Privacy notice

1. Data controller

abierto.io, a technology platform operated by CAJANAUTA PUNTO COM S.A.P.I. DE C.V., with its registered address at Zamora 165, Colonia Condesa, C.P. 06140, Ciudad de México, is responsible for the use and protection of your personal data.

For questions about this notice, write to hola@abierto.io.

2. Personal data we collect

We collect only the data you submit through forms on this site and technical browsing data.

• Identification and contact data: first name, last name, email address, phone, company and role.
• Commercial profile data: type of operation (seller, warehouse or agency), sales channels and approximate order volume.
• Investor profile data, when you use the Investor Relations form: fund or vehicle, role, country, typical ticket range.
• Browsing data: IP address, browser type, pages visited, and date and time of access.

3. We do not collect sensitive data

We do not request or process sensitive personal data. This includes data that could reveal racial or ethnic origin, health status, genetic information, religious, philosophical or moral beliefs, union membership, political opinions or sexual preference.

4. Purposes of processing

Primary purposes necessary for our relationship with you:

• Handling your product demo request and contacting you about it.
• Assessing your operating profile to prepare a relevant demo.
• Handling requests for information about our investment round and, where applicable, granting data room access.
• Providing support, answering questions and managing the commercial relationship.

5. Secondary purposes

Unless you object, we may also use your data to send product communications, event invitations, educational content about marketplace operations and satisfaction surveys.

You can object to processing for these secondary purposes at any time by writing to hola@abierto.io or using the unsubscribe link in each communication. Objecting does not affect how we handle your original request.

6. Transfers and processors

We do not sell or trade your personal data. To operate the site and manage contacts, we use providers that act as data processors and may use the data only according to our instructions:

• Brevo (Sendinblue SAS, France): contact management and email delivery.
• Amazon Web Services (AWS): hosting the site's infrastructure.
• Vonaut, the agency linked to the founding team: commercial handling of demo requests.

7. ARCO rights

You have the right to know what personal data we hold, how we use it and the conditions of that use (Access); request corrections when your information is outdated, inaccurate or incomplete (Rectification); ask us to remove it from our records when you believe it is not being used according to the principles and duties established by law (Cancellation); and object to its use for specific purposes (Objection).

To exercise any of these rights, send a request to hola@abierto.io. Include your full name, a way for us to communicate our response, a clear description of the data concerned and a copy of official identification proving your identity.

We will respond within twenty business days of receiving the request and, where applicable, act on it within the following fifteen business days.

8. Withdrawal of consent

You may withdraw your consent to the processing of your personal data at any time by sending a request to hola@abierto.io. In some cases, legal obligations may prevent us from stopping its use immediately.

9. Cookies and tracking technologies

This site uses only the cookies required for operation, including a technical cookie that records when you submit the Investor Relations form so we do not request your details again.

We do not use third-party advertising cookies. If we add analytics or advertising tools, we will update this notice first. You can disable cookies in your browser settings, though some site functions may stop working correctly.

10. Security measures

We apply reasonable administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access or processing. These measures include TLS encryption in transit and access controls that limit the contact panel to staff who need it.

11. Changes to this notice

This notice may change because of new legal requirements, our needs or changes to our business model. We will publish each modification on this page and show the last-updated date in the header.

12. Supervisory authority

If you believe your right to personal data protection has been infringed, you may file a complaint with the competent Mexican data protection authority.