Privacy Notice

This is a courtesy translation. The Spanish version published at bimxcloud.com/legal/privacidad is the only binding text; in case of discrepancy, the Spanish version prevails.

1. Who is responsible for your personal data

BIMXPERTS INTERNATIONAL, S.A. de C.V. ("bimXperts International"), trading as BIMXcloud, is the data controller (responsable) for your personal data.

• Address: Espora 226, Col. El Jaralillo, C.P. 98085, Zacatecas, Zacatecas, Mexico
• Tax ID (RFC): BIN150824TI8
• Privacy contact: support@bimxcloud.com
• Department handling requests: Office of the Managing Director

BIMXcloud and bimXperts International are the same legal entity. BIMXcloud provides managed cloud infrastructure for architecture and engineering firms: hosted Revit Server, management systems and private file storage.

2. Scope: two different roles

This notice covers the personal data BIMXcloud processes as controller: data about people who visit our site, request information or a demo, purchase our services, and use administration accounts.

It does not cover personal data contained inside the files, models and databases our customers store on the servers they rent from us. For that content BIMXcloud acts as processor (encargado): the customer is the controller and decides what is stored, why and for how long; we only host and back it up on their behalf and under their instructions, as set out in Annex A of our Terms and Conditions. See section 7.

If you are a client or employee of a firm that uses BIMXcloud and want to exercise rights over data held in that firm's files, please contact the firm. If such a request reaches us, we will refer it to our customer.

3. What personal data we process

a) Website visitors (no account)

• Contact form: name, email, company, phone.
• Demo access: name and email.
• AI assistant: the content of your conversation and any contact details you provide. The conversation is processed by a third-party artificial intelligence service (see section 8) and kept on our side as a lead record.
• Technical server logs: IP address, user agent, timestamps. These are operational and security logs and are not linked to customer records or hosted content.
• Site measurement via Google Analytics: a browser identifier stored in a first-party cookie, your IP address (which Google uses to derive an approximate location and does not retain), device and browser type, pages visited and referring site. We do not use this to identify you personally. See section 12.

b) Customers and service users

• Billing: legal name, RFC, tax address, email, phone.
• Payments: your card or account details are captured and processed directly by PayPal. BIMXcloud does not receive, see or store card numbers. We keep only the transaction outcome (transaction ID, amount, date, status).
• Account and administration: names and emails of users authorised by the customer, and server access credentials.
• SMS collections: phone number, subscription number and amount due, to send expiry and payment notices.
• Support: the contents of tickets, emails and WhatsApp messages you send us.

c) Sensitive personal data

BIMXcloud does not collect or process sensitive personal data. We do not request health data, racial or ethnic origin, religious or philosophical beliefs, political opinions, genetic information or sexual preference. Please do not include such information in forms, support tickets or AI assistant conversations.

4. Necessary purposes

1. Responding to and following up on information, quotation and demo requests.
2. Contracting, provisioning, configuring and administering the services you purchase.
3. Billing, collections and CFDI issuance, including expiry and payment notices by email and SMS.
4. Technical support and incident response.
5. Service notices: renewals, expiry, suspensions, maintenance and security alerts.
6. Identification and authentication of users authorised by the customer.
7. Operation, security and diagnostics of our infrastructure.
8. Compliance with legal, tax and accounting obligations, and responding to lawful requests from competent authorities.
9. Keeping evidence of the contractual relationship to defend our rights.

5. Voluntary purposes and how to refuse them

These purposes are not necessary for the service. Refusing them costs you nothing — not the service, not the quality of support, not any commercial term:

1. Sending you information about our services, new products, plan changes and promotions.
2. Inviting you to demos, webinars and training material.

We do not carry out commercial profiling or automated segmentation, and we do not make automated decisions that evaluate you without human intervention.

How to refuse:

• At the moment you give us your data, by leaving the relevant checkbox unticked.
• At any time, using the unsubscribe link in every such email.
• At any time, by emailing support@bimxcloud.com stating that you do not want commercial communications.

We action opt-outs within five business days. After that we will only write to you about your contracted service: expiry, payments, support and security notices.

If we ever wanted to use your data for a purpose beyond sections 4 and 5, we would ask for your consent first.

6. Limiting the use or disclosure of your data

You may ask support@bimxcloud.com at any time to add your contact details to our internal exclusion list, after which we will not contact you other than to operate and invoice a service you have purchased. You may also register with PROFECO's Public Consumer Registry.

7. Content hosted by our customers

Each customer's server is a dedicated instance and is never shared with another customer. The files and models a customer uploads, and the backups we take of them, may contain personal data of that firm's own clients, staff or third parties. For that information the customer is the controller and BIMXcloud is the processor.

Our statement that we do not process sensitive personal data refers to the data we collect as controller, described in section 3. It does not apply to the content each customer chooses to store on their own server: that is the customer's decision, they act as controller of that information, and it falls to them to obtain the express written consent the law requires for sensitive data and to reflect it in their own privacy notice.

In that role:

• We act on the customer's behalf and under their instructions. We do not access that content for our own purposes, do not use it commercially, do not analyse it and do not disclose it, except (i) where strictly necessary to deliver the service or resolve an incident the customer reports, (ii) where the customer authorises it, or (iii) where a competent authority lawfully requires it.
• We take a daily full-server snapshot, stored on a backup server independent of the customer's instance.
• We do not transfer that content to any third party other than the infrastructure provider hosting it.
• Retention and deletion follow section 10 and Annex A of the Terms and Conditions, which contains the processing terms: documented instructions, confidentiality, security measures, subprocessors, breach notification, and return or deletion on termination.

8. Who we share data with

International transfers. Several of these providers are incorporated outside Mexico and their servers may sit in the United States, Spain or India, so your data may be processed outside Mexican territory. In all cases we require processing to be limited to the contracted purpose and to our instructions. The data centre hosting a customer's server is assigned by geographic proximity and disclosed during onboarding; if you need your information to remain in Mexico, tell us before purchasing.

We do not sell, rent or trade your personal data. We publish no customer names, logos, projects or screenshots: all imagery on our site comes from a demonstration environment containing fictitious data.

9. Information security

We apply reasonable administrative, technical and physical measures to protect data against loss, unauthorised use, access, alteration or disclosure, including:

• Dedicated per-customer instances, with no resources shared with other customers.
• Daily full-server snapshots, held on a backup server independent of the customer's instance.
• Per-sync version history: every model synchronisation creates a restore point, allowing a return to an earlier version.
• Access limited to personnel who need it to operate the service.
• Individual credentials for users authorised by the customer.
• Operational logs kept separate from customer information.

For security reasons we do not publish configuration, version or topology details of our infrastructure. No security measure is infallible: we do not guarantee absolute invulnerability.

10. How long we keep your data

Once those periods end, data is deleted, or blocked prior to deletion, as the law requires.

11. Your ARCO rights and how to exercise them

You may at any time access, rectify, cancel (delete) or object to the processing of your personal data.

Single channel: support@bimxcloud.com, subject line "ARCO rights", handled by the Office of the Managing Director.

Your request must include: your name and a means of reply; a copy of official ID (or proof of legal representation); a clear description of the data concerned; which right you are exercising or what you are asking for; anything that helps us locate the data (the email you contacted us from, a ticket number, the company name); and for rectification, the correction sought plus supporting documentation.

Timing. We will communicate our determination within twenty business days of receiving a complete request. If granted, we will implement it within the following fifteen business days. Both periods may be extended once, for justified cause, with notice to you.

No charge. Handling your request is free; we could only charge justified shipping or reproduction costs, and would tell you the amount beforehand.

Limits. The law allows us to deny a request in whole or in part in certain cases — for example where a legal or tax obligation requires us to retain the data, where the requester is not the data subject or their representative, or where deletion would affect third-party rights or prevent performance of an ongoing obligation. We will explain the reason.

Customer accounts. If your data sits within a firm's account, we may need to coordinate with that customer.

12. Cookies

We use cookies for two distinct purposes.

a) Strictly necessary. These make the site work: keeping your session in the customer portal, holding your cart contents, remembering your language preference and protecting forms. Without them the site does not operate.

b) Measurement. We use Google Analytics to see how many people visit the site, how they arrive and which sections they consult, in order to improve it. Google sets first-party cookies on our domain (_ga and _ga_<identifier>, lasting up to 2 years) containing a random identifier for your browser, not your name. We do not use this information to identify you, do not combine it with your customer record, and do not use it for advertising.

Cookies we use:

The first five are strictly necessary and are set only when you sign in to the portal. bxc_consent is likewise strictly necessary: it is set only when you answer the cookie notice and its sole content is that decision, so that we do not ask again and can honour a refusal.

How to refuse. You can decline measurement cookies from the cookie notice shown when you enter the site, or at any time from the "Cookie preferences" link in the footer. Refusing does not affect your access to the site or the customer portal. You may also block or delete cookies in your browser settings, or install Google's Analytics opt-out add-on; blocking strictly necessary cookies will break parts of the site.

13. Withdrawing your consent

You may withdraw your consent by emailing support@bimxcloud.com. We will confirm the withdrawal and the cessation of processing within the periods set out in section 11, and will inform any provider processing that data on our behalf.

Note the difference between the two groups of purposes:

• Withdrawing consent for the voluntary purposes in section 5 (commercial communications, demo invitations) does not affect your service at all. Just ask.
• Withdrawing consent for the necessary purposes in section 4 means we cannot continue providing the contracted service: in practice it amounts to requesting termination, with the consequences set out in the contract and the cancellation policy (suspension and erasure of the server). We will confirm this effect in writing before proceeding.

When you unsubscribe from our communications or request cancellation of your data, we permanently keep the bare minimum needed to honour that decision: your email address or phone number on a suppression list, with the date of your request. That record exists solely so that we do not contact you again, and is used for nothing else.

Withdrawal is not retroactive and does not release us from retaining data the law requires us to keep — in particular accounting and tax records, which remain blocked until the statutory period expires.

14. Changes to this notice

The current version is always published at bimxcloud.com/legal/privacidad with its last-updated date; that page is the means by which we communicate changes. We recommend reviewing it periodically.

15. Data protection authority

If you believe your data protection rights have been infringed, or that we mishandled your request, you may file a complaint with the Secretaría Anticorrupción y Buen Gobierno, Mexico's federal authority for personal data protection in the private sector. (INAI was dissolved and its functions in this area now sit with that Secretaría.)