FIRMA SEGURA, S. DE R.L. DE C.V. (“Mifiel”)
Version: 3.0
Last updated/revised: August 25, 2025
This Notice applies to www.mifiel.com and to related applications, APIs, and tools (the “Sites” and “Services”), regardless of the medium or device used to access them.
1) Identity and address of the Data Controller
Data Controller: FIRMA SEGURA, S. DE R.L. DE C.V.
Privacy contact (ARCO rights): seguridad@mifiel.com
When Mifiel processes data on behalf of a client (e.g., API integration), it acts as a Processor. In such cases, the client's privacy notice governs the relationship with signers/end-users, and Mifiel follows the client's contractual instructions.
2) Personal data processed
2.1 Identification and contact: first name, last name, email address, phone numbers, contact methods, RFC, and tax address.
2.2 Transactional and billing data: tax information, CFDI, references, and payment methods.
2.3 Technical and usage data: IP address, device identifiers, OS and browser, time zone, language, logs, interaction with the Sites, cookies, and similar technologies.
2.4 Digital certificates (e.firma/FIEL): serial number, issuing certification authority, algorithm, validity, holder's name, email, CURP, public key, and metadata.
2.5 Electronic document content: when uploaded by the user/client to operate the Services (the content belongs to the user/client)
2.6 Biometrics (sensitive data, where applicable): facial biometrics (selfie, liveness check, and comparison with official document image) for simple electronic signature workflows with verification
2.7 Sources of collection: directly from the data subject (forms, use of Sites, emails), indirectly from certification authorities and payment providers, and technological (cookies, telemetry, and logs).
For NOM-151 certificates, Mifiel transmits only the document hash value to the PSC; it does not share the document content.
3) Purposes of processing
Primary (necessary): account identification and management; provision/operation of Services (including electronic signature and NOM-151); digital certificate verification; authentication; billing and collections; compliance with legal obligations; security, availability, and operational improvement (telemetry, logs, and auditing).
Secondary (not necessary): commercial communications, surveys, and non-identifiable analytics for improvement.
If you do not wish for your data to be processed for secondary purposes, you may express your refusal within 5 (five) business days after your data is collected, or at any time thereafter by sending an email to seguridad@mifiel.com. Your refusal will not affect the primary purposes.
4) Legal basis and consent
We process data in accordance with applicable Mexican legislation on personal data protection, based on the data subject's consent and, where applicable, other legal bases (legal relationship, contract performance, compliance with obligations, defense of rights, security, and fraud prevention). For biometric data and other sensitive information, we obtain express consent.
5) Transfers and transmissions
Transmissions to Processors (no consent required): cloud/telecommunications services, security/monitoring, PSC for NOM-151 (hash), support, and billing.
Transfers: competent authorities; law firms/auditors for the exercise or defense of legal claims; corporate operations (mergers/acquisitions) with contractual safeguards.
When necessary, Mifiel will request prior consent. International transfers are carried out with adequate safeguards.
6) Cookies and similar technologies
We use cookies to operate the site, remember preferences, measure performance, and improve our Services. You may disable them in your browser settings; however, some features may be affected. For more details, please consult the Cookie Policy available on our Sites.
7) Retention, suppression, and deletion of documents
We retain data as long as the relationship exists and, thereafter, for legal or defense periods. Upon conclusion, we apply secure deletion or dissociation. If you request the deletion of documents uploaded to the Sites, Mifiel will address the request according to the Service's functionality and applicable regulations; certain evidentiary records (e.g., NOM-151 certificates, audit logs) may be retained when necessary for compliance or defense.
8) Security measures
We apply administrative, technical, and physical measures proportional to the risk: encryption in transit and at rest, MFA, access control, environment segregation, logging/auditing, vulnerability management, and business continuity.
9) ARCO rights and other rights
To exercise Access, Rectification, Cancellation, or Opposition, revoke consent, or limit use/disclosure, send a request to seguridad@mifiel.com.
Minimum requirements: name, contact method for response, description of the right, elements to locate data, and a copy of identification.
Indicative legal deadlines: up to 20 business days to respond and, where applicable, an additional 15 business days to execute, in accordance with current regulations.
10) Minors
The Sites and Services are not directed at minors. If we detect processing without a valid basis, we will proceed with its timely deletion.
11) Changes to the Privacy Notice
We will publish the current version at www.mifiel.com/es/privacy with the date of last update. When there are substantial changes, we will communicate them via a prominent notice on the Sites.
12) Acknowledgments and definitions
This Notice is issued in accordance with current legislation (2025) in Mexico regarding the protection of personal data in the private and public sectors, as well as the criteria and guidelines issued by the competent authority in the matter. The terms "Controller," "Processor," "Transfer," "Transmission," "Sensitive data," etc., are interpreted according to said regulations.
13) Acceptance
By using the Sites or contracting the Services, you acknowledge that you have read and understood this Notice and, where applicable, provide your consent for the purposes described. For secondary purposes or the processing of sensitive data, Mifiel will obtain additional consent when required.
All rights reserved © FIRMA SEGURA, S. DE R.L. DE C.V. Mexico, 2025.
