Aviso de Privacidad Integral

Date of last update: June 13, 2026

Through this Comprehensive Privacy Notice (the “Privacy Notice”), CM Identidad, S.A.P.I. de C.V. (“SORA”) informs you of the terms under which the Personal Data (as such term is defined below) collected through the website, the technological platform, and other means enabled for the provision of its services will be processed. 

For the purposes of this Privacy Notice, it is important to note that, depending on the context in which the Personal Data is collected and used, SORA may act: (i) as Controller (as such term is defined below), when it directly determines the purposes and means of the processing; or (ii) as Processor (as such term is defined below), when it processes Personal Data on behalf of and under the documented instructions of a Client, particularly when the User is redirected by an Association or by the Client itself as a result of an Integration Project.

Therefore, we recommend that you carefully read the following information:

1. DEFINITIONS.

Terms written with an initial capital letter shall have the meaning attributed to them in this Privacy Notice, applicable indistinctly in singular or plural and in feminine or masculine gender, as corresponds to the context.

“Association”: Means any legal entity, entity, organization, or association that maintains a direct relationship with the Users, whether of a labor, contractual, commercial, or any other nature, and that is linked to the Client for the purposes of access, use, or utilization of SORA's Services. The Association may redirect Users, directly or indirectly, to the Site and/or the Platform, but this does not, in itself, imply that it has the character of Controller or Processor, which will depend on the specific case and the Applicable Regulations.

“Client”: Means any physical or legal person who contracts SORA's Services and who determines the purposes and means of the processing of the Personal Data of the Users in relation to said Services, and thus shall have the character of controller of the processing of such Personal Data.

“CURP”: Unique Population Registry Code.

“Biometric Data”: Personal Data obtained from specific technical processing, relating to the physical, physiological, or behavioral characteristics of a physical person that allow or confirm the unique identification of that person, such as facial images and/or videos.

“Personal Data”: Any information concerning an identified or identifiable physical person, including, where applicable, Sensitive Personal Data and Biometric Data.

“Sensitive Personal Data”: Those Personal Data that affect the most intimate sphere of the Data Subject or whose misuse may generate discrimination or imply a serious risk for them, including, but not limited to, information about racial or ethnic origin, present or future health status, genetic information, religious, philosophical, or moral beliefs, political opinions, sexual preference, and Biometric Data.

“ARCO Rights”: The rights of access, rectification, cancellation, and opposition that the Data Subject may exercise regarding their Personal Data, in accordance with the provisions of the Applicable Regulations.

“Documents”: Means any document, contract, agreement, format, or Data Message, in electronic or digital format, that the Client, the Administrator Users, and/or the Users upload, generate, send, or make available through the Platform, for their electronic signature and/or the management of said documents.

“Processor”: Means SORA, who processes the Personal Data on behalf of the applicable Controller, in accordance with their documented instructions and without deciding on the purposes of the processing of such Personal Data.

“Data Messages”: Means the information generated, sent, received, or archived by electronic, optical, or any other technology.

“Mexico”: United Mexican States.

“Applicable Regulations”: The Federal Law on Protection of Personal Data Held by Private Parties, its Regulations, and other applicable provisions in the field.

“Platform”: The technological platform, system, interface, software, administration panels, APIs, and other technological elements operated by SORA for the provision of the Services.

“Integration Project”: Any technological, operational, or contractual scheme through which the Client and/or the Association connect, link, or integrate their systems, databases, flows, applications, interfaces, or processes with the Platform, or redirect Users to it, such that SORA processes Personal Data on behalf of the Client.

“Controller”: Means the person who, in each specific case, decides on the purposes and means of the processing of Personal Data, which may be: (i) SORA, when acting in its own capacity as controller; or (ii) the Client, when SORA acts as Processor on its behalf, including those cases where the processing of Personal Data derives from an Integration Project.

“RFC”: Federal Taxpayer Registry.

“Services”: The services provided by SORA under the SaaS (Software as a Service) modality, including, but not limited to, electronic signature services, document management, digital files, payroll receipt signing, automations, APIs, integrations, and other functionalities associated with the Platform.

“Site”: Means the website, microsites, portals, applications, forms, landing pages, or any other digital interface operated directly by SORA or enabled by it for the promotion of its Services.

“SORA”: CM Identidad, S.A.P.I. de C.V.

“Data Subject”: The physical person to whom the Personal Data corresponds.

“Users”: The persons who access, register, use, interact with, and/or navigate the Site and/or the Platform, either directly with SORA or by instruction, authorization, or redirection of the Client and/or the Association.

“Administrator Users”: Means the physical persons designated by the Client, under its exclusive responsibility, with powers to administer the use of the Platform in relation to the applicable Integration Project, including, but not limited to: (i) managing, uploading, and organizing Documents; (ii) registering, enabling, modifying, or deleting Users; (iii) defining signature flows; and (iv) execution of any other administration actions necessary for the operation of the Integration Project.

For the purposes of this Privacy Notice, the terms "we", "us", or "our" shall refer to SORA only when it acts in its capacity as Controller. When SORA acts as Processor, any reference to the controller of the processing shall be understood as being made to the Client.

2. OF THE CONTROLLER AND THE PROCESSOR.

SORA is a legally constituted and existing corporation under Mexican law and, when acting as the Controller, will be responsible for the processing of your Personal Data, designating as its address C. 20 de Noviembre #748 Sur, Col. Ex Seminario, Monterrey, Nuevo León, Mexico, C.P. 64049 and as contact email regarding privacy matters legal@sora.mx.

This Privacy Notice covers the following scenarios:

(a) SORA as Controller: SORA will have the character of Controller when it collects and processes Personal Data directly for its own purposes, including, but not limited to, the management of its relationship with Clients and prospects, the direct provision of its Services, account management, support services, the security of its technological infrastructure, compliance with legal and contractual obligations, billing, collection, and the improvement of its Site, Platform, and Services.

(b) SORA as Processor: SORA will have the character of Processor when it processes Personal Data on behalf of the Client, in accordance with their documented instructions, particularly when the User: (i) is redirected by an Association or by the Client; (ii) accesses the Platform within the framework of an Integration Project; or (iii) uses the Services by virtue of a legal, labor, commercial, or other relationship maintained directly or indirectly with the Client or with the Association linked to it.

In the cases provided in section (b) above, the applicable Controller will be the Client, whose identity, address, and contact means must be made available to the Data Subject by said Client, by the corresponding Association, or through the specific workflow of redirection, registration, invitation, contracting, document, interface, or complementary notice that is applicable.

For the provision of the Services, the processing of Personal Data may be carried out through the Site and/or the Platform, either directly by SORA in its capacity as Controller or by SORA in its capacity as Processor on behalf of the Client. In both cases, SORA may rely on third-party providers acting as processors or sub-processors, in accordance with the Applicable Regulations and, where applicable, the authorizations and instructions of the applicable Controller.

3. PERSONAL DATA PROCESSED.

Depending on the applicable scenario, the nature of the Services, and the workflow of use of the Site and/or the Platform, SORA may collect and process, directly or indirectly, on behalf of and in accordance with the instructions of the applicable Controller when acting in its capacity as Processor, or in its own capacity as Controller when corresponding to the scenario provided in Section 2 (two) above, the following categories of Personal Data:

(a) Identification and contact data: full name; gender; age; official identifications; email; CURP; and telephone number.

(b) Tax data: corporate name or denomination; RFC key; tax address; tax regime; and line of business or main economic activity. 

(c) Access and authentication data: Username; password; and any other additional authentication mechanisms that may be implemented for access to the Site and/or the Platform.

(d) Technological and usage data: date and time of access; navigation, scrolling, and interaction records within the Site and/or the Platform; functionalities accessed and used; and time and/or frequency of use of the Site and/or the Platform.

(e) Biometric Data: Information about your physical characteristics, such as elements of your facial recognition, which will be processed through the Platform by the Processor and, where applicable, by its sub-processors, with the purpose of validating the User's identity and ensuring security in the provision of the Services.

(f) Data regarding the digital security certificate: serial number; issuing certification authority; signature algorithm; validity; name of the digital certificate holder; email address of the digital certificate holder; CURP of the digital certificate holder; public key; and any other data required as additional requirements by the Advanced Electronic Signature Law.

(g) Additional data: comments, opinions, inquiries, or feedback provided; support requests made and communication messages sent; information shared voluntarily during the ordinary use of the Site and/or the Platform; and information or documentation uploaded manually to the Site and/or the Platform.

Personal Data may be obtained by the applicable Controller through any of the following means: (i) directly from the Data Subject; (ii) indirectly through the Client, the Association, administrator users, representatives, authorized third parties, or integrated systems; or (iii) automatically through the use of the Site, the Platform, and the technologies enabled on them. However, the Personal Data referred to in subsections (e) and (f) will be collected directly through the Platform. 

In the case of Documents, files, receipts, agreements, formats, Data Messages, PDF files, XML, videos, evidence, contracts, and other content that the Client, the Association, the Administrator Users, or the Users themselves upload, generate, send, or make available through the Platform, such contents may contain additional categories of Personal Data determined by the Client. In such cases, when SORA acts as Processor, it will not define the substantive content of such documents nor the purposes of their processing, limiting itself to processing them in accordance with the Client's instructions and the functionality of the corresponding Integration Project.

In the event that the User voluntarily provides Sensitive Personal Data in addition to those expressly requested, the Controller will endeavor to preserve its confidentiality as far as possible and may, if applicable, delete such information unilaterally and without prior notice to the corresponding User.

By accessing the Services and/or using the Platform, the User grants their consent for the Controller and its Processor to carry out the processing of their Personal Data in accordance with the provisions of this Privacy Notice, without prejudice to their right to revoke said consent, at any time, through the procedure provided in Section 8 (eight) of this Privacy Notice.

When SORA acts as Processor, it will not use Personal Data for its own purposes incompatible with the Client's instructions, nor will it assume the character of Controller solely by reason of providing technical, operational, storage, hosting, support, authentication, signature, safeguarding, or transmission processing of such Personal Data on behalf of and for the account of the Client.

4. PURPOSES OF THE PROCESSING OF PERSONAL DATA.

The purposes of the processing will depend on the capacity in which SORA intervenes in each specific case:

(a) When SORA acts as Controller, your Personal Data may be processed for the following:

Primary purposes:

• Contractual and legal: (i) to comply with the contractual and legal obligations of SORA towards the Client; and (ii) to notify the User of any update, modification, or change to this Privacy Notice, as well as to other corresponding legal agreements.

• Operational: (i) to properly provide, operate, manage, and/or execute the Services of the Platform; (ii) to process the User's Personal Data for the correct provision of the Services; (iii) to manage the commercial relationship with the Client; (iv) to create, manage, and maintain User accounts on the Platform; (v) to communicate information related to the contracted Services to the Client; and (vi) to provide customer service, technical support, and operational assistance in relation to the Platform.

• Maintenance, improvement, and optimization: (i) to monitor the operation of the Services and/or the Platform; (ii) to detect errors, technical failures, or vulnerabilities; (iii) to validate and optimize processes, calculation mechanisms, and functionalities; (iv) to identify areas of opportunity for correction, continuous improvement, and updating of the Services and/or the Platform; (v) to identify areas of opportunity for the training, validation, and improvement of algorithms; and (vi) to improve the User experience in relation to the Services.

• Security: (i) to authenticate and validate the User's identity on the Platform; (ii) to prevent, detect, and mitigate unauthorized access, fraud, misuse, or illegal activities; and (iii) to implement, maintain, and strengthen security measures.

• Analogous or compatible: Purposes that, without being identical, are compatible or analogous with those described above, provided they do not require obtaining the User's consent again.

Secondary purposes:

• Marketing, advertising, and commercial prospecting: (i) to inform about promotions, discounts, benefits, and offers; (ii) to perform cross-selling and/or incremental sales activities; (iii) to use the Client's image in promotional material; (iv) to disseminate testimonials, opinions, and success stories; and (v) to publish content on social networks, digital or institutional media of SORA.

• Statistical and analytical: (i) to conduct market studies; (ii) to analyze consumption habits and behavior of the Users; (iii) to identify usage trends and patterns; (iv) to generate metrics, reports, and internal indicators; (v) to improve functionalities, processes, and Services; and (vi) to conduct surveys, evaluations, and measurements of User satisfaction.

(b) When SORA acts as Processor on behalf of the Client, in such cases, SORA will process the Personal Data exclusively on behalf of the Client and in accordance with their documented instructions, for the purposes that said Client determines in relation to their link with the Users and with the contracted Services. In this scenario, it will correspond exclusively to the Client, in their capacity as Controller, to specifically inform the Data Subject of the primary and, where applicable, secondary purposes of the processing of their Personal Data, as well as any other information that must be made available to them under the Applicable Regulations.

Such purposes may include, but are not limited to, the following:

• Create, manage, and maintain User accounts;

• Allow access, authentication, and use of the Platform;

• Enable electronic signature flows, identity validation, safeguarding, consultation, administration, and organization of Documents or files;

• Manage labor, administrative, contractual, corporate, tax, or documentary processes of the Client;

• Upload, process, transmit, store, consult, and organize Documents, files, payroll receipts, evidence, data messages, and other files;

• Provide technical support and operational assistance related to the Platform;

• Maintain, secure, and technically improve the operation of the Platform for the benefit of the Client;

• Prevent, detect, and mitigate unauthorized access, fraud, misuse, or security incidents; and

• Comply with the contractual, regulatory, or legal obligations that correspond to the Client.

You have a period of 5 (five) business days from the date of receipt of this Privacy Notice to express your refusal for the processing of your Personal Data for secondary purposes, in accordance with the procedure provided in Section 8 (eight) of this Privacy Notice.

Refusal to process for secondary purposes will not affect the processing of Personal Data for primary purposes. In no case will access to the Platform be conditioned on authorization for the processing of Personal Data for secondary purposes.

When SORA acts as Processor, it will retain the Personal Data only for the period necessary to comply with the Client's instructions, the contract entered into with them, the Applicable Regulations, and the legal obligations enforceable on SORA. Once the processing or corresponding relationship is concluded, SORA will proceed with the return, deletion, blocking, removal, or restricted preservation of the information, as corresponds in accordance with the Client's instructions, the Applicable Regulations, and the legal obligations on SORA.

5. LIMITATION OF THE REMISSION OF PERSONAL DATA. 

(a) When SORA acts as Controller: it may remit the Personal Data of the Data Subject, within or outside Mexico, to third-party processors, provided that such processing is carried out in accordance with its instructions and exclusively for the fulfillment of the purposes provided in Section 4 (four) of this Privacy Notice and in accordance with the Applicable Regulations.

In this sense, Personal Data may be made available to: (i) providers of operational, technological, IT, or information processing services, derived from contracting subrogated services; (ii) third-party service providers or vendors that are necessary for the operation, functioning, or administration of the Services, the Site, and/or the Platform; and (iii) competent administrative, government, or judicial authorities, when there is a duly founded and motivated legal requirement.

(b) When SORA acts as Processor: any transfer of Personal Data decided by the applicable Controller will correspond to the Client, who will be responsible for informing the Data Subject and, where applicable, obtaining the necessary consent. Likewise, the User is informed that, for the proper provision of the Services and the execution of the Integration Project, SORA has the authorization of the applicable Controller to subcontract or rely on certain service providers, third-party service providers, sub-processors, and other auxiliary third parties necessary for the operation, functioning, support, maintenance, security, identity validation, processing, storage, or administration of the Site, the Platform, and/or the Services, who will process the Personal Data on behalf of the applicable Controller and in accordance with the corresponding instructions.

In both scenarios, SORA may rely on processors and/or sub-processors. Access to Personal Data by said third parties will not be considered a transfer under the terms of the Applicable Regulations, to the extent that they act on behalf of the applicable Controller and in accordance with the corresponding instructions.

The communication of Personal Data to authorities may be carried out, among other cases: (i) when there is a legal obligation; (ii) when necessary for the attention, investigation, prevention, or prosecution of allegedly unlawful conduct, fraud, or other crimes; or (iii) when details are indispensable to safeguard the security, integrity, or functioning of the Services and/or the Platform.

SORA will, under no circumstances, sell, assign, or lease Personal Data for commercial, advertising, or marketing purposes unrelated to the authorized purposes.

When SORA acts as Controller, the Data Subject will have a period of 5 (five) business days from the date they become aware of this Privacy Notice to express their refusal regarding the transfer of their Personal Data, by sending the corresponding request to SORA in accordance with the procedure provided in Section 8 (eight) of this Privacy Notice. In the event of not receiving any expression within the specified period, it will be understood that the Data Subject has granted their consent for such transfers, except in those cases where, in accordance with the Applicable Regulations, the consent of the Data Subject is not required.

On the other hand, when SORA acts as Processor, any refusal regarding transfers must be expressed to the Client acting as the applicable Controller, in accordance with the procedures established by the latter.

6. USE OF TRACKING TECHNOLOGIES.

The Site and the Platform use tracking technologies, such as cookies, web beacons, and some provided by third parties such as Microsoft Clarity, to collect information about the User's navigation.

These technologies may collect data such as browser type, operating system, pages visited, IP address, usage patterns, device type, cursor movements, rage clicks, scrolling, heat maps, and other information about interaction with the website, with the purpose of facilitating the functioning of the Platform, improving and optimizing the User experience, and ensuring the security of the Services, in accordance with the purposes defined by the Controller. 

The use of these technologies provided by third parties, including but not limited to Microsoft Clarity, and the data that could be collected by them, will be processed in accordance with the privacy policies of the corresponding provider of such technologies. To know how Microsoft processes Personal Data, you can consult their privacy notice at: https://privacy.microsoft.com/en-us/privacystatement. Notwithstanding the foregoing, these tracking and analytic technologies implemented in the Platform and/or the Site do not have the purpose of accessing, analyzing, or collecting the content of the Documents or Personal Data or any information processed within the Site and/or the Platform.

The use of said technologies may be implemented by the Processor, who acts on behalf of the Controller and in accordance with their instructions.

The User may disable the use of these technologies through their internet browser settings, including but not limited to, rejecting or deleting cookies, as well as managing their preferences regarding the analysis technologies indicated in this section.

The use of the Site and/or the Platform implies acceptance of the use of these technologies under the terms of this Privacy Notice.

7. PROTECTION OF PERSONAL DATA.

With the purpose of ensuring the protection and confidentiality of Personal Data, SORA has adopted and maintains administrative, technical, and physical security measures, implemented in accordance with industry standards and best practices, aiming to prevent damage, loss, alteration, destruction, misuse, unauthorized access, or unlawful processing of said Personal Data.

In particular, measures have been implemented that include, among others, restricted access control schemes based on profiles and roles, ensuring that only duly authorized personnel can access Personal Data and only to the extent strictly necessary for the fulfillment of the purposes provided in this Privacy Notice.

8. ARCO RIGHTS.

You, or your legal representative, have the right to: (i) access your Personal Data in the possession of the Controller and know the details of its processing; (ii) rectify them when they are inaccurate, incomplete, or out of date; (iii) cancel them when you consider that they are not required for the purposes indicated in this Privacy Notice; and (iv) oppose the processing of the same for specific purposes. Likewise, you may request the limitation of their use or disclosure, as well as revoke the consent previously granted for their processing, except in those cases where the Applicable Regulations provide otherwise.

(a) When SORA acts as Controller, to exercise ARCO Rights, the Data Subject must submit a written request addressed to SORA at the following email: legal@sora.mx, which must contain, as a minimum, the following information:

1. Full name, address, and email address to receive notifications. 

2. Valid official documents proving the identity of the Data Subject, or, where applicable, documents proving their legal representation.

3. Clear and precise description of the Personal Data regarding which one seeks to exercise any of the ARCO Rights.

4. Specification of the ARCO Right wishing to be exercised.

• In case of cancellation, revocation of consent, or opposition to the processing of Personal Data, it must be indicated whether the request is total or partial.

• In case of rectification, the requested modification must be specified and accompanied by safety documentation. 

5. Any other element or document that facilitates the location of the Personal Data.

SORA will respond to the request within a maximum period of 20 (twenty) business days from its receipt, indicating the determination adopted. If deemed appropriate, the request will be made effective within 15 (fifteen) business days following the communication of the response. These periods may be extended only once for an equal period when circumstances justify it.

The exercise of ARCO Rights is free of charge; however, the Data Subject must cover the justified shipping costs or costs for reproduction of copies or formats that may be generated. When the User repeats their request in a period of less than 12 (twelve) months, SORA may apply an additional cost in accordance with the limits established in the Applicable Regulations.

(b) When SORA acts as Processor on behalf of the Client: In this scenario, the request to exercise ARCO Rights, limit the use or disclosure of Personal Data, or revoke consent must be addressed to the Client acting as the applicable Controller, under the terms of the privacy notice, mechanisms, or procedures that the latter has made available to the Data Subject.

Notwithstanding the foregoing, if the Data Subject sends a request directly to SORA in a case where SORA acts only as Processor, SORA may: (i) inform the Data Subject that they must direct their request to the Client; and/or (ii) when reasonable and possible, channel the request to the corresponding Client, without this implying assuming the character of Controller or replacing the Client in resolving it.

In any case, when SORA acts as Processor, it will assist the Client in responding to requests related to ARCO Rights, limitation of use, opposition, or revocation, in accordance with the instructions provided by the Client and the applicable contractual obligations.

9. MODIFICATIONS TO THE PRIVACY NOTICE.

SORA reserves the right to modify, update, or add to this Privacy Notice, in whole or in part, at any time.

Any modification will be made available to Users by publishing it on the Site and/or the Platform and, where applicable, by notification sent to the email address provided by the Data Subjects for the registration of their respective User account.

When SORA acts as Controller, such modifications will take effect as of the next business day following the date of their publication.

When SORA acts as Processor, the Client will be responsible for informing the Data Subject of specific modifications related to: (i) their identity and contact data as applicable Controller; (ii) the purposes they determine; (iii) the transfers they decide to make; and (iv) any other particular condition of the processing that depends on said Client. The foregoing without prejudice to the fact that SORA may publish or display such updates on the Site and/or the Platform when so instructed or when necessary for the operation of the Service.

The utilization, access, or use of the Site and/or the Platform by the User, as well as the existence of active or inactive accounts on the Platform after the publication or notification of said modifications, will constitute an expression of conformity and acceptance of the current version of this Privacy Notice, to the extent permitted by Applicable Regulations.

10. ACCEPTANCE OF THE PRIVACY NOTICE.

The Data Subject declares to have read, understood, and accepted this Privacy Notice.

When the Applicable Regulations require the consent of the Data Subject for the processing of their Personal Data, such consent may be collected through physical, electronic, optical, sound, visual means, or any other legally permitted technology, including, but not limited to, acceptance buttons, checkboxes, electronic signatures, biometric mechanisms, validations within the Integration Project, the Site, and/or the Platform, or any other procedure that allows identifying the Data Subject and preserving evidence of their expression of will.

In this sense:

(a) When SORA acts as Controller, it will be understood that the Data Subject expresses their consent and acceptance of this Privacy Notice, as corresponds under the Applicable Regulations, through any of the following acts:   (i) the utilization, access, or use of the Integration Project, the Site, and/or the Platform; (ii) the contracting or use of the Services; (iii) the creation or possession of an account, whether active or inactive, on the Platform; (iv) the selection of buttons identified with labels such as "Log In", "Accept", "Continue", or equivalents; or (v) the execution of any act implying their acceptance.

(b) When SORA acts as Processor, the consent of the Data Subject regarding the processing of their Personal Data must be collected by the Client acting as Controller or in their name, through the mechanisms they determine, including those that are enabled by SORA within the Platform by instruction of the Client.

Likewise, the Data Subject acknowledges that their expression of will may be collected by electronic means and that a digital or printed version of this Privacy Notice and the corresponding evidence may be admissible as evidence in any judicial or administrative proceeding.

In case of not agreeing with this Privacy Notice, the Data Subject must refrain from accessing, using, or continuing to use the Site, the Platform, and/or the Services.

11. ADDITIONAL INFORMATION.

(a) Headings: References to headings contained in this Privacy Notice are for reference purposes only and will not affect the interpretation, scope, or application of any of the provisions set forth herein.

(b) Minors under 18 years: SORA does not intentionally collect Personal Data of minors under 18 (eighteen) years. In the event that it becomes known that a minor of said age has provided Personal Data to SORA, the necessary measures will be adopted to delete said information from our records as soon as possible. If you believe we might have information of this nature, we ask you to contact us via the email legal@sora.mx of the Privacy Department: 

(c) Applicable Legislation and Jurisdiction: This Privacy Notice shall be governed, interpreted, and applied in accordance with the current federal laws of Mexico and, supplementarily and as applicable, by the applicable legislation of the State of Nuevo León, Mexico. For the interpretation, compliance, execution, and validity of this Privacy Notice, the parties expressly submit to the jurisdiction of the competent courts of the city of Monterrey, Nuevo León, Mexico, expressly waiving any other jurisdiction that might correspond to them by reason of their present or future address, or for any other cause.

(d) Questions, concerns, or general claims: If you have comments or questions about our privacy practices, concerns related to your Personal Data, or wish to present a claim regarding the processing of the same: (i) when SORA acts as Controller, you may communicate with SORA through the email: legal@sora.mx; and (ii) when SORA acts as Processor, you must communicate with the Client acting as the Applicable Controller, without prejudice to also being able to contact SORA for guidance or reasonable redirection of your request.