Terms and Conditions

Last updated: September 2, 2026 · Version 1.0

Courtesy translation. The Spanish version published at bimxcloud.com/legal/terminos is the only binding version. If the two differ, the Spanish text prevails.

1. Parties and acceptance

In short: this contract is between your company and bimXperts International, the company behind the BIMXcloud brand. You accept it when you sign up and pay online.

1.1 Who provides the service. BIMXPERTS INTERNATIONAL, S.A. de C.V. ("BIMXcloud", "we"), tax ID (RFC) BIN150824TI8, with address at Espora 226, Col. El Jaralillo, C.P. 98085, Zacatecas, Zacatecas, Mexico. BIMXcloud is the commercial brand under which that company operates; both are the same legal entity.

1.2 Who the customer is. The service is offered to companies and to individuals carrying on a business activity who contract it for their own professional activity ("the Customer", "you"). It is not directed at consumers acquiring as end users, nor at minors. Whoever contracts represents that they have authority to bind the company they represent.

1.3 How it is accepted. These terms are accepted on the first of the following to occur: (i) ticking the acceptance box when signing up on the site; (ii) paying the first subscription; or (iii) using the contracted instance. Acceptance by electronic means has the same effect as a handwritten signature, under articles 89, 89 bis and 93 of the Mexican Commercial Code. We keep a record of the acceptance — account, date, time and version accepted — as evidence, and make it available to the Customer on request.

1.4 Applicable version. The version published at bimxcloud.com/legal/terminos at the time of each renewal applies. Previous versions are kept and can be requested from support@bimxcloud.com.

2. Definitions

In short: what each capitalised term means.

Service: the hosting and administration of an Instance, as set out in the contracted plan.
Instance: the dedicated server assigned to the Customer. It is not shared with other customers.
Subscription: the contracted plan and its term.
Period: the current prepaid month.
Customer Content: the files, models, databases, configurations and other information the Customer or its users store on the Instance.
Authorised User: a person to whom the Customer gives access to the Instance and who is part of its organisation.
External Collaborator: a person outside the Customer's organisation to whom the Customer itself grants access (for example, through the Revit Server access scheme).
Backup: the daily copy of the complete server, held on infrastructure independent of the Instance.
Restore point: the state of the server at the time of the last Backup. There is only one: the most recent.
Suspension: the interruption of access to the Instance for non-payment or breach, with the information retained.
Grace period: the days between Suspension and Deletion.
Deletion: the permanent erasure of the Instance.
Privacy Notice: the one published at bimxcloud.com/legal/privacidad.
AUP: the Acceptable Use Policy published at bimxcloud.com/legal/uso-aceptable.
Personal Data, Controller (Responsable), Processor (Encargado), Data Subject (Titular): as defined in the Mexican Federal Law on the Protection of Personal Data Held by Private Parties in force.

3. Description of the service

In short: we host and administer infrastructure. We do not sell, resell or license third-party software.

3.1 What we do. We provision, host, configure, update, monitor and back up a dedicated Instance, and provide support for it. Depending on the plan, the Instance may run Revit Server for model collaboration, ERPNext for management and Nextcloud for file storage.

3.2 What we do not do. BIMXcloud does not develop, resell or license third-party software. Autodesk, Revit and Revit Server are trademarks of Autodesk, Inc.; their use here is descriptive only. Nextcloud (AGPLv3) and ERPNext (GPLv3) are open-source projects that BIMXcloud hosts and administers under their respective licences.

3.3 Customer licences. Each Customer and each user must hold their own licences for the software they run on the infrastructure. BIMXcloud is not a party to the relationship between the Customer and its software vendors and makes no representation and assumes no responsibility regarding the Customer's licensing compliance.

3.4 Nature of the service. The Service is managed hosting of a dedicated instance, not a multi-tenant service. The obligations in this contract are to be read in that light.

4. Sign-up, activation and provisioning times

In short: normally within an hour; up to four at the weekend; if you order overnight, we start at 08:00.

4.1 Sign-up requirements. To activate we need the Customer's tax details, contact email and the technical information for the plan. Times run from when we receive payment and that information in full.

4.2 Times. Approximately 1 hour within support hours on a business day; up to 4 hours on Saturdays, Sundays and public holidays; orders received outside support hours begin to be processed at 08:00 the following day. Support hours: 08:00 to 22:00, Monterrey time, every day. For the purposes of this contract, business day means Monday to Friday, excluding Saturdays, Sundays and public holidays in Mexico and the United States.

4.3 Nature of these times. These are target times based on actual operations, not a guarantee backed by penalties. If provisioning is significantly delayed we will tell you, and you may cancel with a full refund of what you paid.

5. Prices, invoicing and taxes

In short: prepaid monthly, invoiced, 16% VAT on peso prices, no Mexican withholding on dollar prices.

5.1 Prepayment. The Service is prepaid monthly. There is no minimum term and no cancellation penalty.

5.2 Payment methods. PayPal or bank transfer. Card details are captured and processed directly by PayPal; BIMXcloud neither receives nor stores them.

5.3 Taxes. Prices in Mexican pesos do not include 16% VAT, which is added on the invoice. Prices in US dollars carry no Mexican tax withholding. Any tax, withholding or fiscal charge in the Customer's own country, where applicable, is for the Customer's account.

5.4 Invoicing. We issue a CFDI using the tax details the Customer registers. The Customer is responsible for those details being correct and for telling us when they change; reissuing an invoice because of incorrect details supplied by the Customer is subject to the deadlines allowed by tax law.

5.5 Non-payment. Failure to pay by the due date triggers section 7. No default interest or late-payment surcharges are charged.

6. Renewal, price changes and changes to the service

In short: it renews itself as long as you keep paying; increases are announced 60 days ahead.

6.1 Automatic renewal. The Subscription renews automatically for monthly periods for as long as the Customer keeps paying. To stop renewing, simply do not pay the next period, or tell us in writing.

6.2 Price changes. Any price change is notified 60 calendar days before it takes effect, with a reminder 30 days before. If you disagree, you can stop renewing before that date, with no penalty.

6.3 Changes to the service. We may update, improve or modify technical components of the Service. If a change substantially reduces a function the Customer has been using, we give reasonable advance notice. Withdrawal of a product altogether is governed by section 8.

6.4 Changes to these terms. We publish the current version at bimxcloud.com/legal/terminos with its date. Substantial changes are notified by email 30 calendar days in advance and take effect at the next renewal. If you do not accept them, you can stop renewing.

7. Expiry, suspension, grace period and deletion

In short: we warn you before it expires; on expiry the server is suspended. Download your data before suspension. If you didn't manage to, you can ask us for a grace period of up to 10 days. After that it is erased.

7.1 Advance notices. Before expiry we send notices by email, and where applicable by SMS, to the registered contact.

7.2 Suspension. When the Subscription expires unpaid, the Instance is suspended and access to it ceases. It is the Customer's responsibility to retrieve their information before suspension occurs, in accordance with section 12.

7.3 Grace period, on request. If the Customer did not retrieve their information before suspension, they may request it in writing at support@bimxcloud.com and we will open a grace period of up to 10 calendar days, counted from suspension, for them to do so. The grace period is not automatic: it is granted at the Customer's request. If the Subscription is not renewed and no grace period is requested, the Instance is permanently deleted. Deletion is a manual operation carried out from the tenth calendar day after suspension onward, so it may occur at any point after that date. The Customer should not assume their information will still be available after the tenth day.

7.4 Reactivation. The Customer may reactivate the Service after a suspension by paying for a full month of service. No separate reactivation fee is charged.

7.5 Backup after deletion. We keep the Backup of the last active day for up to 30 calendar days after Deletion. If the Customer returns within that window, we can restore the service from that Backup on the terms of 7.4. After those 30 days the information is erased irreversibly and there is no way to recover it.

7.6 Suspension for breach. We may also suspend the Instance on the grounds set out in section 10 (acceptable use) and section 19.

8. Product withdrawal

In short: if we stop offering a product, we give at least 30 days' notice.

If BIMXcloud decides to withdraw a product or plan, it will give written notice at least 30 calendar days in advance. During that period the Customer may retrieve their information under section 12 and, if the withdrawal prevents them from continuing to use the Service, the unused portion of the prepaid amount is refunded.

9. Customer obligations

In short: your licences, your credentials, your connection, and the conduct of whoever you let in.

9.1 Licences. Hold current licences for the software you run on the Instance and use it in accordance with your own vendors' terms.

9.2 Credentials. Safeguard access credentials, do not share them beyond what the AUP permits, and tell us without delay if you suspect unauthorised use.

9.3 Authorised Users. Keep the list of Authorised Users up to date and request removal of anyone who leaves your organisation.

9.4 External Collaborators. Where the Customer grants access to External Collaborators — for example, subcontractors connecting to their Revit Server — the Customer is responsible for those people's conduct as if it were its own, including compliance with the AUP and this contract.

9.5 Connectivity and equipment. The Customer's internet connection, local equipment and internal network performance are for their account and fall outside the Service.

9.6 Current contact. Maintain a valid contact email address. Notices sent to that address are deemed received.

9.7 Content. Be responsible for the lawfulness of Customer Content and for holding the rights and consents needed to store and process it.

10. Acceptable use

In short: there is a separate acceptable use policy; it forms part of this contract.

10.1 Incorporation. The Acceptable Use Policy published at bimxcloud.com/legal/uso-aceptable forms an integral part of these terms. It is kept as a separate document because it changes more often than the contract.

10.2 Unlawful content. Storing, distributing or processing unlawful content of any kind on the Instance is prohibited. Detection results in immediate suspension and, where applicable, termination for cause under section 19.

10.3 Scope of the AUP. The AUP follows the model of Vultr's use policy — unlawful or harmful content, violations of the security or integrity of other systems, network and resource abuse, prohibition of unsolicited email, and Customer responsibility for its own users' conduct — adapted to Mexican law and to the dedicated-instance nature of the Service. US-specific machinery is not replicated (DMCA, CDA §230, California notices). It covers at least: unlawful content of any kind; resource abuse that degrades other customers or the infrastructure; sharing access outside the contracting firm; using the Instance for work other than the firm's own; attempting to reach other systems from the Instance; load testing without notice; and the Customer's responsibility for its External Collaborators.

11. Service levels and backups

In short: support 08:00 to 22:00 every day; a daily backup of the complete server with a single restore point; we restore within 4 hours, but up to a day's work can be lost.

11.1 Support. From 08:00 to 22:00, Monterrey time, every day, through the published channels. Support is provided by the same team that administers the servers.

11.2 Backup. We take a daily backup of the complete server, held on infrastructure independent of the Instance.

11.3 A single restore point. The backup keeps only the most recent state. There are no historical backups of earlier days.

11.4 History inside the Instance. Additionally, and independently of the Backup, each product keeps its own history inside the Customer's Instance: per-sync versions in Revit Server, file versions and trash in Nextcloud, and document history in ERPNext.

11.5 Remedy in the event of failure. Where a failure prevents use of the Instance and is reported to us, we restore the server from the most recent Backup within 4 hours. The clock runs only within support hours (08:00 to 22:00, Monterrey time): if the report is received within those hours, it starts immediately; if received outside them, it starts at 08:00 the following day. This is the same criterion that applies to provisioning in section 4.2.

11.6 What can be lost. Read together with the point above: restoration returns the server to the state of the last daily backup, so up to 24 hours of work can be lost. The 4 hours are the time to restore; the 24 hours are the work that can be lost. They are not the same figure and should not be read as one.

11.7 No availability percentage. We do not publish a guaranteed availability percentage. This is not an oversight: we do not yet have twelve months of monitoring data that would let us commit to a figure we can stand behind. We would rather not offer one than offer one we cannot evidence.

11.8 Maintenance. Scheduled maintenance is announced with reasonable notice and is arranged outside the Customer's working hours where possible. Emergency security maintenance may be applied immediately, with notice afterwards.

12. Ownership and return of data

In short: Customer Content is yours. We don't use it for anything other than running the service. When it ends, you have a way to get it back.

12.1 Ownership. Customer Content is and remains the property of the Customer. BIMXcloud acquires no rights over it.

12.2 Limited use. We access Customer Content only where strictly necessary to provide the Service or to deal with an incident the Customer reports to us, where the Customer authorises it, or where there is a duly founded and reasoned request from a competent authority. We do not analyse it, do not use it commercially, do not train on it, do not disclose it and do not monitor it routinely.

12.3 Retrieving your information. How you retrieve information depends on the product:

Files and models (Nextcloud, Revit Server): the Customer downloads them by their own means while the Instance is available. These are formats the Customer already works with and need no involvement from us.
Management systems (ERPNext): at the Customer's request we deliver, at no cost, an export of the database and its file attachments, because that information cannot be downloaded through the web interface. Delivery consists of an SQL dump of the database and a ZIP file containing the uploaded files. The request must be made before Deletion and is fulfilled within 5 business days.
In both cases section 7 applies: retrieval must happen before suspension or, failing that, during the grace period the Customer requests.
We never convert information into a format other than the native format of the system that generated it.

12.4 After Deletion. Once the Backup retention period has ended (section 7.5), the information is erased irreversibly.

13. Processing of personal data

In short: the personal data inside your server is yours; we only process it on your behalf and on your instructions. The conditions are in Annex A.

13.1 Two distinct roles. In relation to the Customer's own contact, billing, account and support data, BIMXcloud acts as Controller and its Privacy Notice applies. In relation to personal data contained in Customer Content — models, files and databases that may include information about the firm's own clients, staff and third parties — the Customer is the Controller and BIMXcloud is the Processor.

13.2 Processing conditions. Annex A to these terms contains the conditions of processing as Processor and forms an integral part of the contract.

13.3 The Customer's obligations as Controller. It is for the Customer to have its own privacy notice, to obtain the consents it requires, to handle its data subjects' access, rectification, cancellation and objection (ARCO) rights, and to decide what information it stores, for what purpose and for how long.

14. Intellectual property and third-party software

In short: each side keeps what is theirs; third-party software is governed by its own licences.

14.1 BIMXcloud's. BIMXcloud's tools, automation scripts, configuration templates, documentation, trademarks and website are its property. The contract transfers none of those rights: it only grants the right to use the Service while it is in force.

14.2 Third parties'. Third-party software running on the Instance is governed by its own licences: Autodesk as agreed between the Customer and Autodesk; Nextcloud under AGPLv3; ERPNext under GPLv3.

14.3 Trademarks. Autodesk, Revit and Revit Server are trademarks of Autodesk, Inc. Their mention is descriptive and implies no association, sponsorship or distribution.

14.4 The Customer's. The Customer retains ownership of its Content and its trademarks. BIMXcloud does not use the Customer's name, logo, projects or screenshots for promotional purposes, save with the Customer's prior written authorisation, in line with the published anonymity policy.

15. Confidentiality

In short: a mutual obligation, with the usual exceptions, and it survives termination.

15.1 Scope. Each party undertakes to keep confidential the other's non-public information to which it has access by reason of the contract, including Customer Content, credentials, technical information about the infrastructure and commercial terms.

15.2 Exceptions. This does not apply to information that is or becomes public through no fault of the recipient, that was already lawfully in its possession, that is independently developed, or whose disclosure is required by a competent authority through a duly founded and reasoned request, in which case the other party will be informed where legally permitted.

15.3 Personnel. Each party is responsible for compliance with this obligation by its personnel and by those acting on its behalf. The obligation survives the end of the relationship, in accordance with article 20 of the Federal Law on the Protection of Personal Data Held by Private Parties as regards personal data.

15.4 Duration. It survives for 3 years from termination of the contract, and indefinitely as regards personal data and credentials.

16. Warranties and their limits

In short: we provide the service with professional diligence; we do not promise uninterrupted operation or absolute security, and we do not claim compliance with standards we cannot name.

16.1 What we do offer. To provide the Service with the professional diligence expected of a managed infrastructure provider, with trained personnel and in accordance with these terms and the incorporated documents.

16.2 What we do not warrant. That the Service will operate uninterrupted or error-free; that the Instance will be compatible with any configuration, version or software of the Customer; or the absolute inviolability of the systems. No security measure is infallible.

16.3 No compliance claims. BIMXcloud does not claim to hold certifications or to comply with standards not expressly named in this contract. Any statement to that effect not found here is not ours.

16.4 Scope. To the extent permitted by applicable law, no warranties are given other than those expressly set out in this document.

17. Limitation of liability

In short: if there is a failure we restore your server; if a claim still follows, our financial liability is capped.

17.1 The remedy. Where a failure attributable to the Service prevents use of the Instance, the remedy is restoration from the most recent Backup on the terms of section 11.5, with the data-loss limitation of section 11.6. That is the Customer's principal and ordinary remedy.

17.2 Cause of the incident. The remedy in 17.1 applies regardless of the cause of the incident and at no cost to the Customer, including where the incident arises from use of the Instance by the Customer, its Authorised Users or its External Collaborators, or from malicious software introduced through their access. Restoration is not charged for, and the cause is not debated in order to decide whether it applies.

17.3 The monetary cap. The remedy above does not replace a limitation of liability. Where liability attributable to BIMXcloud is determined, its total aggregate liability to the Customer, on any basis, shall not exceed the sum of the fees actually paid by the Customer in the 3 months preceding the event giving rise to the claim.

17.4 Form of payment. Any amount resulting under 17.3 is settled solely by means of service credits applicable to future subscriptions. No payment is made in cash or by any means other than a service credit under any circumstances.

17.5 Excluded damages. BIMXcloud is in no case liable for loss of profit, loss of business, loss of opportunity, reputational damage, or indirect or consequential damages, even if advised of their possibility. Liability for loss of information is limited to what is provided in 17.1 and 11.6.

17.6 Time limit for claims. Any claim must be submitted in writing within 15 calendar days of the event giving rise to it.

17.7 Exceptions to the cap. The limitations in this section do not apply in cases of wilful misconduct or bad faith, or in situations where Mexican law does not permit liability to be limited.

17.8 Proportionality. The parties acknowledge that these limitations are proportionate to the price of the Service and that the price was set taking them into account.

18. Indemnity

In short: if a third party comes after us because of what you uploaded or who you let in, you answer for it.

The Customer undertakes to hold BIMXcloud harmless against third-party claims arising from: (i) Customer Content and its lawfulness; (ii) the conduct of its Authorised Users and External Collaborators; (iii) the licensing of the software it runs on the Instance; and (iv) breach of its obligations as Controller in matters of personal data. BIMXcloud will notify the Customer of the claim without delay and allow it to take part in the defence.

19. Termination

In short: you can leave whenever you want with no penalty; we only terminate for cause or with prior notice.

19.1 By the Customer. At any time, by not renewing or by giving written notice. There is no penalty. There are no refunds: the current Period already paid for runs to its expiry and the Subscription simply does not renew. The only cases in which money is returned are those in sections 8, 19.3 and 20, where termination comes from BIMXcloud or from a cause outside both parties.

19.2 For cause. Either party may terminate if the other breaches a substantial obligation and fails to cure it within 10 calendar days of written demand. BIMXcloud may in addition suspend immediately and with no cure period in the face of unlawful content, risk to security or to other customers, or a request from a competent authority.

19.3 Without cause, by BIMXcloud. On 30 calendar days' written notice, with a refund of the proportional part of the unused prepaid amount.

19.4 Effects. On termination, access to the Instance ceases and the periods in section 7 (grace, deletion and Backup retention) and section 12 (retrieval of information) apply. Sections 12, 13, 15, 17, 18, 21 and 23 survive.

20. Force majeure

In short: neither side answers for what is outside its hands.

Neither party is liable for failure to perform arising from unforeseeable circumstances or force majeure, including natural disasters, widespread power or telecommunications outages, acts of authority, armed conflict, or failures of infrastructure providers outside BIMXcloud's control. The affected party will notify the other without delay. If the cause persists for more than 30 calendar days, either party may terminate the contract without liability, with a refund of the unused prepaid amount.

21. Notices

In short: we write to each other by email; keep yours current.

21.1 To BIMXcloud. To support@bimxcloud.com, and for legal matters to the address given in section 1.1.

21.2 To the Customer. To the email address registered on the account. Notices are deemed received on the business day following dispatch. The Customer is responsible for keeping that address current and for checking their spam folder.

21.3 Operational notices. Notices of expiry, suspension, maintenance and security are sent by email and, where applicable, by SMS.

22. General provisions

22.1 Assignment. The Customer may not assign this contract without BIMXcloud's prior written consent. BIMXcloud may assign it to a company within its group or in the event of corporate restructuring, giving notice to the Customer.

22.2 Severability. If any clause is held invalid, the remainder stay in force and the invalid clause is replaced by the one closest to its purpose.

22.3 Entire agreement and order of precedence. These terms, together with the AUP, the service levels document, Annex A and the contracted plan, constitute the entire agreement between the parties and supersede any previous communication. In the event of conflict, the following prevails: (1) Annex A on matters of personal data; (2) these terms; (3) the documents incorporated by reference; (4) commercial materials.

22.4 No waiver. A party's failure to require performance of an obligation does not waive its right to require it later.

22.5 Language. The Spanish version is the only binding one. Any translation is provided as a courtesy.

23. Governing law and jurisdiction

In short: Mexican law and the courts of a single city.

This contract is governed by the federal laws of the United Mexican States. For its interpretation and performance, the parties expressly submit to the competent courts of the city of Monterrey, Nuevo León, waiving any other jurisdiction that might correspond to them by reason of their present or future domiciles.

24. Last updated

Last updated: 2 September 2026. Version 1.0. Previous versions are kept and can be requested from support@bimxcloud.com.

ANNEX A — Conditions for the processing of personal data on the Customer's behalf (Processor)

In short: what is inside your server is yours. We process it only to run the service, on your instructions, and we return it or delete it when the relationship ends.

A.1 Purpose and roles. This annex governs the processing BIMXcloud carries out, as Processor, of the personal data contained in Customer Content. The Customer is the Controller and determines the purposes and means of processing.

A.2 Description of the processing.

Operations: storage, backup, restoration, administration and maintenance of the Instance and of the systems it runs.
Duration: the term of the contract, plus the retention periods in section 7 of the terms.
Categories of data subjects: those the Customer chooses to store, typically including its staff, its own clients and third parties connected with its projects.
Categories of data: those the Customer chooses to store, except any whose storage would breach the Acceptable Use Policy. If the Customer stores sensitive personal data on its Instance, it falls to the Customer, as Controller, to obtain the express written consent the law requires and to reflect it in its own privacy notice. BIMXcloud does not determine what information is stored and does not review it. The statement in BIMXcloud's privacy notice that it does not process sensitive data refers to the data it collects as Controller, not to content hosted by its customers.

A.3 Instructions. BIMXcloud processes that data only on the Customer's behalf and on its documented instructions, and not for its own purposes. The contract, the contracted plan and the requests the Customer submits through the support channels constitute documented instructions. No automated decision-making and no analysis of the content is carried out.

A.4 Confidentiality. BIMXcloud personnel involved in the processing are bound by confidentiality, an obligation that survives the end of their relationship with the company.

A.5 Security measures. BIMXcloud maintains administrative, technical and physical measures in accordance with article 18 of the applicable law, among them: dedicated instances with no shared resources, daily backup on independent infrastructure, access control limited to personnel who need it to operate, individual credentials for Authorised Users, and operational logs kept separate from customer content. For security reasons, configurations, versions and topology are not described publicly.

A.6 Subprocessors. The Customer authorises the use of The Constant Company, LLC (Vultr) as infrastructure provider, in the data centres notified at the time of contracting — Mexico City, Dallas, Los Angeles, Chicago or Mumbai, assigned by proximity. BIMXcloud will notify the Customer before adding or replacing a subprocessor that processes Customer Content, and the Customer may terminate the contract without penalty if it disagrees. Notice will be given 30 calendar days in advance. Customer Content is not transferred to third parties other than the infrastructure provider, save on a duly founded and reasoned request from a competent authority.

A.7 Security breaches. BIMXcloud will inform the Customer of any security breach affecting Customer Content without delay and no later than 48 hours after confirming it, with the information available on its nature, scope and the measures adopted, so that the Customer can meet its own obligations towards data subjects. Notification of data subjects is for the Customer as Controller.

A.8 Assistance to the Customer. BIMXcloud will reasonably assist the Customer, at the Customer's cost where significant work is involved, in handling ARCO rights requests and authority requests relating to Customer Content. If a data subject approaches BIMXcloud directly, they will be referred to the Customer and the Customer will be informed.

A.9 Return or deletion. On termination of the relationship, Customer Content is deleted in accordance with the periods in section 7 of the terms, after the opportunity for retrieval under section 12. Backups are deleted when their retention period expires.

A.10 Evidence of compliance. On the Customer's reasonable written request, BIMXcloud answers security questionnaires and provides a description of the measures implemented, within 30 calendar days of the request. This is the agreed means of evidencing compliance with this annex; no on-site audits are carried out and no access to the infrastructure is granted.

A.11 Applicable framework. This annex is drafted in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties in force (Official Gazette, 20 March 2025). As at the date of this version the updated regulations to that law have not been published; this annex will be reviewed when they are.