1Identity and domicile of the Data Controller
REVOLVER MEXICO, S.A.P.I. DE C.V. ("Revolver"), with domicile in Ciudad Juárez, Chihuahua, Mexico, is responsible for the processing of the personal data of its users, customers, prospects, credit applicants, borrowers, joint and several obligors, legal representatives, ultimate beneficial owners, administrators and authorized users of its technology platform, as well as of employees, representatives, contacts and other individuals connected with commercial counterparties, Maquiladoras and Buyers who interact with quotes, RFQs, purchase orders, MRO catalogs, CFDI invoices, compliance documents, messages, attachments or any other functionality enabled within the Platform, under the applicable legislation.
Revolver's official site is: https://usarevolver.mx/.
Revolver is not responsible for third-party sites that use similar domain names or appear to represent the company.
2Personal data department
Revolver maintains a personal data protection department responsible for handling requests relating to ARCO rights, withdrawal of consent, limitation of the use or disclosure of data, clarifications about processing, and security notifications.
Contact: legal@usarevolver.mx — Ciudad Juárez, Chihuahua, Mexico.
3Personal data subject to processing
Revolver may collect and process personal data of individuals connected with the commercial, technological or financial relationship with Revolver. The categories of personal data may include:
a) Identification data
- full name
- date of birth
- nationality
- CURP
- RFC
- signature
- official identification documents
- data contained in powers of attorney, corporate minutes or corporate documentation
b) Contact data
- telephone
- email address
- address
- tax domicile
c) Employment, professional and economic activity data
- role or position
- economic activity
- line of business
- length of time the business has operated
- relationship with the legal entity using the platform
d) Financial and asset data
- income
- ability to pay
- bank statements
- financial transactions
- information on existing credit
- financial history
- bank accounts related to the operation of the business
e) Tax data
- RFC
- tax status certificate
- issued and received CFDI invoices
- tax returns
- available tax acknowledgments and records
- tax information obtained from the SAT in accordance with the authorizations granted by the data subject or by the user company
f) Authentication, security and platform usage data
- login email address
- telephone number
- OTP codes
- IP address
- access records
- device type
- browser
- operating system
- technical and operational logs
g) Identity verification data
- photographs
- validation video calls
- document validation
- facial biometrics, where used for authentication or identity validation
h) Credit data
- information obtained from Credit Information Companies regarding the applicant company and, where applicable, the joint and several obligor
i) Interaction data of commercial counterparties, recipient third parties and Maquiladoras
- full name
- position or role
- company they belong to
- email address
- telephone
- authentication data (OTP)
- IP address and access records
- information contained in quotes, RFQs, comments, attachments, acceptances or rejections generated within the Platform
- technical specifications, quantities, conditions and deadlines included in RFQs issued by the Maquiladora
- electronic evidence relating to their interaction in commercial workflows enabled by a User
In the case of persons accessing the Platform on behalf of a Maquiladora — whether to respond to quotes or to issue RFQs — Revolver will process only the data strictly necessary to authenticate access, manage the corresponding workflow, and generate traceability and electronic evidence of the interaction, as set out in Section 7(j) of this Notice.
4Sensitive personal data
Revolver may process sensitive personal data only where it is strictly necessary for legitimate and specific purposes, and where an applicable legal basis or express consent exists.
For the purposes of this Notice, Revolver may treat the following as sensitive:
- biometric data, including facial biometrics
- data whose misuse could create a serious risk for the data subject
Where the processing of sensitive personal data requires express consent, Revolver will obtain it by handwritten signature, electronic signature, authenticated electronic acceptance or an equivalent mechanism permitted by law.
5Data of legal entities
Revolver may also process information relating to legal entities, including corporate or trade name, RFC, tax domicile, economic activity, financial information, corporate structure and information on legal representatives, administrators and ultimate beneficial owners.
Information relating to legal entities does not always constitute personal data in itself; however, Revolver may process the personal data of individuals connected with those entities in accordance with this Notice.
6How the data is obtained
Revolver may obtain personal data:
- directly from the data subject
- through the legal entity for which they provide services or which they represent
- through the use of the platform and its functionalities, including the Inventory, MRO Stores, Quotes, Fulfillment, CFDI Invoices and Liquidity modules
- through technology providers authorized by Revolver
- through transfers permitted by law
- through publicly accessible sources permitted by the applicable legislation
- through Credit Information Companies, where applicable authorization exists
- through queries to the SAT carried out via authorized technology providers
- through the receipt, review, acceptance, rejection or supplementing of quotes, RFQs, purchase orders or other commercial documents by commercial counterparties or Maquiladoras
- through access events, interactions, RFQ issuance, document uploads, comments, responses or events generated by Maquiladoras or Buyers enabled within the Platform
7Primary purposes of processing
Personal data will be processed for the following purposes necessary for the legal relationship with Revolver:
a) Account creation, administration and security
- create and administer accounts on the platform
- authenticate users, administrators, Maquiladoras and Buyers
- manage access, permissions and authorized users
- prevent unauthorized access, fraud or misuse
b) Provision of technology and SaaS services
- enable the use of Revolver's technology platform and its modules (Inventory, MRO Stores, Quotes, Fulfillment, CFDI Invoices and Liquidity)
- manage inventory catalogs and MRO products published by Users
- operate quoting workflows between suppliers and buyers, including the creation, sending, receipt, review, response, acceptance, rejection and follow-up of quotes
- manage requests for quotation (RFQ) initiated by Maquiladoras or Buyers and addressed to suppliers, whether or not they are registered Users of the Platform
- verify the documentary and tax compliance of commercial counterparties
- manage, issue, receive and validate CFDI electronic invoices
- provide technical support, maintenance, monitoring, auditing and continuous improvement of the service
- generate operational metrics, traceability and electronic evidence of acts carried out within the platform
c) Assessment, origination and administration of liquidity products
- receive and analyze credit or liquidity applications
- assess eligibility, risk and ability to pay
- determine amounts, terms, conditions and limits
- formalize contracts, electronic promissory notes and other associated documents
- administer disbursements, payments, collections and recovery
d) Access to and analysis of tax information
- access, retrieve and analyze tax information from the SAT via authorized technology providers
- validate tax identity and verify commercial transactions
- analyze income, expenditure, commercial behavior and risk
e) Credit queries and monitoring
- query information with Credit Information Companies
- carry out credit monitoring during the contractual or commercial relationship
- detect deterioration, risks, fraud or material events
f) Regulatory compliance and fraud prevention
- KYC, identity validation and document verification
- prevention of fraud, money laundering, impersonation and simulated transactions
- responding to requests from competent authorities
- defense of rights in administrative, judicial or out-of-court proceedings
g) Billing and tax compliance
- issue CFDI for SaaS subscriptions, commissions, interest, charges or other applicable items
- validate the recipient's tax information for invoicing
- manage collections and accounting or tax reconciliation
h) Analytical models and profiling
- develop, train and improve statistical models, scorecards, decision engines, fraud detection tools and internal financial and operational assessment processes
i) Management of commercial relationships between Users and counterparties
- enable the electronic exchange of commercial documentation between Users and their counterparties
- record responses, acceptances, rejections, comments and attachments uploaded by commercial counterparties
- manage permissions, authentication and access controls for recipient third parties and Maquiladoras
- retain electronic evidence and traceability associated with commercial interactions conducted through the Platform
- handle clarifications, incidents, technical disputes or verifications relating to the use of the Platform by non-customer third parties
j) Authentication, management and traceability of Maquiladora (Buyer) access
Where a Maquiladora or Buyer accesses the Platform free of charge — whether to respond to shared quotes or to issue RFQs directly to suppliers — Revolver will process the data of the individuals acting on its behalf solely in order to:
- authenticate access by email and OTP
- manage and transmit the RFQ to the recipient supplier or suppliers, whether or not they are registered Users of the Platform
- record and retain the access log, date, time, IP and device as electronic evidence of the interaction
- protect the shared commercial information (quotes, catalogs, RFQs) and prevent unauthorized access
- generate traceability of the actions carried out within the quoting or RFQ workflow (review, acceptance, rejection, sending, document upload, comments)
The processing of the Maquiladora's data is not intended for credit assessment, the contracting of SaaS services, the sending of Revolver's own commercial communications, or the opening of a business account.
Where circumstances justify it, Revolver may retain the Maquiladora's access data and RFQs for as long as necessary to comply with legal, audit or rights-defense obligations, as set out in Section 11 of this Notice.
Where Revolver uses automated processing forming part of decision-making processes without evaluative human intervention, it will disclose this to the extent applicable, in accordance with the Regulations.
8Secondary purposes
In addition, Revolver may process personal data for the following purposes that are not necessary for the principal legal relationship:
- sending information about improvements or new platform functionalities
- sending commercial information about SaaS services or financial products
- sending educational or informational content
- satisfaction surveys, market studies or product research
The data subject may object to the processing of their data for these secondary purposes by sending an email to: legal@usarevolver.mx.
Refusal for these purposes may not be grounds for denying the principal services.
Persons who access the Platform in the capacity of Maquiladora or Buyer will not be subject to secondary purposes arising from that access. Their data will be processed solely for the primary purposes set out in Section 7(j) of this Notice.
9Transfers of personal data
Revolver may transfer personal data domestically or internationally in the cases permitted by law.
a) Transfers that may be carried out without consent where a legal exception applies
Revolver may transfer data where the transfer is provided for in a law or treaty, is necessary for the performance of a legal relationship, is required by a competent authority, or is carried out within the same corporate group under common internal processes and policies.
b) Recipients of transfers or operational disclosures
Revolver may share data, as applicable, with:
- competent authorities
- Credit Information Companies
- technology providers and cloud infrastructure
- providers of authentication, OTP, electronic signature or document validation
- identity validation and biometrics providers
- collection agencies
- external advisors, auditors and lawyers
- financiers, funders, assignees and investors involved in the structuring, auditing or funding of the portfolio
- technology providers located outside Mexico, including Syntage Technologies, Inc.
- supplier recipients of an RFQ, to the extent that the RFQ issued by the Maquiladora contains Buyer identification data necessary to manage the request
Where a third party processes personal data on Revolver's behalf without deciding on the processing, it will act as a data processor, subject to instructions, confidentiality obligations and applicable security measures.
c) Consent for transfers that require it
Where a transfer does not fall within one of the legal grounds permitting it to be carried out without consent, Revolver will request the data subject's corresponding consent before carrying it out.
10Use of Syntage and other technology providers
Revolver may use Syntage Technologies, Inc. and other technology providers to perform functions necessary for the provision of services, including access to the SAT, retrieval of tax information, identity validation, CFDI retrieval, document verification and technology integration.
These third parties will act under Revolver's instructions or under the legal framework applicable to the service provided.
11Data retention, blocking and deletion
Revolver will retain personal data only for as long as necessary to fulfill the purposes described in this Notice and to comply with legal, regulatory, tax, contractual, audit, fraud-prevention and rights-defense obligations.
In the case of data obtained through a Maquiladora's access — including authentication records, access logs, evidence of interaction with quotes and the content of RFQs issued — Revolver will retain those records for as long as necessary to fulfill traceability, security and rights-defense purposes, without using them for any other purpose.
Once the data is no longer necessary, it will be deleted or blocked in accordance with the law.
12Security and confidentiality measures
Revolver implements and maintains administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction or unauthorized access.
All persons involved in the processing of personal data will be subject to confidentiality obligations that survive the termination of their relationship with Revolver.
13Security breaches
If a security breach occurs that significantly affects the data subject's economic or moral rights, Revolver will report that breach immediately so that the data subject may take the appropriate measures.
14ARCO rights
The data subject or their legal representative may exercise their rights of Access, Rectification, Cancellation and Objection at any time.
Requests must be sent to: legal@usarevolver.mx.
The request must include: the data subject's name, a means of receiving notifications, valid official identification, a document evidencing legal representation where applicable, a clear description of the data and of the right to be exercised, and any element that helps locate the information.
Revolver will communicate its determination within a maximum of 20 business days and will give effect to it within the following 15 business days. Those periods may be extended once for an equal period where circumstances justify it.
The exercise of ARCO rights will be free of charge, except for shipping, reproduction or certification costs permitted by the Regulations.
15Withdrawal of consent
The data subject may withdraw, at any time and without retroactive effect, the consent given for the processing of their personal data, where such processing is based on consent and no legal exception permits or requires its retention.
The request must be submitted to: legal@usarevolver.mx.
Withdrawal may prevent the continuation of certain services where the processing is necessary for the contractual relationship, legal compliance or the defense of rights.
16Options and means to limit use or disclosure
The data subject may request the limitation of the use or disclosure of their personal data by sending a request to: legal@usarevolver.mx.
Revolver may maintain internal exclusion lists to record, free of charge, the data subject's refusal to have their data processed for secondary purposes, in accordance with the Regulations.
17Cookies and similar technologies
The website and the platform may use cookies, web beacons and similar technologies to authenticate sessions, remember preferences, analyze use of the site and improve performance, security and functionality.
These technologies may collect information such as IP address, browser type, operating system, session identifiers and browsing activity within the site or the platform.
The user may disable certain cookies from their browser settings, although this could affect service functionality.
18Billing and tax data for paid services
Where the User contracts paid services, including SaaS subscriptions to the Platform's modules, Revolver will process the tax data necessary to issue the corresponding CFDI and to comply with accounting, tax and collection obligations.
The user will be responsible for keeping their tax information current and correct for invoicing purposes.
The Maquiladora's or Buyer's access through the Platform is free of charge and does not give rise to the issuance of any tax receipt payable by the Maquiladora for Revolver's services.
19Consent
By using the Platform, providing personal data, activating functionalities, accepting electronic contracts or requesting Revolver's products or services, the data subject acknowledges having read this Privacy Notice and consents to the processing of their personal data on the terms described herein. In the case of individuals who interact with the Platform in their capacity as representatives, employees, contacts, recipient third parties, Maquiladoras, Buyers or members of a User's commercial counterparties, the use of the corresponding functionality, electronic authentication, RFQ issuance, document upload, acceptance or rejection of documents, or any other interaction enabled within the Platform, will constitute evidence that this Notice was made available and, where applicable, of the consent that applies under the law.
19.1. Data provided by Users regarding commercial counterparties
Where a User provides Revolver with personal data of representatives, employees, contacts or third parties connected with its commercial counterparties or with Maquiladoras in order to enable quoting workflows, RFQs, purchase orders, commercial follow-up or document exchange within the Platform, that User represents that it has a sufficient legal basis to provide such data and to instruct the sending of communications or access relating to the corresponding commercial transaction.
19.2. Specific consent of the Maquiladora (Buyer)
Where an individual accesses the Platform on behalf of a Maquiladora — whether to review a shared quote or to issue an RFQ to a supplier — that access constitutes evidence that:
- the person has been informed of the existence of this Privacy Notice, available at https://usarevolver.mx/
- they accept that their access data (email address, OTP, IP, device and interaction logs) and the data included in the RFQ issued will be processed solely for the purposes of authentication, RFQ management, traceability and protection of commercial information
- their access does not imply the opening of an account, the contracting of SaaS services or the request of financial products
- they may exercise their ARCO rights by sending a request to legal@usarevolver.mx
20Amendments to the Privacy Notice
Revolver may amend or update this Privacy Notice as a result of legal, regulatory, technological, operational or business model changes.
The current version will be available at: https://usarevolver.mx/.
Where the changes are material, Revolver may communicate them through the website, the platform, email, an in-account message or any other reasonable means.
21Governing law and jurisdiction
This Privacy Notice is governed by the laws of the United Mexican States.
For any dispute relating to its interpretation or performance, the parties submit to the competent courts of Ciudad Juárez, Chihuahua, Mexico, unless a mandatory legal provision states otherwise.
22Permanent means of consultation
The data subject may consult this Privacy Notice at any time on Revolver's official site: https://usarevolver.mx/.