Privacy Notice

Soluciones Industriales de Transformación Digital, S.A.S. (hereinafter "Jibby", "we" or "us") is the data controller responsible for processing your personal data under the terms of this notice, with its address at Ciudad del Carmen, Campeche, México.

For any matter related to the protection of your personal data you can write to us at soporte@jibby.mx.

This notice applies to:

• The website https://jibby.com.mx, including the contact, support and account deletion forms found on it.
• Jibby Chat, the internal communication app of Jibby Suite, available for mobile devices.
• The Jibby Suite ecosystem in general. As new modules become available, this notice will incorporate specific sections for each of them.

Jibby Suite is a subscription service for companies. Jibby Chat accounts are not created individually: they are set up by the administrator of the organization that subscribes to the service. For that reason, the section Relationship with the client organization explains how responsibilities over your data are shared between Jibby and your organization.

By browsing the website, submitting a form or using Jibby Chat, you acknowledge that you have read this notice. For data that is not sensitive, the law allows tacit consent, unless you object through the means described in the section ARCO rights and withdrawal of consent.

Contact, support and account deletion forms

When you submit a form on the website, we collect only the data you enter:

• Name.
• Email address.
• Company or organization you belong to.
• Reason for your request (for example: request a Jibby Suite demo, Jibby Chat support, consulting or development, account deletion).
• Message or description of your request.

The forms include a checkbox to confirm that you have read this notice. The data is sent by email to our support team through a transactional email provider (see the section Data processors and transfers).

Technical browsing data

When you visit the website, the infrastructure that hosts it automatically logs technical information: IP address, browser type and version, operating system, pages visited, date and time of access and referring page. This information is used to operate the website, keep it secure and detect failures; it is not used to identify you or to build advertising profiles.

We do not request sensitive personal data (ethnic origin, health status, religious beliefs, sexual preferences, among others) or financial data through the website. Please do not include such data in the message field.

Jibby Chat is the internal messaging app of Jibby Suite: it lets you send direct and group messages, share photos and files, and receive notifications. In order to work, it processes the following categories of personal data:

Access to your device's camera, photo gallery or files is used only when you choose to send a photo or a file, and depends on the permissions you grant in your device's operating system.

The content of your messages, photos and files is stored so that it can be delivered to and viewed by its recipients within your organization. Jibby does not read or analyze the content of conversations for commercial purposes; it only accesses that content when necessary to handle a support request, an abuse report or a legal requirement.

Jibby Chat does not request sensitive personal data. We recommend that you do not share through the app any sensitive, financial or third-party information that is not necessary for your work.

Jibby Suite includes other modules, such as Human Resources, Asset Control, Procurement and Cash Control. Each one processes the categories of data specific to the business area it serves. As each module is made available to clients, this notice will be updated with a specific section detailing the data it collects, its purposes and the providers involved.

In the meantime, the general principles of this notice (data controller, purposes, processors, security, retention and ARCO rights) apply to every module of the ecosystem.

Primary purposes

We process your data for the following purposes, which are necessary to provide the service and to maintain the relationship with you or with the organization you belong to:

• Providing the messaging service: delivering, storing and displaying the messages, photos and files exchanged between collaborators of the same organization.
• Authentication: verifying your identity when you sign in and keeping your session active securely.
• Notifications: sending push notifications to your device when you receive messages or when other relevant activity occurs in your organization.
• Support: handling and following up on your help, contact, demo and account deletion requests.
• Security: preventing unauthorized access, detecting failures, protecting the integrity of the platform and keeping technical logs to investigate incidents.
• Moderation: reviewing reports of messages or users, enforcing the terms and conditions of use (see Terms and conditions) and, where applicable, suspending accounts that break the rules.
• Legal compliance: responding to requests from competent authorities and complying with the obligations imposed on us by applicable law.

Secondary purposes

Additionally, we may use statistical and aggregated information about the use of the website and the app (for example, installed app versions, frequency of failures or most-used features) for service improvement. This purpose is not necessary to provide the service.

If you do not want your data to be used for this secondary purpose, send an email to soporte@jibby.mx with the subject "I do not consent to secondary purposes", stating your name, email address and organization. Refusing will not affect your access to the service.

Jibby does not sell, rent or assign your personal data to third parties for commercial purposes, nor does it use your data to show you advertising. Jibby Chat contains no ads.

To operate the website and the app we use technology providers that process personal data on behalf of Jibby and following our instructions (data processors). Each of them is bound by contractual terms that require them to protect the data and to use it only to provide the contracted service to us.

These providers may store or process the information on servers located outside Mexico, mainly in the United States. By using the website or the app, you acknowledge that your data may be processed in those locations under the security measures described in this notice. You can review Google Firebase's privacy practices at firebase.google.com/support/privacy.

Transfers

Apart from the disclosures to data processors described above, Jibby only shares personal data with third parties in the following cases:

• With the client organization you belong to, which administers its collaborators' accounts (see the section Relationship with the client organization).
• With competent authorities, when there is a duly founded and motivated legal requirement or when necessary to protect the rights of Jibby, its users or third parties.
• In the other cases in which the Law allows a transfer without the need for consent.

We do not transfer personal data for marketing, advertising or commercial prospecting purposes. We do not sell personal data.

Jibby Suite is subscribed to by companies or organizations. The organization that subscribes to the service designates an administrator, who creates, manages and deactivates its collaborators' accounts from the platform. Accordingly, the personal data relationship works as follows:

• The client organization is the data controller for the personal data it loads into the platform (for example, the name, email address and organization of its collaborators) and is responsible for having a legal basis to do so, including, where applicable, its own privacy notice towards its collaborators.
• Jibby acts as a data processor for that information and for the content that collaborators generate within the organization's workspace, and processes it solely to provide the contracted service and in accordance with its terms.
• Jibby acts as the data controller for the account and technical data generated by the use of the app and the website (device token, technical device information, security logs and data from the website forms), as well as for the processing needed for the security and support of the service.

Your organization's administrator can view the information of the accounts it manages, deactivate them or request their deletion. If you have questions about how your organization uses your data, we recommend that you consult your employer's privacy notice.

When the client organization terminates the service, Jibby deletes or returns the information as agreed with that organization and within the time frames described in the section Data retention and deletion.

Jibby implements administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction or unauthorized access. These include:

• Encryption in transit: all communication between the app, the website and our servers is encrypted using TLS.
• Credentials protected on the device: session credentials are stored securely on your device using the mechanisms provided by the platform. You can sign out at any time to remove them.
• Access control by organization: each organization has its own workspace. A user can only see and communicate with collaborators of their own organization.
• Restricted access: only Jibby staff who need it for support, security or moderation can access the data, under confidentiality obligations.
• Certified infrastructure: our providers, such as Google Firebase, maintain internationally recognized security certifications.

No system is infallible. If a security breach were to occur that significantly affects your rights, we will inform you through the available contact channels and, where applicable, through the organization you belong to, and we will take the necessary corrective measures.

We keep your data only for as long as necessary to fulfill the purposes described in this notice:

• Jibby Chat data: kept while your account is active in the organization you belong to.
• Website form data: kept while we handle your request and for a reasonable period afterwards to follow up and document the assistance provided.
• Technical data and security logs: kept for limited periods to detect failures and investigate incidents.

Deleting your account and data

Although your account is administered by your organization, you can directly request the deletion of your account and data at Delete account and data. We will process the request within a maximum of 30 days from receipt and will confirm by email once it has been completed.

When the account is deleted, your identification data, your notification token and your access to the organization are erased. Some data may be kept temporarily where there is a legal obligation, an authority's requirement or a need to handle claims; in that case it is blocked, not used for any other purpose, and deleted once the applicable period ends. The page Delete account and data details which data is deleted and which is kept temporarily.

When the client organization deactivates your account or terminates the service, the same time frames and criteria apply.

You have the right to access your personal data, rectify it when it is inaccurate or incomplete, cancel it when you consider it is not required for the purposes of this notice, and object to its processing for specific purposes (ARCO rights). You may also withdraw the consent you have given us and limit the use or disclosure of your data.

How to exercise them

Send your request by email to soporte@jibby.mx with the subject "ARCO rights", including:

1. Full name of the data subject and, where applicable, of their representative.
2. Email address or other means to communicate our response to you.
3. A copy of a document proving your identity (official ID) or, where applicable, the legal representation.
4. A clear and precise description of the data regarding which you wish to exercise any of the rights, and of the right you wish to exercise.
5. Any other element or document that helps locate your data (for example, the organization you belong to).

We will respond within a maximum of 20 business days from receipt of the complete request. If the request is granted, we will carry it out within the period established by the Law. These periods may be extended once, for an equal period, when the circumstances justify it, in which case we will notify you.

Exercising ARCO rights is free of charge. Only justified shipping costs or the cost of reproduction in copies or other formats may be charged, where applicable.

Withdrawal of consent and limitation of use

You may withdraw your consent through the same channel. Please note that we may not always be able to act on the withdrawal immediately, since certain legal obligations require us to continue processing some data. Likewise, withdrawing consent for or cancelling data needed to operate your account will mean that we can no longer provide the Jibby Chat service to you.

If you wish to limit the use or disclosure of your data for secondary purposes, simply state so in the email described in the section Purposes of processing.

Authority

If you believe that your right to the protection of personal data has been violated by any conduct of Jibby, you may file a complaint with the competent personal data protection authority in Mexico (functions formerly held by the National Institute for Transparency, Access to Information and Personal Data Protection, INAI, and currently exercised by the Secretaría Anticorrupción y Buen Gobierno).

The website jibby.com.mx uses only technical cookies and technologies that are necessary for it to work, for example:

• Remembering the language you selected (Spanish or English).
• Keeping the website and its forms secure and working properly.

We do not use advertising cookies, tracking pixels or third-party trackers for marketing purposes, and we do not track your activity on other websites.

You can delete or block cookies from your browser settings; if you do so, some website features, such as your language selection, may not be kept between visits.

Jibby Chat, being a mobile app, does not use cookies. The technical information it collects is described in the section Data collected in Jibby Chat.

The website and Jibby Chat are not directed to persons under 18 years of age. Jibby Chat accounts are created by the client organization for its collaborators, so it is that organization's responsibility to ensure that users meet the minimum age.

If we become aware that data has been collected from a person under 18 without the appropriate authorization, we will delete it promptly. If you believe this has happened, write to us at soporte@jibby.mx.

This notice may be modified to reflect changes in legislation, in our privacy practices, in the Jibby Suite modules or in the providers we use.

Any change will be published on this website, at Privacy notice, with the date of the last update. When the change is substantial (for example, new purposes or new processors that involve a different kind of processing), we will also communicate it by email or through the app and, where applicable, through the organization you belong to. We recommend that you review this notice periodically.

For questions, comments or requests related to this notice or to the processing of your personal data:

• Email: soporte@jibby.mx
• Address: Ciudad del Carmen, Campeche, México
• Help center and contact form: Support
• Account deletion request: Delete account and data
• Terms and conditions: Terms and conditions

Date of last update of this notice: September 27, 2026. This version supersedes any previous version.