Privacy EN

Privacy Notice

SENTO MX, S.A.P.I. DE C.V.

Last updated: January 15, 2026
Privacy Notice version: 1.2

We are committed to communicating with you professionally and to protecting your confidential information. We use the data you provide us (name, address, phone number, email, etc.) to contact you and share information about our products and services.

We will not share your data with third parties outside our organization, except when strictly necessary to fulfill your request. This company does not sell, trade, or rent your personal data to third parties. See below for more information.

II. Purpose and Scope of the Privacy Notice

This Notice describes how Sento collects, uses, stores, and protects the personal data of:
‍
• Corporate clients and their representatives (individuals who contract or use Sento's services on behalf of their organization).
• Visitors to the website www.sento-ai.com (operated by us)
• Individuals who contact Sento through contact forms, email, or other communication channels.

This Notice does NOT apply to the personal data of end users (for example, individuals who take part in calls or chats analyzed through Sento's platform). Such data is processed by Sento in its capacity as Data Processor, as described in Section VII.

III. Personal Data We Collect

3.1 Client and prospect data

When an organization contracts or expresses interest in Sento's services, we collect various types of information. During use, we may ask you for certain personal information that can be used to contact or identify you. Such information may include, among others:
‍
- Your first and last name
- Your email address
- Your phone number
- Address, city, state/province, and postal code
- Billing information (name, tax ID, tax address) — data of a financial nature that, under Article 7 of the LFPDPPP, requires your express (not implied) consent.

Sento only collects personal data that is necessary, adequate, and relevant to the purposes described in this Notice, in accordance with the principle of proportionality established in Article 12 of the LFPDPPP.

3.2 Website visitor data

When you browse www.sento-ai.com, we automatically collect the following data:
Your device's IP address
Browser type and version.
Pages visited
Date and time of the visit.
Time spent on pages.
Unique device identifiers and diagnostic data. This data is used for two purposes: (a) analyzing site traffic and usage through Google Analytics 4, and (b) displaying relevant advertising and content on other platforms (Meta, Google Ads, LinkedIn). Analytics and marketing cookies are activated only with your prior consent. For more information on the technologies used and how to manage your preferences, see Section VIII.

3.3 Contact form data

When you browse www.sento-ai.com, we automatically collect the following data:
‍
- Your device's IP address
- Browser type and version.
- Pages visited
- Date and time of the visit.
- Time spent on pages.
- Unique device identifiers and diagnostic data.

This data is used for two purposes: (a) analyzing site traffic and usage through Google Analytics 4, and (b) displaying relevant advertising and content on other platforms (Meta, Google Ads, LinkedIn). Analytics and marketing cookies are activated only with your prior consent. For more information on the technologies used and how to manage your preferences, see Section VIII.

IV. Purposes of Processing

4.1 Primary purposes (do not require additional consent)

These purposes are necessary for the contractual or business relationship with Sento:
‍
- Providing, managing, and supporting the contracted services.
- Processing payments and managing billing.
- Complying with contractual and legal obligations.
- Handling requests, inquiries, and complaints.
- Managing platform access and account security, in accordance with the controls established in our Information Security Management System certified under the ISO 27001 standard.
- Sending transactional communications related to the contracted service (notifications, alerts, confirmations).

4.2 Secondary purposes (require your consent)

The following purposes are not necessary for providing the service, but allow us to improve our offering and keep you informed:

- Sending marketing communications such as event invitations, newsletters, news, and promotions for Sento's products and services.
- Conducting satisfaction surveys and market research.
- Personalizing content and advertising on our website and other digital platforms through marketing cookies (see Section VIII).

If you do not want your data processed for any or all of these purposes, you may state so at any time through the following mechanisms:

- For marketing communications: by clicking the unsubscribe link included in any of our communications, or by writing to comercial@sento-ai.com to submit your request.
- For marketing and personalization cookies: through the cookie management panel available on our website.
- For any other secondary purpose: by sending your request to comercial@sento-ai.com.

Declining to have your data processed for secondary purposes will not affect the provision of the contracted services.

Unsubscribing from marketing communications or secondary purposes does not affect the sending of administrative or transactional notifications related to your account or the contracted services, which are necessary for providing the service.

V. Legal Basis for Processing

Contract performance: processing is necessary to fulfill the services agreement signed with your organization.

‍Legal obligation: when processing is necessary to comply with an applicable legal provision, including tax, accounting, and anti-money-laundering obligations.

‍Compliance with the legal relationship and security: processing necessary to protect the platform and prevent fraud is carried out without additional consent, pursuant to Article 9, Section IV, and the security duty under Article 18 of the LFPDPPP.

‍Consent: for the secondary purposes described in Section IV.2, including sending marketing communications and personalizing advertising. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to such withdrawal.

VII. Sento as Data Processor for Conversation Data

Sento's conversational analytics platform processes recordings of calls, chats, and other interactions of its clients' end users (contact centers and companies). In this context:

- The client (contact center or contracting company) is the Data Controller for such data, under the terms of Article 2, Sections XII, XIV, and XVI, of the 2025 LFPDPPP.

- Sento acts exclusively as Data Processor, without any decision-making power over the purposes or means of processing, and processes such data solely in accordance with the documented instructions of the client-controller.
‍
- Recordings, transcripts, and other conversation data are kept encrypted in transit and at rest, and are processed exclusively through automated means by Sento's platform. No Sento personnel access, listen to, read, or review the content of such conversations.

- Sento does not use this data for its own purposes, commercialization, training models unrelated to the service, or any purpose other than that agreed with the client-controller. Sento will not transfer, sell, or assign such data to third parties without the client-controller's express authorization.

- At the end of the business relationship, Sento will delete or return the data to the client-controller as contractually agreed. The maximum operational retention period for recordings is 6 months, unless otherwise instructed by the client-controller.

The responsibility for issuing the Privacy Notice to end users whose conversations are analyzed rests exclusively with the client-controller, not with Sento.

Sento formalizes this relationship through Data Processing Agreements with each client, which include confidentiality obligations, security measures, subcontracting restrictions, and breach-response protocols.

VIII. Cookies and Tracking Technologies

The website www.sento-ai.com uses cookies and similar technologies to improve the browsing experience and analyze site usage. The types of cookies we use are:

Session cookies: necessary for the basic functioning of the site. They do not require consent.
‍Preference cookies: remember your settings between visits.
‍Analytics cookies: let us understand how the site is used (for example, Google Analytics). They transfer anonymized data to Google LLC.
‍Marketing cookies: measure the effectiveness of our campaigns and display relevant content. They transfer behavioral data to LinkedIn.

The use of analytics and marketing cookies is based on legitimate interest under the 2025 LFPDPPP

IX. Transfers of Personal Data

Transfers made by the Data Controller will comply with the provisions of Article 36 of the LFPDPPP and other applicable regulatory provisions.

9.1 Operations in Guatemala

Sento has operational offices in Guatemala. Personal data transfers between the group's entities (Mexico and Guatemala) are made under Article 36, which allows transfers to companies within the same corporate group operating under the same internal processes and policies.

Sento guarantees, through internal agreements, that processing carried out in that jurisdiction observes the same protection standards established in this Notice and in the 2025 LFPDPPP.

X. Data Security

Sento holds ISO 27001 certification, which confirms the implementation of an Information Security Management System (ISMS) in accordance with international standards. This system establishes the administrative, technical, and physical controls applicable to the processing of personal data, in compliance with Article 18 of the 2025 LFPDPPP.

Measures implemented include, on a non-exhaustive basis: role-based access control, encryption of data in transit and at rest, continuous security monitoring, vulnerability management, and incident response plans.

In the event of a security breach that significantly affects the property or moral rights of data subjects, Sento will provide notice in accordance with Article 19 of the 2025 LFPDPPP.

All individuals involved in the processing of personal data are subject to confidentiality obligations that survive even after the employment or business relationship with Sento has ended, pursuant to Article 20 of the 2025 LFPDPPP.

XI. ARCO Rights and Mechanisms to Exercise Them

In accordance with the LFPDPPP, the data subject has the right to access ("Access") the data held by the Data Controller and details of its processing; to rectify it if inaccurate or incomplete ("Rectification"); to cancel it under the terms of the LFPDPPP ("Cancellation"); to object to its processing for specific purposes ("Objection"); and to withdraw consent ("Withdrawal") — together known as ARCO rights. The data subject or their legal representative may exercise the rights described above by sending an email to the following address: comercial@sento-ai.com stating that you wish to exercise your ARCO rights or right of withdrawal. This request may be submitted through a free-form written request considering the elements of Article 28 of the LFPDPPP, or through the form provided by the Information Privacy Office, if the data subject so requests. For the free-form written request mentioned above, the following requirements must be met: - Name of the data subject. - Official identification of the data subject. - Email address to receive the response to your request. - Clear and precise description of the personal data for which you seek to exercise any of the rights mentioned above.

If the right is exercised through a representative, official identification and a document proving representation must be provided. If the information provided in the request is insufficient, incorrect, or the necessary supporting documents are missing, the Data Controller may request the information and/or documentation needed to process it, in accordance with Article 96 of the Regulations. The data subject will have 10 business days to respond to such a request. The Data Controller will respond to your request with its determination within 20 business days of receiving the request. This period may be extended once for an equal period, in accordance with Article 31 of the LFPDPPP. If the request is granted, it will be carried out within 15 business days. If you exercise the right of "Access," the information or personal data requested will be provided as simple copies or electronic documents sent to the email address indicated in your request. The Data Controller may deny "Access" to personal data, or deny "Rectification," "Cancellation," or "Objection" to its processing, under the circumstances set out in Article 33 of the LFPDPPP. The Data Controller is not obligated to cancel the data subject's personal data under the circumstances set out in Article 25 of the LFPDPPP. Consent may be withdrawn at any time, as established in Article 7 of the LFPDPPP. To clarify questions about the procedure and requirements for exercising ARCO rights and withdrawal, the responsible area is the Information Privacy Office, reachable at: comercial@sento-ai.com

XIV. Applicable Law and Jurisdiction

This Privacy Notice is governed by and interpreted in accordance with applicable Mexican law, in particular:
‍
- The Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Federal Gazette (DOF) on March 20, 2025.
- El Reglamento y los Lineamientos que resulten aplicables en materia de protección de datos personales, en lo que no se opongan a la presente Ley.

For any dispute arising from the processing of personal data, the data subject may file a complaint with the Anti-Corruption and Good Governance Secretariat of the Mexican Federal Government, the supervisory authority for personal data protection in the private sector.

For purposes of any legal action arising from this Notice, the parties submit to the jurisdiction of the competent courts of Mexico City, waiving any other jurisdiction that might correspond to them by reason of their present or future addresses.