Privacy Notice

Last updated: October 8, 2026.

This privacy notice is issued in compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”), published in the Official Gazette of the Federation (DOF) on March 20, 2025, and its applicable regulations. It describes how the personal data you provide, or that is generated when you use the sorenn.io website (the “Site”), is processed. The Spanish version is the original; this English version is a faithful translation of it.

1. Identity and address of the data controller

The controller of your personal data is Luis Mauricio Paz Espino, an individual, operating under the trade name “Sorenn” or “Sorenn Software Consulting” (“Sorenn”, “we” or the “Controller”).

• Address: Dos Pte #10, Santa Fé, C.P. 76803, San Juan del Río, Querétaro, Mexico.
• Email for privacy, ARCO rights, withdrawal of consent and any legal matter: hi@sorenn.io.

2. Personal data we collect

2.1 Data you provide

We collect personal data only through the “Briefing” form on the Site (/briefing):

• Name.
• Work email address.
• Company.
• Job title.
• Company size (range).
• Time zone.
• Areas you want to improve.
• Free-text description of the operational bottleneck.
• If you book a session, the date and time you choose.

2.2 Technical data

When you visit the Site, the following is generated or collected automatically:

• IP address, browser type and server logs, kept by our hosting provider.
• Technical browser signals used to detect automated traffic (bot protection) and prevent abuse.

2.3 Sensitive data

We do not request sensitive personal data (for example, health, racial or ethnic origin, religious beliefs, sexual orientation, biometric data or financial information). We ask that you do not include this type of data in the free-text field of the form. If you do, we will process it only to respond to your request and may delete it.

2.4 Cookies and analytics

The Site does not use first-party cookies or advertising cookies. If analytics is enabled, it will be cookie-free (Vercel Web Analytics) and based on aggregated data, without building individual profiles of Site visitors.

3. Purposes of processing

3.1 Primary purposes (necessary)

We use your data to:

1. Respond to your briefing request.
2. Assess whether there is a fit between your need and Sorenn’s services.
3. Schedule and hold the session by video call.
4. Send the calendar invitation and the acknowledgment of your request.
5. Follow up commercially on that same request.
6. Ensure the security of the Site and prevent abuse and automated traffic.

3.2 Secondary purposes

There are no secondary purposes. We do not send newsletters, we do not use your data for marketing or advertising, and we do not use it for any purpose other than those described above. If a different purpose is added in the future, we will tell you here and, where the Law requires it, we will ask for your consent before using your data for that purpose.

3.3 Consent

By submitting the Briefing form, once this notice has been made available to you, you state that you are aware of it and consent to the processing of your data for the primary purposes described. You may withdraw your consent at any time under section 7.

4. Referrals to processors and transfers

4.1 Processors (referrals)

To operate the Site and handle your request, we rely on providers that process data on our behalf and under our instructions (processors). These disclosures are referrals, not transfers, and do not require your consent:

These providers may process your data in the United States. We have accepted data processing agreements with each of them. The technical logs they generate are retained under their own policies.

4.2 Transfers

We do not sell, assign or share your data with third parties. We will only make transfers that the Law allows or requires without your consent, for example, to a competent authority that requests it through a duly grounded and reasoned order.

5. Retention

• Data from requests that do not become a commercial relationship is deleted after 24 months.
• If a commercial relationship is established, we will keep the data for as long as applicable law and the relevant contract require.

6. Means to limit the use or disclosure of your data

You may ask us at any time to limit the use or disclosure of your data, or to stop contacting you, by writing to hi@sorenn.io. Because we do not process your data for marketing, there is no subscription list to unsubscribe from.

7. ARCO rights and withdrawal of consent

You have the right to access your personal data and know how we process it, to rectify it when it is inaccurate or incomplete, to cancel it when you consider it is not needed for the stated purposes or is being used unlawfully, and to object to its processing for specific purposes (ARCO rights). You may also withdraw the consent you have given us.

7.1 How to exercise them

Send your request to hi@sorenn.io, from the email address you used in the form, and include:

1. Your full name and a means to communicate the response to you.
2. Documents proving your identity or, where applicable, the legal representation of the person acting on your behalf.
3. A clear and precise description of the data with respect to which you wish to exercise any of the rights.
4. For rectification, the correction you request and the supporting documentation.
5. Any other element that helps locate your data.

7.2 Deadlines

We will communicate our decision to you within a maximum of fifteen business days counted from the date we receive your request. If it is granted, we will make the right effective within fifteen business days following the date we communicate the response. Both deadlines may be extended once by an equal period when the circumstances of the case justify it. For the right of access, delivery takes place after your identity has been verified.

The response will be sent by email. Exercising these rights is free of charge, except for justified shipping costs or document reproduction costs, if any.

8. Minors

The Site is not directed at minors and we do not knowingly collect their data. If you believe a minor has given us data, write to hi@sorenn.io so we can delete it.

9. Visitors from the United States and Canada

Sorenn serves organizations established in North America. If you visit the Site from the United States or Canada, the laws of your state, province or country may give you rights to access, correct and delete your personal data. You may exercise them by writing to hi@sorenn.io, with the information listed in section 7.1. We will handle your request to the extent those laws apply to you. This notice is not a certification of compliance with any foreign data protection law.

10. Security measures

We apply reasonable administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction, or unauthorized use, access or processing, including encrypted communications between your browser and the Site and the use of providers with recognized security controls. No internet transmission is completely secure, so we cannot guarantee absolute security. If a security breach occurs that significantly affects your property or moral rights, we will inform you without delay so you can take the appropriate measures.

11. Changes to this notice

We may amend this notice because of legal changes or changes in our services or practices. We will publish the current version on this same page, with the update date shown at the top. If a change alters the purposes of processing, we will ask for your consent where the Law requires it.

12. Authority

If you believe your right to personal data protection has been violated, you may turn to the competent authority for the protection of personal data held by private parties, which is currently the Secretaría Anticorrupción y Buen Gobierno (the Ministry of Anti-Corruption and Good Governance), following the dissolution of the INAI.

13. Contact

For any question about this notice, the processing of your data or the exercise of your rights:

• Email: hi@sorenn.io
• Controller: Luis Mauricio Paz Espino (Sorenn)
• Address: Dos Pte #10, Santa Fé, C.P. 76803, San Juan del Río, Querétaro, Mexico.