Privacy Policy

Last Updated: November 4, 2026

CORPORACIÓN OTIF LOGÍSTICA INTEGRADA, S.A. DE C.V. ("OTIF," "we," "us," or "our") respects your right to privacy, and we are dedicated to securing and protecting any information we have about you. This Privacy Policy describes the ways we collect, use, and share information that relates to an identifiable individual ("Personal Data") in connection with the OTIF UMM messaging and collaboration workspace (the "Service"), and how you can exercise your rights under applicable privacy and data protection laws.

If you have any questions or concerns about our use of your Personal Data, or if you wish to exercise any of your privacy rights including the right to object (where applicable), then please contact us using the contact details under 'How to Contact Us' at section 14 below.

OTIF is headquartered in Mexico. For jurisdiction specific provisions of this Privacy Policy see the 'Jurisdiction-Specific Provisions' at section 9 below.

We recommend that you read this Privacy Policy in full to ensure you are completely informed about OTIF's collection and use of your Personal Data.

By creating or using an account in the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the terms of this Privacy Policy, you must not use the Service.

Table of Contents

• Applicability of this Privacy Policy
• Minors' Data
• Personal Data We Collect and Process
• How We Use Personal Data
• Who We Share Your Personal Data With
• How We Keep Your Personal Data Secure
• Data Retention
• International Data Transfers
• Jurisdiction-Specific Provisions
• Your Data Protection Rights
• Data Ownership
• Prohibited Conduct
• Updates to This Privacy Policy
• How to Contact Us
• Subprocessors

1. Applicability of this Privacy Policy

This Privacy Policy describes how OTIF collects, uses, discloses, and otherwise processes Personal Data in connection with the OTIF UMM messaging and collaboration workspace, powered by the Zulip software platform and accessible at zulip.otif.mx and through the Zulip desktop and mobile applications (the "Service").

This Privacy Policy applies to all users holding an account in the OTIF UMM organization, including OTIF employees, independent contractors, and any external collaborators invited to participate in the organization (collectively, "Users"). The Service is an internal business communication tool operated by OTIF for the coordination of its corporate operations and logistics services.

If you are an OTIF employee or contractor, your use of the Service is also governed by OTIF's internal policies and your employment or services agreement. This Privacy Policy supplements, and does not replace, those instruments. This Privacy Policy governs only where OTIF is the data controller responsible for the processing of Personal Data.

2. Minors' Data

The Service is intended solely for use by adults in a business context. The Service is not directed at individuals under the age of eighteen (18) years, and we do not knowingly collect Personal Data from individuals under eighteen (18) years of age.

If you have reason to believe that a minor under the age of 18 has provided Personal Data to OTIF through the Service, please email us at privacy@otif.mx and we will take steps to remove that information from our servers.

3. Personal Data We Collect and Process

OTIF collects and processes Personal Data in connection with the provision of the Service. The Service is designed for business communications; the categories of data described below may contain Personal Data to the extent that they relate to an identifiable individual. Below is a description of the categories of data we collect:

3.1 Account and Registration Data

Creating an account in the Service requires a full name and an email address. Your password is stored only as a cryptographic salted hash. You may optionally provide a profile picture, timezone, and other profile information. Account data also includes your role within the organization (e.g., member, administrator, guest) and account status.

3.2 Message Content

The Service stores the content of messages you send, including messages posted to channels (streams and topics), direct messages, and group direct messages, together with associated metadata such as timestamps, emoji reactions, and message edit history. Message content may include Personal Data that you or other Users choose to share. The visibility of message content is governed by the Service's permission model: channel messages are visible to organization members with access to the corresponding channel, and direct messages are visible only to their participants.

3.3 Files and Attachments

Messages may include files and attachments (for example, documents, spreadsheets, and images) that you upload through the Service. Uploaded files are stored by the Service and are subject to the same visibility rules as the messages that contain them.

3.4 AI-Assisted Operations

OTIF operates artificial intelligence assistants ("AI Assistants," including OpenClaw agents) that are integrated into specific channels of the Service. If you send a message in a channel served by an AI Assistant, or if you address an AI Assistant directly, the content of your message may be processed by that AI Assistant, under OTIF's control and on OTIF-managed infrastructure, for the sole purpose of performing the task you request or the functions assigned to that assistant. Messages in channels and conversations without an AI Assistant are not processed by AI Assistants.

3.5 Technical and Session Data

The Service collects technical information necessary to operate, secure, and troubleshoot the platform, including IP addresses, browser and device information, access timestamps, session cookies and tokens, and API keys associated with your account.

3.6 Push Notification Data

If you enable push notifications on mobile or desktop applications, the information necessary to deliver those notifications — including a minimal excerpt of the message content — may be processed by Google (Firebase Cloud Messaging) for Android devices and by Apple (Apple Push Notification service) for Apple devices. If you do not wish to have this data processed for this purpose, you can disable push notifications at any time in your device or application settings.

3.7 Server Logs

The Service maintains server logs containing IP addresses, timestamps, and request information for security, fraud prevention, and abuse prevention purposes.

3.8 Data We Do Not Collect

The Service does not use third-party advertising SDKs, cross-site trackers, or third-party analytics cookies, and we do not sell Personal Data. As part of the Service's functionality, we do not collect precise geolocation, health or medical data, fitness data, biometric data, or payment card data.

3.9 Prohibition on Transmission of Sensitive Personal Data

You should not transmit sensitive personal data — such as passwords, credentials, government identification numbers, financial account numbers, health information, or sensitive personal data of third parties — through the Service, except where strictly necessary and directly relevant to a legitimate business operation. The Service is not designed to collect or process such information as part of its functionality, and OTIF does not request such information to provide the Service. If you become aware that sensitive personal data has been inadvertently transmitted through the Service, you should promptly notify OTIF at privacy@otif.mx so that appropriate measures may be taken.

4. How We Use Personal Data

We process Personal Data exclusively for purposes directly related to the operation of the Service and OTIF's legitimate business operations. Specifically, we use data for the following purposes:

4.1 Service Functionality and Delivery

All data collected through the Service is used solely for service functionality. This includes:

• Account Provisioning and Authentication: Creating, authenticating, and administering user accounts.
• Message Delivery and Storage: Delivering, storing, indexing, and making searchable the messages and files exchanged through the Service.
• Notifications: Delivering push, desktop, and email notifications about messages and mentions, where enabled.
• Access and Permission Management: Administering channel subscriptions and permission models so that content is visible only to the appropriate audiences.
• AI-Assisted Operations: Processing message content through OTIF-controlled AI Assistants to perform requested tasks and assigned functions, as described in section 3.4.
• Operational Coordination: Facilitating internal collaboration and coordination of OTIF's corporate operations and logistics services.

4.2 Evidentiary and Legal Purposes

Messages, files, and associated records constitute OTIF business records. Data collected through the Service may be used as records with evidentiary value for internal investigations, dispute resolution, insurance claims, audits, or legal proceedings.

4.3 Purposes for Which We Do Not Use Data

We do not use data collected through the Service for third-party advertising, first-party advertising or marketing, or any purpose beyond what is necessary to provide the Service and support OTIF's legitimate business operations, security, and legal obligations.

5. Who We Share Your Personal Data With

5.1 Visibility Within the Organization

Message content is shared with other Users strictly according to the Service's permission model: channel messages with members of the corresponding channel, and direct messages with their participants only. Organization administrators may access content as necessary for administration, security, and compliance purposes.

5.2 OTIF Services and AI Assistants

The Service is a first-party OTIF system. All API calls are first-party calls to OTIF-managed servers. Message content may be processed by OTIF-controlled AI Assistants as described in section 3.4, or by other OTIF systems where necessary to fulfill a request you make (for example, linking an operational record you reference in a message).

5.3 Service Providers and Subprocessors

We use a limited set of subprocessors to operate the Service, as listed in section 15 (Subprocessors). These providers process data only on OTIF's instructions and for the purposes of hosting the Service and delivering notifications.

5.4 No Data Brokers

We do not share any data with data brokers.

5.5 No Advertising Networks

We do not share email lists, advertising IDs, device IDs, or other identifiers with third-party advertising networks for retargeting, lookalike audience purposes, or any other advertising-related purpose.

5.6 Legal and Regulatory Disclosures

We may disclose Personal Data if required to do so by law or in response to valid requests by public authorities, including to meet national security or law enforcement requirements. We may also disclose Personal Data to: (a) conform to the law, comply with legal process, or investigate, prevent, or take action regarding suspected or actual illegal activities; (b) to enforce our internal policies and terms, to take precautions against liability, to investigate and defend ourselves against any claims or allegations, or to protect the security or integrity of our systems; and/or (c) to exercise or protect the rights, property, or personal safety of OTIF, our employees, or others.

5.7 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or other sale of all or a portion of our assets, Personal Data held by us may be among the assets transferred to the acquiring entity. We will provide notice before Personal Data is transferred and becomes subject to a different privacy policy.

6. How We Keep Your Personal Data Secure

OTIF implements appropriate technical and organizational measures designed to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include:

6.1 Encryption in Transit

All data transmitted between your devices and our servers is encrypted using Secure Sockets Layer (SSL)/Transport Layer Security (TLS) encryption.

6.2 Access Controls

We implement per-identity access controls on OTIF-managed cloud infrastructure to ensure that only authorized personnel can access data, and we apply least-privilege principles for administrative access.

6.3 Authentication Protections

Passwords are stored only as cryptographic salted hashes. Two-factor authentication (2FA) is available for user accounts, and API keys and sessions can be revoked by users or administrators at any time.

6.4 Data Minimization by Design

The Service's permission model ensures that message content is visible only to the audiences for which it is intended. The Service does not track users across third-party websites or online services.

While we strive to use commercially reasonable means to protect Personal Data, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your data.

6.5 Data Breach Notification

In the event of a data breach that affects your Personal Data, we will notify you and the relevant supervisory authorities in accordance with applicable law.

7. Data Retention

We retain data collected through the Service for the following periods:

Deleted messages and files are removed from the Service upon deletion and are purged from backups within thirty (30) days. Please note that messages sent by a user whose account is later deactivated remain as organizational business records, attributed to a deactivated user rather than to an identified individual, and copies of message content already delivered by email notification or already received by other Users cannot be recalled retroactively.

Notwithstanding the foregoing, we may retain data beyond the standard retention period in the following circumstances:

• Pending or Threatened Legal Proceedings: Where data is relevant to pending litigation, arbitration, regulatory investigation, or where we have a reasonable belief that legal proceedings may be commenced.
• Legal Holds: Where data is subject to a valid legal hold, preservation notice, or similar legal requirement.
• Regulatory Requirements: Where longer retention is required by applicable law or regulation.
• Ongoing Contractual Obligations: Where retention is necessary to fulfill ongoing obligations to OTIF's clients and business partners.

Early Deletion. Users may delete their own messages and files subject to the organization's settings, and may request deletion of their account data, subject to applicable legal exceptions.

8. International Data Transfers

8.1 Data Storage Location

Data collected through the Service is stored on servers located in the United States of America.

8.2 Transfers from Mexico

For users located in Mexico; by using the Service you consent to the transfer of your data to the United States, which may have different data protection laws than Mexico. OTIF will take appropriate measures to ensure that your data is treated securely and in accordance with this Privacy Policy and applicable Mexican law, including the LFPDPPP.

8.3 Transfers from the European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, United Kingdom, or Switzerland, please note that data collected through the Service will be transferred to and processed in the United States. The United States may not provide the same level of data protection as your home jurisdiction. When we transfer Personal Data outside of the EEA, United Kingdom, or Switzerland, we will implement appropriate safeguards to ensure that such data receives an adequate level of protection, which may include: (a) transfers to countries that have been deemed to provide an adequate level of data protection by the European Commission; (b) the use of Standard Contractual Clauses approved by the European Commission; or (c) other lawful transfer mechanisms. You may request a copy of the relevant safeguards by contacting us at the contact details provided below.

9. Jurisdiction-Specific Provisions

This Section 9 provides additional information for users located in specific jurisdictions regarding how we collect, use, and disclose Personal Data, and describes certain rights you may have under applicable law. These jurisdiction-specific provisions supplement the other sections of this Privacy Policy. In the event of a conflict between this Section 9 and other provisions of this Privacy Policy, this Section 9 shall control with respect to users located in the applicable jurisdiction.

9.1 Mexico (LFPDPPP)

If you are a data subject located in Mexico, the following provisions apply in accordance with the LFPDPPP and its Regulations:

Responsible Party. CORPORACIÓN OTIF LOGÍSTICA INTEGRADA, S.A. DE C.V. is the responsible party ("Responsable") for the processing of your Personal Data under the LFPDPPP.

Purposes of Processing. Your Personal Data is processed for the primary purposes described in Section 4 of this Privacy Policy, which are necessary for the provision of the Service and OTIF's legitimate business operations. We do not process your Personal Data for secondary purposes such as marketing, advertising, or profiling.

Sensitive Personal Data. We do not request or knowingly collect sensitive Personal Data ("datos personales sensibles") as defined under Article 3, Section VI of the LFPDPPP as part of the Service's functionality, including data revealing racial or ethnic origin, present or future health status, genetic information, religious, philosophical or moral beliefs, union membership, political opinions, or sexual preference.

ARCO Rights. Under the LFPDPPP, you have the right to access, rectify, cancel, or oppose (collectively, "ARCO Rights") the processing of your Personal Data. To exercise your ARCO Rights, please submit a written request to privacy@otif.mx containing:

• (a) your name and contact information;
• (b) a clear description of the Personal Data with respect to which you seek to exercise any of your ARCO Rights;
• (c) any other element that facilitates the location of your Personal Data; and
• (d) in the case of rectification requests, indication of the modifications to be made and documentation supporting your request.

Consent. By creating or using an account in the Service, you consent to the processing of your data as described in this Privacy Policy.

Limitation on Use or Disclosure. You may limit the use or disclosure of your Personal Data by contacting us at privacy@otif.mx.

Revocation of Consent. You may revoke consent to the processing of your Personal Data at any time by contacting us at privacy@otif.mx. Please note that revocation of consent may affect your ability to use the Service, and that certain data may be retained as organizational business records under the exceptions described in Section 7.

Transfer of Personal Data. By using the Service, you consent to the transfer of your Personal Data to servers located in the United States for the purposes described in this Privacy Policy.

Changes to Privacy Policy. Any changes to this Privacy Policy will be published at https://otif.mx/privacy/zulip.

9.2 United States

If you are a consumer located in the United States ("US"), we process your Personal Data in accordance with US privacy laws, including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 ("CCPA").

Categories of Personal Information Collected. In the preceding twelve (12) months, we have collected the following categories of personal information as defined under the CCPA/CPRA:

• Identifiers (name, email address, account identifiers, API keys)
• Customer records — information sufficient to identify you and associated with with your account and communications (message content, files and attachments)
• Internet or other electronic network activity information (session data, server logs)

Sources of Personal Information. We collect personal information directly from you through your use of the Service and automatically from your devices when you access the Service.

Business or Commercial Purposes. We collect personal information for the business purposes described in Section 4 of this Privacy Policy, specifically for service functionality and evidentiary/legal purposes.

Categories of Third Parties with Whom Personal Information is Shared. We share personal information only with the subprocessors listed in Section 15 that operate the Service (hosting and notification delivery), and through the Service's permission model as described in Section 5. We do not sell personal information and have not sold personal information in the preceding twelve (12) months.

Sale or Sharing of Personal Information. We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.

Sensitive Personal Information. We do not collect sensitive personal information as part of the Service's functionality, including precise geolocation. Message content is not used to infer characteristics about you.

Your California Privacy Rights. Subject to certain exceptions, California residents have the following rights:

• Right to Know: You have the right to request that we disclose what personal information we have collected, used, disclosed, and sold about you.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising; therefore, there is no need to opt out.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information as part of the Service's functionality; therefore, this right does not apply.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise your rights, please contact us at privacy@otif.mx. We will respond to verifiable consumer requests within forty-five (45) days.

Authorized Agents. You may designate an authorized agent to submit requests on your behalf. To do so, you must provide the authorized agent with written permission to act on your behalf, and we may require you to verify your identity directly with us and confirm that you have authorized the agent. If your authorized agent submits a request, we may require them to submit proof of their authorization to act on your behalf.

Do Not Track Signals. The Service is a messaging application and does not respond to "Do Not Track" browser signals. The Service does not track users across third-party websites or online services, and therefore Do Not Track signals are not applicable to the Service's functionality.

Retention. We retain personal information as described in Section 7 of this Privacy Policy.

9.3 European Economic Area (EEA), United Kingdom, and Switzerland

If you are located in the European Economic Area ("EEA"), United Kingdom ("UK"), or Switzerland, the following provisions apply to the processing of your Personal Data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK General Data Protection Regulation ("UK GDPR"), and the Swiss Federal Act on Data Protection, as applicable.

Data Controller. CORPORACIÓN OTIF LOGÍSTICA INTEGRADA, S.A. DE C.V. is the data controller responsible for your Personal Data.

Legal Bases for Processing. Under the GDPR and UK GDPR, we are required to have a valid legal basis for processing your Personal Data. The legal bases we rely upon are described below:

Contractual Necessity (Article 6(1)(b) GDPR). We process Personal Data necessary to provide the Service to you, including creating and authenticating your account and delivering, storing, and making available the messages and files you exchange through the Service.

Legitimate Interests (Article 6(1)(f) GDPR). Our legitimate interests include: (a) enabling efficient internal collaboration and coordination of OTIF's business operations; (b) maintaining the integrity and security of OTIF's systems, including fraud and abuse prevention; (c) creating evidentiary business records for dispute resolution, audits, insurance claims, and legal proceedings; and (d) operating OTIF-controlled AI Assistants to automate and assist business functions. Where we rely on legitimate interests, we have conducted a balancing test and determined that our legitimate interests do not override your rights and freedoms, particularly given the business-to-business nature of the Service, the permission model that limits content visibility to intended audiences, and the fact that use of the Service occurs in an employment or business context.

Legal Obligation (Article 6(1)(c) GDPR). We process Personal Data where such processing is necessary for compliance with a legal obligation to which we are subject, including responding to lawful requests from public authorities and complying with applicable legal, tax, and accounting obligations.

Consent (Article 6(1)(a) GDPR). In certain limited circumstances, such as push notification delivery, we may process Personal Data based on your consent. Where we rely on consent, you have the right to withdraw your consent at any time (for example, by disabling push notifications or by contacting us at privacy@otif.mx). Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

The following table sets forth the purposes for which we process Personal Data, the legal bases for such processing, and the categories of Personal Data processed for each purpose:

Your Rights Under the GDPR. Subject to applicable law, you have the following rights:

• Right of Access (Article 15 GDPR): You have the right to obtain confirmation as to whether Personal Data concerning you is being processed and, if so, to access that data.
• Right of Rectification (Article 16 GDPR): You have the right to request rectification of inaccurate Personal Data.
• Right of Erasure ("Right to be Forgotten") (Article 17 GDPR): You have the right to request erasure of your Personal Data in certain circumstances.
• Right to Restriction of Processing (Article 18 GDPR): You have the right to request restriction of processing in certain circumstances.
• Right to Data Portability (Article 20 GDPR): You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format.
• Right to Object (Article 21 GDPR): You have the right to object to processing based on legitimate interests.
• Right to Withdraw Consent (Article 7(3) GDPR): Where processing is based on consent, you have the right to withdraw consent at any time.
• Right to Lodge a Complaint (Article 77 GDPR): You have the right to lodge a complaint with a supervisory authority in your country of residence.

To exercise your rights, please contact us at privacy@otif.mx.

International Transfers. Please see Section 8 of this Privacy Policy regarding international data transfers.

10. Your Data Protection Rights

10.1 Accessing, Correcting, or Deleting Your Data

We handle requests for data access, correction, or deletion on a case-by-case basis. To make such a request, please contact privacy@otif.mx. We will respond to your request in accordance with applicable law.

10.2 Managing Your Messages and Profile

You may edit or delete your own messages subject to the organization's settings, update your profile information, and export or revoke your API keys and active sessions from your account settings.

10.3 Account Deactivation

You may request deactivation of your account by contacting your organization administrators or privacy@otif.mx. As described in Section 7, messages you previously sent remain as organizational business records, attributed to a deactivated user rather than to an identified individual.

10.4 Jurisdiction-Specific Rights

For information about your specific rights under Mexican, California, or EU/UK law, please see Section 9 of this Privacy Policy.

11. Data Ownership

All content transmitted through the Service, including messages, files, and associated records, constitutes organizational business records of OTIF. Such content is made available to Users according to the Service's permission model. Users do not acquire ownership of OTIF's data by accessing it through the Service.

12. Prohibited Conduct

The following conduct is prohibited when using the Service:

• Credential Sharing: Sharing your password, API keys, or account access with third parties is prohibited.
• Circumventing Permissions: Attempting to access channels, direct messages, or content that has not been shared with you, or circumventing the Service's permission model, is prohibited.
• Scraping and Harvesting: Bulk extraction, scraping, or harvesting of message content or user data through automated means, except where expressly authorized by OTIF, is prohibited.
• Harmful Content: Transmitting malware or any code intended to harm the Service or its Users is prohibited.
• Unnecessary Disclosure of Sensitive Personal Data: Transmitting sensitive personal data of yourself or third parties, except where strictly necessary and directly relevant to a legitimate business operation, is prohibited as described in Section 3.9.

Without limiting any other rights or remedies available to OTIF, Users found to have engaged in prohibited conduct may face: (a) immediate termination of access to the Service; (b) reporting to their employer or contracting company; and (c) removal from the OTIF UMM organization.

13. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we make material changes to this Privacy Policy, we will notify you by posting the updated Privacy Policy at https://otif.mx/privacy/zulip and updating the "Last Updated" date at the top of this document, and we may also announce material changes within the Service.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data. Your continued use of the Service following the posting of changes constitutes your acceptance of such changes.

14. How to Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• General Privacy Inquiries: privacy@otif.mx

15. Subprocessors

EEA Representative: to be appointed