Privacy notice

Last updated: November 12, 2026

Data controller

Siklum (hereinafter, "Siklum") is the controller of the personal data described in this notice, in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations and the Privacy Notice Guidelines.

Who this notice is for

People who use the siklum.com website, users at companies that contract Siklum, business partners in the partner program, and individuals whose data appears in the documents suppliers deliver to those companies (legal representatives, shareholders, beneficial owners and contacts).

Siklum as processor

When a company uses Siklum to verify its suppliers, that company is the controller of the personal data and Siklum acts as processor, following the company's instructions. Siklum in turn uses Ztify's verification engines as a sub-processor. Both handle the data only to provide the service, with the security measures in this notice, and do not use it for their own purposes. Each company's privacy notice applies to its suppliers.

Data collected

From the website: name, email and company when you request a demo; technical connection data. From platform users: name, email, role and a log of their actions. From partners: name, email, phone and tax data for commission payments. From supplier documents (on behalf of the responsible company): name, position, nationality, date of birth, CURP, voter key, ID number and expiration, signature and ID image, equity interest and address, when they appear in articles of incorporation, powers of attorney, IDs, proofs of address, the Tax Status Certificate (Constancia de Situación Fiscal) and the Compliance Opinion (Opinión de Cumplimiento).

Sensitive data: the questionnaire on politically exposed persons may reveal that a person holds or held public office. Express consent is collected in the portal before it is answered. Siklum does not collect data on health, ethnic origin, religious beliefs, political opinions or sexual orientation.

Purposes

1. Handle demo and contact requests.
2. Operate the platform: accounts, users, partners and commissions.
3. On behalf of the responsible companies: verify suppliers' identity, legal existence and tax status; meet tax and risk-prevention obligations (including the lists under articles 69, 69-B and 69-B Bis of the Federal Tax Code); identify beneficial owners; screen against sanctions lists and politically exposed persons lists; calculate an indicative risk score; monitor periodically; send suppliers the emails needed to complete their file.

There are no secondary purposes and no advertising use.

Public sources consulted

Mexico's Tax Administration Service (SAT) (RFC status and the 69, 69-B and 69-B Bis lists), the OFAC SDN list, OpenSanctions, news media, court bulletins, geolocation services and websites. Siklum does not control the content or updating of those sources.

Use of artificial intelligence

Documents are read with artificial intelligence tools to extract and validate data. This is assisted reading, not automated decision-making: the decision to start, continue or end a business relationship is made by a person at the responsible company and is recorded.

Transfers

Siklum does not transfer data to third parties other than its processors, except for the exceptions provided by law (for example, a request from a competent authority). The infrastructure may be located outside Mexico; the transfer takes place between controller and processors, under contract, in accordance with article 37 of the Law.

Retention

Verification reports are kept for ten years, in line with the responsible companies' tax obligations. Evaluations that are not submitted are archived after 30 days of inactivity and deleted 30 days later. Website contact data is kept until the request is handled or consent is revoked.

Security

Data is encrypted in transit and at rest, access is restricted by role, every action is logged, and suppliers access their file with a personal link and a code sent to their email.

ARCO rights and revocation

You may access, rectify, cancel or object to the processing of your data, and revoke your consent, by writing to soporte@siklum.com with your name, a way to reply to you, a copy of an official ID and a description of the right you are exercising. We will respond within 20 business days at most and, if applicable, make it effective within the following 15 business days. If your data is handled by a company that uses Siklum, we will forward your request to that company, which is the controller. You may also contact the authority responsible for personal data protection.

Cookies

The website and the platform use only the cookies and storage needed for the session and language. No advertising or tracking cookies are used.

Changes

This notice may be updated to reflect legal or service changes. The current version will always be at siklum.com/privacidad.