the account is active and for up to 12 months after it is canceled.
• Contracts and electronic-signature records: for the period required by applicable law, the relevant customer agreement and ZERO's documented retention policy. Where NOM-151 preservation mechanisms are used, the applicable commercial and evidentiary retention requirements are followed.
• Tax and billing data: for the retention period required by applicable tax, accounting and commercial rules.
• Access and audit logs: up to 24 months for security and traceability.
• Marketing data: until the data subject exercises the right to object or revokes consent.

When these periods end, the data is securely deleted or anonymized, unless a legal obligation requires us to keep it longer.

08 Security measures

ZERO implements administrative, technical and physical safeguards designed to protect personal data against loss, alteration, destruction and unauthorized use, access or processing. Security controls are reviewed according to risk and the services involved.

If a personal-data security incident triggers a notification obligation, ZERO will notify affected data subjects and/or the competent authority as required by applicable law.

09 Your rights

As a data subject, you may exercise the rights available to you under applicable law.

10 How to exercise your rights

To exercise any of the rights described above, send a request to privacidad@zeroclm.com with the following information:

1. The data subject's full name and a way to receive our response (email address).
2. Information or documentation reasonably necessary to verify your identity. If you act through a representative, documentation establishing the representative's authority may also be required.
3. A clear and precise description of the personal data covered by your request.
4. The right you want to exercise and, where applicable, the reasons or documents that support your request.

Response times

• Mexico (LFPDPPP): requests are handled within the periods established by the applicable Mexican privacy framework.
• International users: if another privacy law applies, ZERO will respond within the period required by that law.

11 Cookies and similar technologies

The website www.zeroclm.com uses cookies and similar technologies (web beacons, pixels and local storage) to improve the user experience, analyze site performance and, in some cases, show relevant content.

Further information about the types of cookies used, their purpose, duration and available controls is provided through the site's cookie information and consent tools.

Cookies that are strictly necessary for the site to work are placed without prior consent, as permitted by applicable law. All other cookies require your express consent, which you can give or withdraw through the cookie banner shown when you visit the site.

12 Changes to this privacy notice

ZERO reserves the right to modify or update this privacy notice at any time to reflect changes in how the service operates, in applicable law or in our internal privacy practices.

Any changes will be published on www.zeroclm.com, showing the date of the last update. Where applicable law or the nature of the change requires additional notice or consent, ZERO will provide it through an appropriate channel.

We recommend that you review this notice regularly to stay informed about how we protect your information.

13 Users outside Mexico

ZERO is based in Mexico. If you use our website or platform from another country, your personal data may be processed in Mexico and, where service providers are involved, in other locations described in section 06.

This notice is primarily based on Mexican privacy law. Depending on where you are located and the circumstances of the processing, another privacy law may also apply and may grant you additional rights. ZERO will address those rights and requirements to the extent that they are legally applicable.

To ask about privacy rights that may apply to you outside Mexico, contact us at privacidad@zeroclm.com.